diff --git a/.entire/.gitignore b/.entire/.gitignore
index 0b700c83e3..a1557d5f0e 100644
--- a/.entire/.gitignore
+++ b/.entire/.gitignore
@@ -3,3 +3,4 @@ settings.local.json
 metadata/
 current_session
 logs/
+redactors/local/
diff --git a/cmd/entire/cli/settings/settings.go b/cmd/entire/cli/settings/settings.go
index 3654f5ccde..c52204db82 100644
--- a/cmd/entire/cli/settings/settings.go
+++ b/cmd/entire/cli/settings/settings.go
@@ -155,6 +155,15 @@ func (s *SummaryGenerationSettings) SetProvider(newProvider, newModel string) {
 // RedactionSettings configures redaction behavior beyond the default secret detection.
 type RedactionSettings struct {
 	PII *PIISettings `json:"pii,omitempty"`
+
+	// CustomRedactions is a label → RE2 regex map for user-defined patterns
+	// to scrub from transcripts. Use it for internal credential shapes the
+	// bundled detectors don't know about, project codenames, or any other
+	// string pattern you don't want stored. Each match is replaced with the
+	// bare "REDACTED" token used by the built-in secret layers, not the
+	// "[REDACTED_<LABEL>]" token used by PII. Failed regex compilations are
+	// logged via slog.Warn and the rule is skipped.
+	CustomRedactions map[string]string `json:"custom_redactions,omitempty"`
 }
 
 // PIISettings configures PII detection categories.
@@ -550,6 +559,19 @@ func mergeRedaction(dst *RedactionSettings, data json.RawMessage) error {
 			return err
 		}
 	}
+	if csRaw, ok := raw["custom_redactions"]; ok {
+		var cs map[string]string
+		if err := json.Unmarshal(csRaw, &cs); err != nil {
+			return fmt.Errorf("parsing redaction.custom_redactions: %w", err)
+		}
+		if dst.CustomRedactions == nil {
+			dst.CustomRedactions = cs
+		} else {
+			for k, v := range cs {
+				dst.CustomRedactions[k] = v
+			}
+		}
+	}
 	return nil
 }
 
diff --git a/cmd/entire/cli/settings/settings_test.go b/cmd/entire/cli/settings/settings_test.go
index bf8dc2a37a..3fc9cba07f 100644
--- a/cmd/entire/cli/settings/settings_test.go
+++ b/cmd/entire/cli/settings/settings_test.go
@@ -974,6 +974,78 @@ func containsUnknownField(msg string) bool {
 	return strings.Contains(msg, "unknown field")
 }
 
+func TestLoadMerged_CustomRedactionsPerKeyOverride(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	base := filepath.Join(dir, "settings.json")
+	local := filepath.Join(dir, "settings.local.json")
+
+	if err := os.WriteFile(base, []byte(`{
+  "redaction": {
+    "custom_redactions": {
+      "team_token":   "TEAM_[A-Za-z0-9]{16,}",
+      "shared_token": "SHARED_[A-Z]{4}_[A-Za-z0-9]{12,}"
+    }
+  }
+}`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(local, []byte(`{
+  "redaction": {
+    "custom_redactions": {
+      "shared_token": "SHARED_[A-Z]{4}_[A-Za-z0-9]{20,}",
+      "personal":     "PERSONAL_[a-z]{32}"
+    }
+  }
+}`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	merged, err := loadMergedSettings(base, local)
+	if err != nil {
+		t.Fatalf("loadMergedSettings: %v", err)
+	}
+
+	want := map[string]string{
