diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index ecadcac..91c892e 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,13 +1,3 @@
-exclude: |
-  (?x)
-  .drawio$|
-  ^test/.*.json$|
-  tsconfig.json$|
-  .diff$|
-  .patch$|
-  .min.|
-  ^states/common/setup/files/01-netzbegruenung.sh$|
-  ^states/common/setup/files/01-verdigado.sh$
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v4.6.0
@@ -40,6 +30,10 @@ repos:
     rev: v0.9.0.5
     hooks:
       - id: shellcheck
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.16.1
+    hooks:
+      - id: gitleaks
   - repo: local
     hooks:
       - id: check-ssh-keys
@@ -49,12 +43,6 @@ repos:
         files: ^pillars/users/.+\.sls$
         additional_dependencies: ['pyyaml==6.0.1'] # Renovate can't parse it, yet https://github.com/renovatebot/renovate/issues/20780 # TODO
 
-      - id: check-codeowners
-        name: check CODEOWNERS for alphabetical comment order
-        entry: python build/check-alphabetical-comments.py
-        language: python
-        files: CODEOWNERS
-
       - id: prettier # Copied from https://github.com/pre-commit/mirrors-prettier/ instead of referencing it to not rely on their published Prettier versions
         name: Prettier
         description: ''
@@ -65,10 +53,3 @@ repos:
         require_serial: false
         additional_dependencies: ['prettier@3'] # Renovate can't parse this, either. Unspecific to prevent local installs, when global installations are available
         minimum_pre_commit_version: '0'
-
-      - id: git-diff
-        name: git diff
-        entry: git diff --exit-code
-        language: system
-        pass_filenames: false
-        always_run: true