diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..0ecce1c
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,47 @@
+# SPDX-License-Identifier: MPL-2.0
+#
+# Gitleaks configuration — hyperpolymath/rrecord-verity
+#
+# EXTENDS THE ESTATE BASELINE, it does not replace it.
+# `.gitleaks-estate.toml` is staged into the workspace root by
+# hyperpolymath/standards `.github/workflows/secret-scanner-reusable.yml`
+# before the scan runs. gitleaks resolves `[extend] path` against the process
+# CWD (verified — NOT relative to this file), which is the repository root.
+#
+# WHY THIS FILE IS LOCAL RATHER THAN IN THE ESTATE BASELINE.
+# Every entry below is a blind spot. Held here, it blinds this repository only,
+# and the justification sits beside the code it describes. Promoted to the
+# estate baseline it would blind all 400+ repositories — so the baseline keeps
+# only entries that are true everywhere (lockfiles, vendored bundles, published
+# protocol constants).
+#
+# Each entry names WHAT THE VALUE IS. "This file is noisy" is not a reason; if
+# an entry cannot say what the matched value actually is, the secret should be
+# removed from the tree instead.
+#
+# Every finding suppressed here was triaged on 2026-08-06 by reading the
+# matched line with the value redacted. Before adding an entry, plant a
+# realistic secret in the same path and confirm it is STILL detected.
+
+[extend]
+path = ".gitleaks-estate.toml"
+
+[allowlist]
+description = "hyperpolymath/rrecord-verity: locally justified exemptions, extending the estate baseline"
+
+
+paths = [
+  # Captured email corpus (.eml) used as parser input. Real newsletters from
+  # a public mailing list; the matches are DKIM signature material, which is
+  # published in the message header by design.
+  '''(^|/)test/data/''',
+
+  # Property and unit test suites — synthetic verification inputs.
+  '''(^|/)(tests|test)/(property|unittest)/''',
+
+  # DKIM/DMARC verifier source. The match is the identifier
+  # `savedAuthResult.dkim = dkimResultV2.signatures` — a VARIABLE NAME long
+  # enough to trip the entropy heuristic, not a value.
+  '''(^|/)modules/authVerifier\.mjs\.js$''',
+
+]