+		"team_token":   "TEAM_[A-Za-z0-9]{16,}",
+		"shared_token": "SHARED_[A-Z]{4}_[A-Za-z0-9]{20,}",
+		"personal":     "PERSONAL_[a-z]{32}",
+	}
+	got := merged.Redaction.CustomRedactions
+	if len(got) != len(want) {
+		t.Fatalf("CustomRedactions size: want %d, have %d (%v)", len(want), len(got), got)
+	}
+	for k, v := range want {
+		if got[k] != v {
+			t.Errorf("CustomRedactions[%s]: want %q, have %q", k, v, got[k])
+		}
+	}
+}
+
+func TestLoadFromBytes_CustomRedactions(t *testing.T) {
+	t.Parallel()
+
+	data := []byte(`{
+  "redaction": {
+    "custom_redactions": {
+      "acme_token": "ACME_TOKEN_[A-Za-z0-9]{20,}"
+    }
+  }
+}`)
+
+	got, err := LoadFromBytes(data)
+	if err != nil {
+		t.Fatalf("LoadFromBytes: %v", err)
+	}
+	if got.Redaction == nil {
+		t.Fatalf("Redaction is nil")
+	}
+	if want, have := "ACME_TOKEN_[A-Za-z0-9]{20,}", got.Redaction.CustomRedactions["acme_token"]; want != have {
+		t.Errorf("CustomRedactions[acme_token]: want %q, have %q", want, have)
+	}
+}
+
 func TestEntireSettings_ReviewRoundTrip(t *testing.T) {
 	t.Parallel()
 	raw := []byte(`{
diff --git a/cmd/entire/cli/strategy/common.go b/cmd/entire/cli/strategy/common.go
index 48285525e7..15feaf7089 100644
--- a/cmd/entire/cli/strategy/common.go
+++ b/cmd/entire/cli/strategy/common.go
@@ -343,33 +343,58 @@ var (
 
 var initRedactionOnce sync.Once
 
-// EnsureRedactionConfigured loads PII redaction settings and configures the
-// redact package. No-op if PII is not enabled in settings.
-// Must be called at each process entry point before checkpoint writes
-// (e.g., hook PersistentPreRunE, doctor PreRun).
+// EnsureRedactionConfigured loads redaction settings and configures the
+// redact package: PII detection (opt-in), inline custom_redactions, and rule
+// packs auto-discovered from .entire/redactors/.
+//
+// Must be called at each process entry point before checkpoint writes.
 func EnsureRedactionConfigured() {
 	initRedactionOnce.Do(func() {
 		ctx := context.Background()
 		s, err := settings.Load(ctx)
 		if err != nil {
 			logCtx := logging.WithComponent(ctx, "redaction")
-			logging.Warn(logCtx, "failed to load settings for PII redaction", slog.String("error", err.Error()))
+			logging.Warn(logCtx, "failed to load settings for redaction", slog.String("error", err.Error()))
 			return
 		}
-		if s.Redaction == nil || s.Redaction.PII == nil || !s.Redaction.PII.Enabled {
-			return
+
+		// PII detection (opt-in).
+		if s.Redaction != nil && s.Redaction.PII != nil && s.Redaction.PII.Enabled {
+			pii := s.Redaction.PII
+			cfg := redact.PIIConfig{
+				Enabled:        true,
+				Categories:     make(map[redact.PIICategory]bool),
+				CustomPatterns: pii.CustomPatterns,
+			}
+			cfg.Categories[redact.PIIEmail] = pii.Email == nil || *pii.Email
+			cfg.Categories[redact.PIIPhone] = pii.Phone == nil || *pii.Phone
+			cfg.Categories[redact.PIIAddress] = pii.Address != nil && *pii.Address
+			redact.ConfigurePII(cfg)
+		}
+
+		// Custom rules: inline + packs.
