diff --git a/scripts/scan_secrets.sh b/scripts/scan_secrets.sh
new file mode 100644
index 00000000..812b8fa5
--- /dev/null
+++ b/scripts/scan_secrets.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+TRUFFLEHOG_IMAGE="ghcr.io/trufflesecurity/trufflehog:3.97.0@sha256:ff4c95e9df7d645daf2140e3ca1039031c63106268d5fbb25feb43ceca1bcc33"
+CONTAINER_ID=""
+
+cleanup() {
+  if [ -n "$CONTAINER_ID" ]; then
+    docker rm -f "$CONTAINER_ID" >/dev/null 2>&1 || true
+  fi
+}
+trap cleanup EXIT
+
+# Gitea/act jobs themselves run inside a container. A normal `docker run -v
+# "$ROOT:/repo"` therefore asks the host Docker daemon to mount a path that
+# exists only inside the job container. `docker cp` transfers the checked-out
+# tree through the Docker API instead and works in both native and nested jobs.
+CONTAINER_ID="$(docker create "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --no-update --fail)"
+docker cp "$ROOT/." "$CONTAINER_ID:/repo"
+docker start -a "$CONTAINER_ID"
+
+echo "Verified-secret scan passed."