diff --git a/.github/workflows/gitleaks-scan-on-pr.yml b/.github/workflows/gitleaks-scan-on-pr.yml
index 8f35434..af281e4 100644
--- a/.github/workflows/gitleaks-scan-on-pr.yml
+++ b/.github/workflows/gitleaks-scan-on-pr.yml
@@ -30,6 +30,6 @@ jobs:
       pull-requests: read
     steps:
       - name: Run Gitleaks diff scan
-        uses: deckhouse/modules-actions/gitleaks@v6
+        uses: deckhouse/modules-actions/gitleaks@v16
         with:
           scan_mode: "diff"
diff --git a/.github/workflows/gitleaks-scan-on-schedule.yml b/.github/workflows/gitleaks-scan-on-schedule.yml
index 9d70fc7..c4d230c 100644
--- a/.github/workflows/gitleaks-scan-on-schedule.yml
+++ b/.github/workflows/gitleaks-scan-on-schedule.yml
@@ -32,6 +32,6 @@ jobs:
       pull-requests: read
     steps:
       - name: Run Gitleaks diff scan
-        uses: deckhouse/modules-actions/gitleaks@v6
+        uses: deckhouse/modules-actions/gitleaks@v16
         with:
           scan_mode: "full"
diff --git a/.gitleaks.toml b/.gitleaks.toml
index 72e3c37..c8f2a30 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -1,6 +1,7 @@
-# Use default gitleaks rules + module allowlist
+# Extend the centralized Deckhouse gitleaks config + module allowlist
 [extend]
-useDefault = true
+useDefault = false
+path = "gitleaks.base.toml"
 
 [allowlist]
 paths = [