diff --git a/Dockerfile.gateway b/Dockerfile.gateway
index 4b3ec9b..29448fa 100644
--- a/Dockerfile.gateway
+++ b/Dockerfile.gateway
@@ -34,18 +34,13 @@
 #   9420  git-gate smart HTTP (VM-backend agent-facing transport)
 #   9100  supervise (MCP HTTP)
 
-# Stage 1: gitleaks binary. The upstream gitleaks image is alpine
-# with the binary at /usr/bin/gitleaks. Pinned by digest in lockstep
-# with Dockerfile.git-gate's prior base (now deleted at chunk 3).
-FROM zricethezav/gitleaks@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f AS gitleaks-src
-
-# Stage 2: assembly. Based on `python:3.12-slim` (Debian trixie) rather
-# than the `mitmproxy/mitmproxy` image (Debian bookworm) so the whole
-# stack — gateway here, and the firecracker infra image that builds
-# FROM this — lands on trixie, whose buildah (1.39) can build agent
-# Dockerfiles that use heredocs. mitmproxy is pip-installed to the same
-# effect as the upstream image. (bookworm's buildah is 1.28, which can't
-# parse `RUN ... <<EOF`; see the infra image + PR discussion.)
+# Based on `python:3.12-slim` (Debian trixie) rather than the
+# `mitmproxy/mitmproxy` image (Debian bookworm) so the whole stack —
+# gateway here, and the firecracker infra image that builds FROM this —
+# lands on trixie, whose buildah (1.39) can build agent Dockerfiles that
+# use heredocs. mitmproxy is pip-installed to the same effect as the
+# upstream image. (bookworm's buildah is 1.28, which can't parse
+# `RUN ... <<EOF`; see the infra image + PR discussion.)
 FROM python:3.12-slim
 
 # Runtime system deps:
@@ -65,8 +60,19 @@ RUN apt-get update \
 # egress-entrypoint.sh, so it doesn't depend on a `mitmproxy` home user.
 RUN pip install --no-cache-dir mitmproxy==11.1.3
 
-# Pull the standalone binaries into the final image.
-COPY --from=gitleaks-src /usr/bin/gitleaks /usr/bin/gitleaks
+# gitleaks (the pre-receive hook's secret scanner). Installed from its
+# official release, pinned by version + SHA256 and verified — rather than
+# using a third-party image as a build stage (supply-chain surface, and it
+# would pin us to that image's cadence). python (already present) does the
+# download so we add no curl/wget. trixie apt also ships gitleaks, but an
+# older 8.16; the pinned download keeps the verified 8.30.1.
+ARG GITLEAKS_VERSION=8.30.1
+ARG GITLEAKS_SHA256=551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
+RUN url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+ && python3 -c "import sys,urllib.request; urllib.request.urlretrieve(sys.argv[1], '/tmp/gitleaks.tar.gz')" "$url" \
+ && echo "${GITLEAKS_SHA256}  /tmp/gitleaks.tar.gz" | sha256sum -c - \
+ && tar -xzf /tmp/gitleaks.tar.gz -C /usr/bin gitleaks \
+ && rm /tmp/gitleaks.tar.gz
 
 # Project Python: addon + server modules + the init supervisor.
 # Kept flat under /app/ so mitmdump's loader resolves them as