diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..9f5e068
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,8 @@
+# Gitleaks configuration
+# https://github.com/gitleaks/gitleaks#configuration
+
+[allowlist]
+# Test files that contain variable names matching secret patterns (e.g., s3_key)
+paths = [
+  '''backend/tests/.*\.py''',
+]
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3531bc2..81a509f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,7 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 - Fixed production CI deployment namespace to use correct `orch-namespace` (#54)
-- Added gitleaks fingerprint for test file false positive (#54)
+- Added gitleaks config to allowlist test files from secret scanning (#54)
 
 ## [0.5.0] - 2026-01-23
 ### Added