diff --git a/.github/trufflehog-canary.env b/.github/trufflehog-canary.env
new file mode 100644
index 000000000..574d9505d
--- /dev/null
+++ b/.github/trufflehog-canary.env
@@ -0,0 +1,6 @@
+# Intentionally fake canary credentials for verifying TruffleHog enforcement in PR CI.
+# Expected behavior: the TruffleHog job should flag these as unverified secrets in
+# the pull request diff. These values are shaped like real tokens, but are not live
+# credentials and are only used to exercise secret scanning in CI.
+GITHUB_TOKEN=ghp_7Yh3mK9pQ2vL8nR4xT6cW1bN5dF0jH2sP4qR
+GITHUB_APP_TOKEN=ghs_4Pm8tQ2nV7xL1cR5wK9bD3fH6jN0sY4pT8mW