+		var inline map[string]string
+		if s.Redaction != nil {
+			inline = s.Redaction.CustomRedactions
+		}
+		packsRelPath := filepath.Join(paths.EntireDir, redact.RedactorsDirName)
+		packsDir, perr := paths.AbsPath(ctx, packsRelPath)
+		if perr != nil {
+			logCtx := logging.WithComponent(ctx, "redaction")
+			logging.Warn(logCtx, "failed to resolve redactors path", slog.String("error", perr.Error()))
+			packsDir = packsRelPath
+		}
+		packs, lerr := redact.LoadPacks(packsDir)
+		if lerr != nil {
+			logCtx := logging.WithComponent(ctx, "redaction")
+			logging.Warn(logCtx, "failed to load redactor packs", slog.String("error", lerr.Error()))
 		}
-		pii := s.Redaction.PII
-		cfg := redact.PIIConfig{
-			Enabled:        true,
-			Categories:     make(map[redact.PIICategory]bool),
-			CustomPatterns: pii.CustomPatterns,
+		if len(inline) > 0 || len(packs) > 0 {
+			redact.ConfigureCustomRules(redact.CustomRulesConfig{
+				Inline: inline,
+				Packs:  packs,
+			})
 		}
-		// Email and phone default to true when PII is enabled; address defaults to false.
-		cfg.Categories[redact.PIIEmail] = pii.Email == nil || *pii.Email
-		cfg.Categories[redact.PIIPhone] = pii.Phone == nil || *pii.Phone
-		cfg.Categories[redact.PIIAddress] = pii.Address != nil && *pii.Address
-		redact.ConfigurePII(cfg)
 	})
 }
 
@@ -1058,6 +1083,7 @@ func EnsureEntireGitignore(ctx context.Context) error {
 		"settings.local.json",
 		"metadata/",
 		"logs/",
+		redact.RedactorsDirName + "/local/",
 	}
 
 	// Track what needs to be added
diff --git a/cmd/entire/cli/strategy/common_test.go b/cmd/entire/cli/strategy/common_test.go
index bc91eff5a8..fef91846d4 100644
--- a/cmd/entire/cli/strategy/common_test.go
+++ b/cmd/entire/cli/strategy/common_test.go
@@ -6,6 +6,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"strings"
 	"sync"
 	"testing"
 
@@ -1670,3 +1671,25 @@ func TestReadAgentTypeFromTree_MetadataJSON_OverridesDir(t *testing.T) {
 	result := ReadAgentTypeFromTree(tree, "cp")
 	assert.Equal(t, agent.AgentTypeCursor, result)
 }
+
+func TestEnsureEntireGitignore_IncludesRedactorsLocal(t *testing.T) {
+	// Cannot t.Parallel(): EnsureEntireGitignore writes to the worktree root.
+
+	dir := t.TempDir()
+	testutil.InitRepo(t, dir)
+	t.Chdir(dir)
+	paths.ClearWorktreeRootCache()
+	t.Cleanup(paths.ClearWorktreeRootCache)
+
+	if err := EnsureEntireGitignore(context.Background()); err != nil {
+		t.Fatalf("EnsureEntireGitignore: %v", err)
+	}
+
+	body, err := os.ReadFile(filepath.Join(dir, ".entire", ".gitignore"))
+	if err != nil {
+		t.Fatalf("read .entire/.gitignore: %v", err)
+	}
+	if !strings.Contains(string(body), "redactors/local/") {
+		t.Errorf(".entire/.gitignore missing redactors/local/ entry; got:\n%s", body)
+	}
+}
diff --git a/docs/security-and-privacy.md b/docs/security-and-privacy.md
index a5b09a9dbf..0be03a5e8c 100644
--- a/docs/security-and-privacy.md
+++ b/docs/security-and-privacy.md
@@ -78,6 +78,128 @@ All detected secrets are replaced with `REDACTED`. PII matches are replaced with
 
 To reduce over-redaction, Entire preserves structural transcript fields such as IDs and paths, leaves placeholder values alone, and redacts only credential values for bounded key/value forms. Placeholders are detected by exact match (e.g. `changeme`, `example`, `placeholder`, `your_password`, `your_secret`, prior `REDACTED`/`[REDACTED]`/`<REDACTED>` markers) or by shape: shell expansions like `${DB_PASSWORD}`, bracketed names like `<password>` or `<your-db-password>`, and mask runs of three or more `*`/`x`/`.`/`-` (so `***`, `xxxx`, `....`, `----` all match). When a connection string contains a real password, it is redacted as a unit because partial fragments can still expose sensitive material; connection strings whose passwords are placeholders are left intact.
