diff --git a/security/security-secrets-credential-engineer.md b/security/security-secrets-credential-engineer.md
index 31b915f0..f2ce43a7 100644
--- a/security/security-secrets-credential-engineer.md
+++ b/security/security-secrets-credential-engineer.md
@@ -82,7 +82,9 @@ jobs:
       - uses: actions/checkout@v4
         with: { fetch-depth: 0 }   # full history so an old leak is caught too
       - uses: gitleaks/gitleaks-action@v2
-        env: { GITLEAKS_CONFIG: .gitleaks.toml }  # allowlist known-public test fixtures
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # required by the action to scan pull_request events
+          GITLEAKS_CONFIG: .gitleaks.toml            # allowlist known-public test fixtures
 ```
 
 ### Static Key → Dynamic, Short-Lived Credential