diff --git a/.github/workflows/secrets-scanning.gitleaks.yaml b/.github/workflows/secrets-scanning.gitleaks.yaml
index b3c5fde..1e218c3 100644
--- a/.github/workflows/secrets-scanning.gitleaks.yaml
+++ b/.github/workflows/secrets-scanning.gitleaks.yaml
@@ -61,6 +61,22 @@ jobs:
         tool_versions: |
           gitleaks ${{ inputs.gitleaks_version }}
 
+    - name: Report tool setup failure
+      id: setup-failure
+      if: ${{ failure() && steps.setup-tools.outcome == 'failure' }}
+      run: |
+        {
+          echo "## ⚠️ Secret Scan Not Run"
+          echo ""
+          echo "Tool setup failed before Gitleaks could run."
+          echo "No scan result is available; this does not confirm or rule out leaked secrets."
+          echo ""
+          echo "Check the setup logs and re-run the failed job after resolving the installation error."
+          echo "This check remains failed until the scan can run."
+        } >> "${GITHUB_STEP_SUMMARY}"
+
+        echo "::error title=Secret scan not run::Tool setup failed before Gitleaks could run. Check the setup logs and re-run the failed job."
+
     - name: Resolve scan scope
       id: scope
       env: