diff --git a/.github/workflows/secret-defense.yml b/.github/workflows/secret-defense.yml
index 677e10c..09cac1e 100644
--- a/.github/workflows/secret-defense.yml
+++ b/.github/workflows/secret-defense.yml
@@ -28,7 +28,12 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Install gitleaks OSS CLI
+        run: |
+          curl -fsSL -o gitleaks.tar.gz \
+            https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
+          echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  gitleaks.tar.gz" | sha256sum -c -
+          tar -xzf gitleaks.tar.gz gitleaks
+          chmod +x gitleaks
       - name: Scan repository history for secrets
-        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: ./gitleaks detect --source . --redact --verbose
diff --git a/packaging/linux/build-appimage.sh b/packaging/linux/build-appimage.sh
index 30f1752..90175ee 100755
--- a/packaging/linux/build-appimage.sh
+++ b/packaging/linux/build-appimage.sh
@@ -57,11 +57,11 @@ exec "${here}/usr/bin/FB2Blogger.Desktop" "$@"
 APPRUN
 chmod +x "${app_dir}/AppRun" "${app_dir}/usr/bin/FB2Blogger.Desktop"
 
-# AppImage upstream intentionally uses continuous releases. The content digest
-# pins this download to commit 8c8c91f762b412a19f4e8d2c4b35afb98f2d7c81
-# (published 2025-12-04); an upstream replacement fails closed until reviewed.
-appimagetool_url="https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage"
-appimagetool_sha256="a6d71e2b6cd66f8e8d16c37ad164658985e0cf5fcaa950c90a482890cb9d13e0"
+# The "continuous" upstream asset is replaced in place, which broke its pinned
+# digest. Pin the tagged 1.9.1 release asset and its content digest instead;
+# any upstream replacement still fails closed until reviewed.
+appimagetool_url="https://github.com/AppImage/appimagetool/releases/download/1.9.1/appimagetool-x86_64.AppImage"
+appimagetool_sha256="ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3cb384eb0"
 appimagetool="${work_dir}/appimagetool-x86_64.AppImage"
 curl --fail --location --proto '=https' --tlsv1.2 "${appimagetool_url}" -o "${appimagetool}"
 printf '%s  %s\n' "${appimagetool_sha256}" "${appimagetool}" | sha256sum --check --strict
diff --git a/tests/AuditHarness/Program.cs b/tests/AuditHarness/Program.cs
index 762c555..de72294 100644
--- a/tests/AuditHarness/Program.cs
+++ b/tests/AuditHarness/Program.cs
@@ -118,8 +118,10 @@
 
 var secretDefenseWorkflow = File.ReadAllText(Path.Combine(workflowDirectory, "secret-defense.yml"));
 Check(
-    Regex.IsMatch(secretDefenseWorkflow, @"gitleaks/gitleaks-action@[0-9a-f]{40}(?:\r?$|\s)", RegexOptions.Multiline, TimeSpan.FromSeconds(1)),
-    "Secret Defense pins Gitleaks to an immutable commit");
+    Regex.IsMatch(secretDefenseWorkflow, @"github\.com/gitleaks/gitleaks/releases/download/v\d+\.\d+\.\d+/gitleaks_\d+\.\d+\.\d+_linux_x64\.tar\.gz", RegexOptions.None, TimeSpan.FromSeconds(1)) &&
+    Regex.IsMatch(secretDefenseWorkflow, @"echo ""[0-9a-f]{64}  gitleaks\.tar\.gz"" \| sha256sum -c -", RegexOptions.None, TimeSpan.FromSeconds(1)) &&
+    !secretDefenseWorkflow.Contains("gitleaks/gitleaks-action", StringComparison.Ordinal),
+    "Secret Defense runs a version-pinned, checksum-verified open-source Gitleaks CLI");
 
 var securityAuditWorkflow = File.ReadAllText(Path.Combine(workflowDirectory, "security-audit.yml"));
 Check(
diff --git a/tests/PackagingAudit/Program.cs b/tests/PackagingAudit/Program.cs
index d8120f7..b84347b 100644
--- a/tests/PackagingAudit/Program.cs
+++ b/tests/PackagingAudit/Program.cs
@@ -64,9 +64,9 @@ void Check(bool condition, string name)
       linuxScript.Contains("Permission is hereby granted", StringComparison.Ordinal) &&
       linuxScript.Contains("sha256sum", StringComparison.Ordinal),
     "Linux packaging creates, extracts, launches, and hashes a real AppImage containing the MIT license");
-Check(linuxScript.Contains("8c8c91f762b412a19f4e8d2c4b35afb98f2d7c81", StringComparison.Ordinal) &&
-      linuxScript.Contains("a6d71e2b6cd66f8e8d16c37ad164658985e0cf5fcaa950c90a482890cb9d13e0", StringComparison.Ordinal),
-    "AppImage tooling is fail-closed to an audited upstream commit and SHA256");
+Check(linuxScript.Contains("appimagetool/releases/download/1.9.1/appimagetool-x86_64.AppImage", StringComparison.Ordinal) &&
+      linuxScript.Contains("ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3cb384eb0", StringComparison.Ordinal),
+    "AppImage tooling is fail-closed to the tagged 1.9.1 release and its SHA256");
 
 Check(metadataScript.Contains("REF_TYPE", StringComparison.Ordinal) &&
       metadataScript.Contains("PR-${PR_NUMBER", StringComparison.Ordinal) &&