diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 76b4884..1242e7d 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -14,13 +14,11 @@ jobs:
           fetch-depth: 0
       - name: all branches
         run: git fetch origin '+refs/heads/*:refs/remotes/origin/*' && git branch -a && git rev-list --all | wc -l
-      - name: gitleaks (redacted)
-        run: nix run nixpkgs#gitleaks -- detect --source . --log-opts=--all --redact -v --no-banner || true
       - name: pattern scan (file names only)
         run: |
           scan() {
             echo "== $1"
-            git rev-list --all | xargs -n 20 git grep -lIE "$1" | awk -F: '{print $2}' | sort | uniq -c || true
+            git rev-list --all | xargs -n 20 git grep -lIE "$1" | cut -d: -f2 | sort | uniq -c || true
           }
           scan 'BEGIN [A-Z ]*PRIVATE KEY'
           scan 'sk-[A-Za-z0-9_-]{16,}'
@@ -40,4 +38,4 @@ jobs:
           scan 'vendors\.llm'
           scan 'citadel|nexus'
           echo "== all files ever"
-          git rev-list --all | xargs -n 20 git ls-tree -r --name-only | sort -u | wc -l
+          git rev-list --all | xargs -n 1 git ls-tree -r --name-only | sort -u