diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index ff9d095..19b3ddd 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -3,6 +3,24 @@
 # they need an emulator and a local relay.
 stages: [test]
 
+# The repository is public, so this sweep is the last thing between a pasted
+# key and the internet. Until 2026-09-17 it only ran when somebody remembered
+# to, and it had been red for nine days without anyone noticing, because a
+# formatter carried an allow marker off the line it covered. A check nobody
+# runs protects nothing; here it runs on every merge request and every push
+# to main, and it finishes in seconds.
+secret-sweep:
+  stage: test
+  tags: [mac-local]
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+    - if: '$CI_COMMIT_BRANCH == "main"'
+  variables:
+    GIT_DEPTH: "1"
+  script:
+    - bash scripts/secret-sweep.sh
+  timeout: 5m
+
 unit-tests:
   stage: test
   tags: [mac-local]