diff --git a/.gitignore b/.gitignore
index 57d10fc..ac71780 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,6 @@
 coverage.html
 coverage.out
 tmp/
+# mise scaffolding, except the uv lock sidecars that mise.lock never embeds.
+/.mise/*
+!/.mise/locks/
diff --git a/hk.pkl b/hk.pkl
index 0aa1f2f..ac78e79 100644
--- a/hk.pkl
+++ b/hk.pkl
@@ -45,4 +45,20 @@ hooks {
       ["change-id"] = Extra.timber_commit_msg
     }
   }
+  ["pre-commit"] {
+    fix = true
+    stage = true
+    stash = "git"
+    steps {
+      // No file filter: scan every staged change, including arbitrary types,
+      // binary files, deletions, and commits without Go or Markdown changes.
+      // The git-mode scan only sees text diffs, so staged binary bytes are
+      // checked out to a temporary directory and scanned explicitly.
+      ["gitleaks"] = (Hk.gitleaks) {
+        scan = "staged"
+        check =
+          "gitleaks git --redact --pre-commit --staged --verbose --no-banner && tmp=$(mktemp -d) || exit $?; trap 'rm -rf \"$tmp\"' EXIT INT TERM; git diff --cached --name-only -z --diff-filter=ACMRT > \"$tmp/list\" || exit $?; git checkout-index -z --stdin --prefix=\"$tmp/tree/\" < \"$tmp/list\" || exit $?; mkdir -p \"$tmp/tree\" || exit $?; gitleaks dir --redact --verbose --no-banner \"$tmp/tree\" || exit $?"
+      }
+    }
+  }
 }
diff --git a/mise.lock b/mise.lock
index d2842e7..9fbfcd1 100644
--- a/mise.lock
+++ b/mise.lock
@@ -433,7 +433,7 @@ uv = { path = ".mise/locks/pypi-agentskills-tools/0.8.0", digest = "sha256:ea4b8
 [[tools.python]]
 version = "3.13.18"
 backend = "core:python"
-specifiers = ["3.13"]
+specifiers = ["latest"]
 
 [tools.python."platforms.linux-arm64"]
 checksum = "sha256:578d9da1983463ffb0c8c98ab0da2f18177f44069328eb0af847860c1eb05c3e"
diff --git a/mise.toml b/mise.toml
index 0b3551d..d8e26d6 100644
--- a/mise.toml
+++ b/mise.toml
@@ -17,7 +17,7 @@ gofumpt = "latest"
 hk = "2.10.0"
 pkl = "latest"
 "pypi:agentskills-tools" = "latest"
-python = "3.13"
+python = "latest"
 staticcheck = "latest"
 tombi = "latest"
 uv = "latest"