diff --git a/.github/workflows/publish-policy-packs.yml b/.github/workflows/publish-policy-packs.yml
index 6b6031d..85ba573 100644
--- a/.github/workflows/publish-policy-packs.yml
+++ b/.github/workflows/publish-policy-packs.yml
@@ -40,6 +40,20 @@ jobs:
       - name: Install exact dependencies
         run: bun install --frozen-lockfile
 
+      - name: Install verified Gitleaks
+        env:
+          GITLEAKS_ARCHIVE: gitleaks_8.30.1_linux_x64.tar.gz
+          GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
+          GITLEAKS_VERSION: 8.30.1
+        run: |
+          set -euo pipefail
+          curl --fail --silent --show-error --location \
+            --output "$RUNNER_TEMP/$GITLEAKS_ARCHIVE" \
+            "https://github.com/gitleaks/gitleaks/releases/download/v$GITLEAKS_VERSION/$GITLEAKS_ARCHIVE"
+          printf '%s  %s\n' "$GITLEAKS_SHA256" "$RUNNER_TEMP/$GITLEAKS_ARCHIVE" | sha256sum --check --strict
+          tar --extract --gzip --file "$RUNNER_TEMP/$GITLEAKS_ARCHIVE" --directory "$RUNNER_TEMP" gitleaks
+          printf '%s\n' "$RUNNER_TEMP" >> "$GITHUB_PATH"
+
       - name: Validate publication inputs and source
         id: inputs
         env:
diff --git a/docs/integrations/ci/github-actions-plan.yml b/docs/integrations/ci/github-actions-plan.yml
index c903071..836b272 100644
--- a/docs/integrations/ci/github-actions-plan.yml
+++ b/docs/integrations/ci/github-actions-plan.yml
@@ -26,7 +26,7 @@ jobs:
           terraform show -json "$RUNNER_TEMP/plan.tfplan" > "$RUNNER_TEMP/plan.json"
       # Rootform reads completed files, runs no provider, and publishes only
       # the Form and derived reports. Summary and artifacts default to on.
-      - uses: rootform-dev/action@17cf0cbefae80ac388b54e0329dd40f3cd0f659e # v1
+      - uses: rootform-dev/action@86eb7a7ca072d3564c4ca66f074cdc2e2763bf04 # v1.0.0
         id: rootform
         with:
           version: 0.2.0