diff --git a/actions/leak-scan/run.sh b/actions/leak-scan/run.sh
index 2ab585f..24bd105 100755
--- a/actions/leak-scan/run.sh
+++ b/actions/leak-scan/run.sh
@@ -132,7 +132,7 @@ run_all_refs_scan() {
   if command -v gitleaks >/dev/null 2>&1; then
     gitleaks detect \
       --source=. \
-      --all \
+      --log-opts="--all" \
       --redact \
       --report-path=gitleaks-report.json \
       2>&1 || gitleaks_exit=$?
diff --git a/tests/test_deploy_platform_d.py b/tests/test_deploy_platform_d.py
index 1d73227..bd1543e 100644
--- a/tests/test_deploy_platform_d.py
+++ b/tests/test_deploy_platform_d.py
@@ -216,12 +216,19 @@ def test_unknown_mode_fails_with_error_code(self) -> None:
         self.assertIn("E_UNKNOWN_LEAK_SCAN_MODE", result.stderr)
 
     def test_all_refs_mode_line_in_script(self) -> None:
-        """T-D2: all-refs mode runs gitleaks with --all and --redact flags."""
+        """T-D2: all-refs mode runs gitleaks with --log-opts=--all and --redact flags."""
         script_text = LEAK_SCAN_RUN.read_text(encoding="utf-8")
-        # Script uses line continuations; check for key flags independently
+        # gitleaks v8.x uses --log-opts="--all" instead of a standalone --all flag.
+        # Assert the combined form to catch regression back to the bare --all invocation.
         self.assertIn("gitleaks detect", script_text)
-        self.assertIn("--all", script_text)
+        self.assertIn('--log-opts="--all"', script_text)
         self.assertIn("--redact", script_text)
+        # Regression guard: the all-refs block must NOT use a standalone --all flag.
+        self.assertNotIn(
+            "      --all \\\n",
+            script_text,
+            "run.sh must not pass --all as a standalone flag to gitleaks detect (gitleaks v8.x removed it)",
+        )
 
     def test_path_mode_detects_ipv4_literal(self) -> None:
         """T-D2: path mode detects IPv4 literal and emits redacted gate-summary."""