diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 7126b19..7c4e10c 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -10,6 +10,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - name: Secret scan
+        uses: trufflesecurity/trufflehog@v3.79.0
+        with:
+          path: ./
+          extra_args: --only-verified
       - name: Backend tests in isolated PostgreSQL stack
         run: sh scripts/run-isolated-tests.sh
       - name: Backend static checks