diff --git a/.github/workflows/pr-leakage.yaml b/.github/workflows/pr-leakage.yaml
new file mode 100644
index 000000000..e869c9a36
--- /dev/null
+++ b/.github/workflows/pr-leakage.yaml
@@ -0,0 +1,18 @@
+name: pr-leakage
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  check:
+    # Pinned to @main until the reusable workflow gets a tagged release; tracked as
+    # follow-up so this caller can pin to a stable ref.
+    uses: ConductorOne/github-workflows/.github/workflows/pr-leakage-check.yaml@main
+    with:
+      pr_number: ${{ github.event.pull_request.number }}
+    secrets: inherit