diff --git a/pkgs/tools/security/gitleaks/default.nix b/pkgs/tools/security/gitleaks/default.nix
index 6dfed076d2ef..a9cdeb326100 100644
--- a/pkgs/tools/security/gitleaks/default.nix
+++ b/pkgs/tools/security/gitleaks/default.nix
@@ -1,30 +1,47 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
+, gitleaks
+, installShellFiles
+, testers
 }:
 
 buildGoModule rec {
   pname = "gitleaks";
-  version = "8.11.2";
+  version = "8.12.0";
 
   src = fetchFromGitHub {
     owner = "zricethezav";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-E6ogPJQbg8hrfUNPIQ7b9c5at5VY73j0cEolzQpzUTM=";
+    sha256 = "sha256-g15ySGRX9f3zlmoatfzUomokdXyr33geNZnEQLle9rw=";
   };
 
-  vendorSha256 = "sha256-KtBE8zOCSh/sItEpEA+I2cG3U44FJ2wxxVX3F6choUY=";
+  vendorSha256 = "sha256-Ev0/CSpwJDmc+Dvu/bFDzsgsq80rWImJWXNAUqYHgoE=";
 
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/zricethezav/gitleaks/v${lib.versions.major version}/version.Version=${version}"
+    "-X github.com/zricethezav/gitleaks/v${lib.versions.major version}/cmd.Version=${version}"
   ];
 
+  nativeBuildInputs = [ installShellFiles ];
+
   # With v8 the config tests are are blocking
   doCheck = false;
 
+  postInstall = ''
+    installShellCompletion --cmd ${pname} \
+      --bash <($out/bin/${pname} completion bash) \
+      --fish <($out/bin/${pname} completion fish) \
+      --zsh <($out/bin/${pname} completion zsh)
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = gitleaks;
+    command = "${pname} version";
+  };
+
   meta = with lib; {
     description = "Scan git repos (or files) for secrets";
     longDescription = ''