diff --git a/.gitignore b/.gitignore
index eeb7bc6..11fa49e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,7 +3,6 @@ local
 gh/
 .claude
 .wrangler
-
 # Secrets and machine-local tool state
 *.pem
 *.key
@@ -12,4 +11,7 @@ gh/
 credentials.json
 *.secret
 Brewfile.lock.json
+
+# XDG_CONFIG_HOME points at this repo, so tools sometimes drop machine-local
+# state here. Homebrew writes its tap trust store (homebrew/trust.json).
 homebrew/
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 0f37bf7..eef9bf0 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,5 +1,9 @@
+# Pre-commit hooks for this dotfiles repo.
+# Install once with: pre-commit install
+# Run against all files: pre-commit run --all-files
 repos:
   - repo: https://github.com/gitleaks/gitleaks
     rev: v8.30.1
     hooks:
+      # Scans staged changes for secrets before they can be committed.
       - id: gitleaks