diff --git a/.gitleaksignore b/.gitleaksignore
new file mode 100644
index 0000000..6a58dbf
--- /dev/null
+++ b/.gitleaksignore
@@ -0,0 +1,7 @@
+# Findings checked by hand and confirmed dead - each line ignores exactly one
+# finding (commit:file:rule:line). Anything else gitleaks finds still fails CI.
+
+# Paperless OIDC client secret in old history (removed from the files 2026-07-06).
+# Checked 2026-10-11: that client_id no longer exists in Authentik (all 104
+# OAuth2 providers), and Paperless uses a different client and secret.
+973546647df3fe505e913c42af9ed3547083593c:Docker/Paperless-NGX/docker-compose.yaml:generic-api-key:50