diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 000000000..6c652a062
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,6 @@
+[whitelist]
+# As of v4, gitleaks only matches against filename, not path in the
+# files directive.  Leaving content for backwards compatibility.
+files = [
+  "secrets/*",
+]