diff --git a/copier.yml b/copier.yml
index 0176ecd..3c1444d 100644
--- a/copier.yml
+++ b/copier.yml
@@ -49,7 +49,11 @@ _tasks:
   - command: pnpm install
     working_directory: frontend
     when: "{{ include_frontend }}"
-  - command: "pre-commit install && pre-commit install --hook-type commit-msg"
+  # 未安装 pre-commit 时跳过而非让生成失败（退出码恒 0）
+  - command: >-
+      command -v pre-commit >/dev/null 2>&1
+      && pre-commit install && pre-commit install --hook-type commit-msg
+      || echo '⚠ 未检测到 pre-commit，已跳过钩子安装；请先安装后手动运行：pre-commit install'
 
 # ── 项目基本信息 ────────────────────────────────────────────────────────
 project_name:
diff --git a/template/.pre-commit-config.yaml.jinja b/template/.pre-commit-config.yaml.jinja
index 38c2665..0be158f 100644
--- a/template/.pre-commit-config.yaml.jinja
+++ b/template/.pre-commit-config.yaml.jinja
@@ -11,6 +11,12 @@ repos:
       - id: check-added-large-files
       - id: detect-private-key
 
+  # 密钥扫描（防密钥误入库，配合 detect-private-key）
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.21.2
+    hooks:
+      - id: gitleaks
+
   # 提交信息规范（Conventional Commits）
   - repo: https://github.com/compilerla/conventional-pre-commit
     rev: v3.4.0
diff --git a/template/frontend/pnpm-workspace.yaml.jinja b/template/frontend/pnpm-workspace.yaml.jinja
new file mode 100644
index 0000000..4a0c352
--- /dev/null
+++ b/template/frontend/pnpm-workspace.yaml.jinja
@@ -0,0 +1,5 @@
+# pnpm 10+ 默认拦截依赖的构建脚本（供应链安全）。
+# allowBuilds 显式放行确需构建的包，避免 ERR_PNPM_IGNORED_BUILDS 致 install 非零退出。
+# pnpm 11 用 allowBuilds 取代已废弃的 onlyBuiltDependencies。
+allowBuilds:
+  esbuild: true