diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e464de6..6b5256a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -116,7 +116,12 @@ jobs:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           fetch-depth: 0
-      - name: gitleaks over full history
+      # Named for what it does. The action scans the commit range of the
+      # event -- one commit on a pull request, the pushed range on a push --
+      # not the whole repository; fetch-depth: 0 makes that range resolvable,
+      # it does not widen it. Full history is covered by the identity job,
+      # which runs the pre-push gate in its --all-history mode.
+      - name: gitleaks over the pushed range
         uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9
         env:
           # The action refuses to scan a pull_request event without this and