diff --git a/.github/workflows/unified-devsecops.yml b/.github/workflows/unified-devsecops.yml
index dd6f4da..661d7ab 100644
--- a/.github/workflows/unified-devsecops.yml
+++ b/.github/workflows/unified-devsecops.yml
@@ -176,10 +176,18 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Run Gitleaks
-        uses: gitleaks/gitleaks-action@v2
+      - name: Install Gitleaks
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_VERSION: 8.24.2
+        run: |
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            | tar -xz
+          mkdir -p "$HOME/bin"
+          mv gitleaks "$HOME/bin/gitleaks"
+          echo "$HOME/bin" >> "$GITHUB_PATH"
+
+      - name: Run Gitleaks
+        run: gitleaks git --redact --verbose --exit-code 1 .
 
   dependency-audit:
     name: Dependency Audit
diff --git a/README.md b/README.md
index 1e347cd..b61fd4a 100644
--- a/README.md
+++ b/README.md
@@ -483,11 +483,8 @@ Outputs:
 5. Use Terraform plans to structure implementation and identify missing query mappings.
 6. Translate source queries into real Datadog telemetry before applying Terraform.
 
-## Publication Notes
+## Access and Use
 
-This repo is close to public-ready from a content perspective, but two publication decisions still remain:
-- decide whether to publish example fixtures or keep users responsible for supplying their own exports
+This is a private repository. Access is restricted to authorized team members. Do not share, redistribute, or republish any part of this codebase outside of authorized channels.
 
-## License Status
-
-No license file has been added. Unless and until a license is added, this repository should be treated as published source code without an open-source license grant.
+All rights reserved.