diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 00000000..2b974b6a
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,4 @@
+# Protect the organization secret-scanning control and reviewed baseline.
+/.github/CODEOWNERS @andreybavt @luca-martial
+/.github/workflows/secret-scan.yml @andreybavt @luca-martial
+/.betterleaks-baseline.json @andreybavt @luca-martial
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
new file mode 100644
index 00000000..7859f5e0
--- /dev/null
+++ b/.github/workflows/secret-scan.yml
@@ -0,0 +1,22 @@
+name: Secret scan
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  push:
+    branches: [main]
+  schedule:
+    - cron: "17 4 * * 1"
+    - cron: "43 4 1 * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: secret-scan-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  betterleaks:
+    uses: Kaelio/kaelio/.github/workflows/reusable-secret-scan.yml@d55c37ec6e3d7e8e0399547074f401a42499c091