diff --git a/.github/workflows/secret-scan-pulse.yml b/.github/workflows/secret-scan-pulse.yml
new file mode 100644
index 00000000000..dc9c556ebc6
--- /dev/null
+++ b/.github/workflows/secret-scan-pulse.yml
@@ -0,0 +1,43 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# CI secret-scan enforcement via NVIDIA/security-workflows (Pulse).
+# Runs on Linux nv-gha-runners (Pulse Docker image + OIDC/Vault) — Linux-only by design.
+# The local secret-scan-trufflehog pre-commit hook is cross-platform (Linux/macOS/Windows via Git Bash).
+# Pinned to a reviewed commit SHA.
+
+name: Secret Scan (Pulse)
+
+on:
+  push:
+    branches:
+      - main
+      - ctk-next
+      - "pull-request/[0-9]+"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-on-${{ github.event_name }}-from-${{ github.ref_name }}
+  cancel-in-progress: true
+
+# Caller must grant every permission the reusable workflow declares.
+permissions:
+  contents: read
+  id-token: write          # OIDC -> Vault -> nvcr.io image pull
+  security-events: write   # publish redacted SARIF to code scanning
+  actions: read
+
+jobs:
+  secret-scan:
+    name: Secret Scan
+    # Pulse needs nv-gha-runners + Vault/nvcr vars; skip on forks.
+    if: github.repository == 'NVIDIA/cuda-python'
+    uses: NVIDIA/security-workflows/.github/workflows/secret-scan-pulse.yml@69032f641c3c34e0c0b46f636b54ed2b101b7aa4
+    with:
+      runs-on: linux-amd64-cpu4
+      # Set failure_policy explicitly so enforcement can't drift with upstream defaults.
+      #   unverified — fail on verified/live secrets (183); warn on unverified (185)  [default]
+      #   strict     — fail on any finding (verified or unverified)
+      #   all        — warn only; never fail the job on findings
+      failure_policy: unverified
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 6e0485eb450..110a0790db1 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -9,12 +9,20 @@ ci:
     autoupdate_branch: ''
     autoupdate_commit_msg: '[pre-commit.ci] pre-commit autoupdate'
     autoupdate_schedule: quarterly
-    skip: [lychee, check-precommit-installed]
+    skip: [lychee, check-precommit-installed, secret-scan-trufflehog]
     submodules: false
 
 # Please update the rev: SHAs below with this command:
 # pre-commit autoupdate --freeze
 repos:
+  # Runs first so a leaked credential blocks the commit before any formatter runs.
+  # Self-installing: the hook downloads a pinned, checksum-verified trufflehog on
+  # first use (no manual install). Skipped on pre-commit.ci; Pulse CI enforces server-side.
+  - repo: https://github.com/NVIDIA/security-workflows
+    rev: 031c5429271b5692e025c3e292fcc2bf11e116f7  # frozen: v0.2.0
+    hooks:
+      - id: secret-scan-trufflehog
+
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: c60c980e561ed3e73101667fe8365c609d19a438  # frozen: v0.15.9
     hooks:
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 9f28ec49a38..e3f7c5b1326 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -167,6 +167,11 @@ If the hook isn't installed, `pre-commit run` (and CI) will print a visible
 warning reminding you to run `pre-commit install`.
 
 
+## Secret Scanning
+
+The `secret-scan-trufflehog` pre-commit hook scans staged files and installs TruffleHog on first run (use Git Bash on Windows). If it flags a secret, remove it before committing, or contact a maintainer if it's a false positive. Secrets are also scanned server-side in CI.
+
+
 ## Signing Your Work
 
 Contributions to files licensed under Apache 2.0 must be certified under the