 
+## Customizing redaction
+
+The built-in detectors handle well-known secret formats. For anything else you don't want stored in transcripts — internal credential shapes the bundled scanners don't know about, project codenames, or specific words and phrases you'd rather keep out of session archives — Entire offers two extension surfaces. Both run plain regex matching against transcript content, so the rules can target any string pattern, not just credentials. Both feed the same engine and run as their own layer between connection-string detection and bounded credential KV detection.
+
+### Surface 1: Inline `redaction.custom_redactions`
+
+Add a label → regex map under `redaction.custom_redactions` in `.entire/settings.json`:
+
+```json
+{
+  "redaction": {
+    "custom_redactions": {
+      "acme_token":  "ACME_TOKEN_[A-Za-z0-9]{20,}",
+      "internal_id": "INTERNAL_[a-z]{6}_[0-9]{4}"
+    }
+  }
+}
+```
+
+- The label is for diagnostics only; matches are replaced with the bare `REDACTED` token (matching the built-in secret layers, not the `[REDACTED_<LABEL>]` token used for PII).
+- Regexes follow [Go's RE2 syntax](https://pkg.go.dev/regexp/syntax). No lookarounds, no backreferences.
+- A failed compile is logged once at startup and the rule is skipped — it will never crash the redactor.
+- Override in `.entire/settings.local.json` for personal additions; entries merge per-key (override replaces the same key, leaves other keys intact).
+
+### Surface 2: Rule packs
+
+Drop a YAML or JSON file into `.entire/redactors/`:
+
+```yaml
+# .entire/redactors/acme-internal.yaml
+name: acme-internal              # MUST match the filename stem
+version: 1.0.0
+description: Internal ACME service tokens
+rules:
+  - id: acme-token
+    description: Long-lived ACME service tokens
+    regex: 'ACME_TOKEN_[A-Za-z0-9]{20,}'
+    samples:
+      - { input: "key=ACME_TOKEN_abc123def456ghi789jkl", redacted: true  }
+      - { input: "ACME_TOKEN_short",                     redacted: false }
+  - id: acme-session
+    regex: 'asess_[a-f0-9]{32}'
+```
+
+Equivalent JSON form:
+
+```json
+{
+  "name": "acme-internal",
+  "version": "1.0.0",
+  "rules": [
+    {
+      "id": "acme-token",
+      "regex": "ACME_TOKEN_[A-Za-z0-9]{20,}",
+      "samples": [
+        { "input": "key=ACME_TOKEN_abc123def456ghi789jkl", "redacted": true  },
+        { "input": "ACME_TOKEN_short",                     "redacted": false }
+      ]
+    }
+  ]
+}
+```
+
+**Required fields:** `name` (must equal the filename stem — `acme-internal.yaml` → `acme-internal`), `version` (any string; semver recommended), and `rules[]` (at least one entry, each with `id` and `regex`).
+
+**Optional fields:** `description` (pack-level and rule-level), and `rules[].samples[]` (see "Self-tests" below).
+
+A pack does not have to target credentials. The same shape works for any string pattern you don't want stored in transcripts — for example, a project codename or a small word list:
+
+```yaml
+# .entire/redactors/local/private-words.yaml
+name: private-words
+version: 1.0.0
+description: Project codenames and personal words to keep out of transcripts
+rules:
+  - id: codename-falcon
+    description: Internal project codename
+    regex: '(?i)\bproject[- ]?falcon\b'
+    samples:
+      - { input: "rolling out Project Falcon next week", redacted: true  }
+      - { input: "the falcon flew over",                  redacted: false }
+  - id: personal-words
+    description: Words I'd rather not see archived
+    regex: '(?i)\b(word_one|word_two)\b'
+```
+
+Putting personal lists under `.entire/redactors/local/` keeps them out of team commits (see "Distribution" below).
