diff --git a/.github/workflows/app-security.yml b/.github/workflows/app-security.yml
index fb595a0..b908eac 100644
--- a/.github/workflows/app-security.yml
+++ b/.github/workflows/app-security.yml
@@ -84,14 +84,10 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      # gitleaks-action reads the pull request's commits through the API
-      # (GET .../pulls/{n}/commits) instead of the diff already on disk.
-      pull-requests: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - run: mise run secrets