diff --git a/.github/workflows/utils/.gitleaks.toml b/.github/workflows/utils/.gitleaks.toml
index e5b6fc6f8..891594dee 100644
--- a/.github/workflows/utils/.gitleaks.toml
+++ b/.github/workflows/utils/.gitleaks.toml
@@ -3,9 +3,13 @@ title = "Gitleaks config"
 [extend]
 useDefault = true
 
-# Ignore test files and test directories
 [[allowlists]]
 paths = [
   '''.*_test\..*''',                    # Test files
   '''(^|/)testdata/.*''',               # Testdata directories
+  '''devel/devkeys/.*''',               # Development keys
+  '''devel/README\.md''',               # Development docs with example tokens
+  '''deployment/chainloop/.*README\.md''',  # Helm chart documentation
+  '''deployment/chainloop/values\.yaml''',  # Helm values with example keys
+  '''deployment/chainloop/templates/_helpers\.tpl''',  # Helm template helpers
 ]
diff --git a/.gitleaksignore b/.gitleaksignore
deleted file mode 100644
index 0cd2e4b18..000000000
--- a/.gitleaksignore
+++ /dev/null
@@ -1,27 +0,0 @@
-# .gitleaksignore
-#
-# This file contains fingerprints for verified false positives in gitleaks scans.
-# Format: file_path:rule_id:line_number
-
-# PostHog public API key
-app/cli/cmd/root.go:generic-api-key:413
-
-# Buf dependency version
-buf.yaml:generic-api-key:135
-
-# Development keys
-devel/devkeys/cas.pem:private-key:1
-devel/devkeys/ca.pem:private-key:1
-
-# Expired JWT token example in development documentation
-devel/README.md:jwt:162
-
-# Helm chart deployment documentation, example private keys, content redacted or truncated
-deployment/chainloop/README.md:private-key:231
-deployment/chainloop/charts/vault/README.md:private-key:96
-
-# Helm chart templates, development keys that cannot be generated
-deployment/chainloop/templates/_helpers.tpl:private-key:43
-
-# Helm values.yaml, field documentation example
-deployment/chainloop/values.yaml:private-key:114
diff --git a/app/cli/cmd/root.go b/app/cli/cmd/root.go
index 937b76084..3cd16451c 100644
--- a/app/cli/cmd/root.go
+++ b/app/cli/cmd/root.go
@@ -415,7 +415,7 @@ var (
 	// It can be overridden by the user if they want to use their own instance of Posthog or deactivated by setting
 	// DO_NOT_TRACK=1 more information that can be found at: https://github.com/chainloop-dev/chainloop/blob/main/docs/docs/reference/operator/cli-telemetry.mdx
 	// nolint:gosec
-	posthogAPIKey   = "phc_TWWW19kEiD6sEejlHKWcICQ5Vc06vZUTYia8WdPB0A0"
+	posthogAPIKey   = "phc_TWWW19kEiD6sEejlHKWcICQ5Vc06vZUTYia8WdPB0A0" // gitleaks:allow
 	posthogEndpoint = "https://crb.chainloop.dev"
 )
 
diff --git a/buf.yaml b/buf.yaml
index 4358d0cfc..c8c1182f2 100644
--- a/buf.yaml
+++ b/buf.yaml
@@ -132,6 +132,6 @@ modules:
         - FIELD_SAME_DEFAULT
 deps:
   - buf.build/bufbuild/protovalidate:v1.1.0
-  - buf.build/googleapis/googleapis:4ed3bc159a8b4ac68fe253218760d035
+  - buf.build/googleapis/googleapis:4ed3bc159a8b4ac68fe253218760d035 # gitleaks:allow
   - buf.build/grpc-ecosystem/grpc-gateway:v2.26.3
   - buf.build/kratos-go/kratos:e1d52e944e3845c6862a566db322432d