+
+### Self-tests via `samples[]`
+
+Each rule may declare an array of `{input, redacted}` pairs. On the next process startup after editing the pack, Entire runs each sample and emits a `slog.Warn` for any mismatch:
+
+```
+WARN  redactor pack sample mismatch  pack=.entire/redactors/acme-internal.yaml
+      rule=acme-token sample_index=0 sample_length=42 expected=true got=false
+```
+
+A failing sample never disables the rule — sample validation is informational. Use it to catch typos and false positives before they ship.
+
+### Distribution
+
+- **Within a team:** commit `.entire/settings.json` and/or `.entire/redactors/*` to your repo. Teammates pull and the rules apply.
+- **Across teams:** copy the pack file or share a link to a gist; recipients drop the file into their `.entire/redactors/`.
+- **Personal-only:** put the file in `.entire/redactors/local/` — `entire enable` writes that path into `.entire/.gitignore` so personal rules don't pollute team commits.
+
+### When to write a rule vs. file an issue
+
+Write a rule for:
+
+- Internal service tokens (`ACME_*`, `INTERNAL_*`) and custom env-var prefixes the bundled detectors don't know about.
+- Project-specific session formats.
+- Project codenames or other identifiers you don't want stored in transcripts.
+- Specific words or phrases you'd rather keep out of session archives.
+
+File an issue when the rule would benefit every Entire user (e.g., a major SaaS issued a new token format), when a built-in is producing false positives on common idioms in your codebase, or when a built-in is *not* catching a well-known shared format (we'd rather fix the built-in than have everyone ship the same custom rule).
+
+### Troubleshooting
+
+- **My rule doesn't redact anything.** Warnings about invalid patterns or sample mismatches appear on stderr when Entire initializes redaction, such as hooks that write checkpoints or `entire doctor`. Look for lines mentioning your label or pack path.
+- **My pack file is silently ignored.** Filenames must end in `.yaml`, `.yml`, or `.json`. Other extensions are skipped.
+- **I want to disable a rule temporarily.** Comment it out (prefix the YAML key with `#`) or remove the entry from `custom_redactions`. The rule reloads on the next CLI invocation.
+
 ## Limitations
 
 - **Best-effort.** Novel or low-entropy secrets (short passwords, predictable tokens) may not be caught.
diff --git a/go.mod b/go.mod
index 0244cb610c..e180277a5d 100644
--- a/go.mod
+++ b/go.mod
@@ -30,6 +30,7 @@ require (
 	golang.org/x/sync v0.20.0
 	golang.org/x/sys v0.43.0
 	golang.org/x/term v0.42.0
+	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
@@ -133,5 +134,4 @@ require (
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/redact/custom.go b/redact/custom.go
new file mode 100644
index 0000000000..30dba3cc1a
--- /dev/null
+++ b/redact/custom.go
@@ -0,0 +1,132 @@
+package redact
+
+import (
+	"log/slog"
+	"regexp"
+	"sync"
+)
+
+// CustomRulesConfig configures inline custom_redactions and parsed rule packs.
+type CustomRulesConfig struct {
+	// Inline maps a label (used only in logs/diagnostics) to a Go RE2 regex
+	// string. Failed compilations are logged via slog.Warn and dropped.
+	Inline map[string]string
+
+	// Packs are pre-parsed rule packs (see LoadPacks). Per-rule regex
+	// compilation failures are logged and dropped; sample mismatches are
+	// logged but do not drop the rule.
+	Packs []*Pack
+}
+
+// compiledCustomRule is a compiled regex retained across calls.
+// label is unused for replacement (custom rules always emit the bare REDACTED
+// token to match other secret layers), but is preserved for diagnostics.
