diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index f0270d081..5f8cf574d 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -29,7 +29,22 @@ jobs:
           set -euo pipefail
           GITLEAKS_VERSION="8.24.3"
           GITLEAKS_BASE_URL="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}"
-          ARCHIVE_NAME="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          RUNNER_ARCH="$(uname -m)"
+
+          case "${RUNNER_ARCH}" in
+            x86_64|amd64)
+              GITLEAKS_ARCH="x64"
+              ;;
+            aarch64|arm64)
+              GITLEAKS_ARCH="arm64"
+              ;;
+            *)
+              echo "Unsupported runner architecture: ${RUNNER_ARCH}" >&2
+              exit 1
+              ;;
+          esac
+
+          ARCHIVE_NAME="gitleaks_${GITLEAKS_VERSION}_linux_${GITLEAKS_ARCH}.tar.gz"
 
           # Download gitleaks archive using the release filename so checksum verification works
           curl -sSfL "${GITLEAKS_BASE_URL}/${ARCHIVE_NAME}" -o "${ARCHIVE_NAME}"