diff --git a/.gitleaks.toml b/.gitleaks.toml
index 5ae85df..017091a 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -9,7 +9,9 @@
 #
 # The other stopwords are the nonces of the published test vectors for the server's proof
 # route and signed requests (docs/reference/http-api.md). They are public examples, not
-# secrets, and the extension and server tests check them byte for byte.
+# secrets, and the extension and server tests check them byte for byte. The last is the
+# release key's public SSH fingerprint (MAINTAINERS.md, .github/allowed_signers), which the
+# security reviews quote.
 
 [extend]
 useDefault = true
@@ -20,4 +22,5 @@ stopwords = [
   "0123456789",
   "q1aP3n0ZKcB1x5mW0u7S9b",
   "dE8gH0iL2nO4pQ6rS8tU0v",
+  "HqIaFq/thUm844NjYC3a+4Br40cqD2yJHEq1L2iiw4E",
 ]