+type compiledCustomRule struct {
+	label string
+	regex *regexp.Regexp
+}
+
+type customRulesState struct {
+	rules []compiledCustomRule
+}
+
+var (
+	customConfig   *customRulesState
+	customConfigMu sync.RWMutex
+)
+
+// ConfigureCustomRules compiles user-defined redaction rules and stores the
+// result for use by redact.String(). Sample-validation runs here too, so
+// failures surface the next time any process initializes redaction.
+//
+// Call once at process startup after loading settings. Thread-safe.
+func ConfigureCustomRules(cfg CustomRulesConfig) {
+	state := &customRulesState{}
+
+	for label, pattern := range cfg.Inline {
+		compiled, ok := compileCustomRule(
+			label,
+			pattern,
+			"skipping invalid custom_redactions pattern",
+			slog.String("label", label),
+		)
+		if ok {
+			state.rules = append(state.rules, compiled)
+		}
+	}
+
+	for _, pack := range cfg.Packs {
+		for _, rule := range pack.Rules {
+			compiled, ok := compileCustomRule(
+				pack.Name+"."+rule.ID,
+				rule.Regex,
+				"skipping invalid pack rule",
+				slog.String("pack", pack.sourcePath),
+				slog.String("rule", rule.ID),
+			)
+			if ok {
+				state.rules = append(state.rules, compiled)
+				runRuleSamples(pack, rule, compiled.regex)
+			}
+		}
+	}
+
+	customConfigMu.Lock()
+	defer customConfigMu.Unlock()
+	customConfig = state
+}
+
+func compileCustomRule(label, pattern, warning string, attrs ...any) (compiledCustomRule, bool) {
+	compiled, err := regexp.Compile(pattern)
+	if err != nil {
+		attrs = append(attrs, slog.String("error", err.Error()))
+		slog.Warn(warning, attrs...)
+		return compiledCustomRule{}, false
+	}
+	return compiledCustomRule{label: label, regex: compiled}, true
+}
+
+// runRuleSamples checks each sample against the compiled regex and logs a
+// warning per mismatch. Failures never drop the rule — sample validation
+// is informational, not gating.
+func runRuleSamples(pack *Pack, rule Rule, compiled *regexp.Regexp) {
+	for i, s := range rule.Samples {
+		got := compiled.MatchString(s.Input)
+		if got != s.Redacted {
+			slog.Warn("redactor pack sample mismatch",
+				slog.String("pack", pack.sourcePath),
+				slog.String("rule", rule.ID),
+				slog.Int("sample_index", i),
+				slog.Int("sample_length", len(s.Input)),
+				slog.Bool("expected", s.Redacted),
+				slog.Bool("got", got))
+		}
+	}
+}
+
+// getCustomRulesConfig returns the currently-configured custom rules.
+// Returns nil if ConfigureCustomRules has never been called.
+func getCustomRulesConfig() *customRulesState {
+	customConfigMu.RLock()
+	defer customConfigMu.RUnlock()
+	return customConfig
+}
+
+// detectCustomRules returns tagged regions for every match of every
+// configured custom rule. Returns nil if no rules are configured.
+//
+// All regions use an empty label so they are replaced with the bare
+// "REDACTED" token used by the built-in secret layers, not the
+// "[REDACTED_<LABEL>]" token used by PII.
+func detectCustomRules(cfg *customRulesState, s string) []taggedRegion {
+	if cfg == nil || len(cfg.rules) == 0 || s == "" {
+		return nil
+	}
+	var regions []taggedRegion
+	for _, rule := range cfg.rules {
+		for _, loc := range rule.regex.FindAllStringIndex(s, -1) {
+			regions = append(regions, taggedRegion{region: region{loc[0], loc[1]}})
+		}
+	}
+	return regions
+}
diff --git a/redact/custom_test.go b/redact/custom_test.go
new file mode 100644
index 0000000000..b1449f8f55
--- /dev/null
+++ b/redact/custom_test.go
@@ -0,0 +1,215 @@
+package redact
+
+import (
+	"bytes"
+	"log/slog"
+	"strings"
+	"sync"
+	"testing"
+)
+
+// resetCustomRulesForTest clears the package-level config so tests don't leak
+// state into each other. Tests cannot run in parallel against the global, so
+// the helper is invoked at top-of-test in a t.Cleanup pattern.
+func resetCustomRulesForTest(t *testing.T) {
+	t.Helper()
+	customConfigMu.Lock()
+	customConfig = nil
+	customConfigMu.Unlock()
+	t.Cleanup(func() {
+		customConfigMu.Lock()
+		customConfig = nil
+		customConfigMu.Unlock()
+	})
+}
+
+// captureSlogForTest installs a slog handler that writes JSON lines to buf.
+// Returns a restore function the caller defers. Tests use this to assert
+// that ConfigureCustomRules emits the right warnings for failing samples.
+func captureSlogForTest(buf *bytes.Buffer) func() {
+	prev := slog.Default()
+	h := slog.NewJSONHandler(buf, &slog.HandlerOptions{Level: slog.LevelWarn})
+	slog.SetDefault(slog.New(h))
+	return func() { slog.SetDefault(prev) }
+}
+
+func TestConfigureCustomRules_SkipsInvalidRegexAndContinues(t *testing.T) {
+	resetCustomRulesForTest(t)
+
+	ConfigureCustomRules(CustomRulesConfig{
+		Inline: map[string]string{
+			"valid":   `[A-Z]{8}`,
+			"invalid": `[unterminated`,
+		},
+	})
+
+	cfg := getCustomRulesConfig()
+	if cfg == nil {
+		t.Fatal("expected config")
+	}
+	if got := len(cfg.rules); got != 1 {
+		t.Fatalf("rules: want 1 (invalid dropped), have %d", got)
+	}
+	if cfg.rules[0].label != "valid" {
+		t.Errorf("label: want valid, have %q", cfg.rules[0].label)
+	}
+}
+
+func TestConfigureCustomRules_ConcurrentReadsAndWrites(t *testing.T) {
+	resetCustomRulesForTest(t)
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() {
+		defer wg.Done()
+		for range 100 {
+			ConfigureCustomRules(CustomRulesConfig{Inline: map[string]string{"x": `[a-z]+`}})
+		}
+	}()
+	go func() {
+		defer wg.Done()
+		for range 100 {
+			_ = getCustomRulesConfig()
+		}
+	}()
+	wg.Wait()
+}
+
+func TestString_CustomRuleEndToEnd(t *testing.T) {
+	resetCustomRulesForTest(t)
+	ConfigureCustomRules(CustomRulesConfig{
+		Inline: map[string]string{
+			"acme_token": `ACME_TOKEN_[A-Za-z0-9]{20,}`,
+		},
+	})
+
+	in := "first=ACME_TOKEN_abc123def456ghi789jkl second=ACME_TOKEN_zyx987wvu654tsr321qpo"
+	out := String(in)
+
+	if got := strings.Count(out, "REDACTED"); got != 2 {
+		t.Errorf("REDACTED count: want 2, have %d in %q", got, out)
+	}
+	if contains(t, out, "ACME_TOKEN_") {
+		t.Errorf("raw token leaked into output: %q", out)
+	}
+	if contains(t, out, "[REDACTED_") {
+		t.Errorf("custom rule used PII-style token: %q", out)
+	}
+}
+
+func TestString_CustomRuleNotConfiguredIsNoop(t *testing.T) {
+	resetCustomRulesForTest(t)
+
+	in := "T_aaaaaa T_bbbbbb"
+	if got := String(in); got != in {
+		t.Errorf("expected unchanged %q, got %q", in, got)
+	}
+}
+
+func contains(t *testing.T, s, sub string) bool {
+	t.Helper()
+	return strings.Contains(s, sub)
+}
+
+func TestConfigureCustomRules_SamplesPassEmitNoWarn(t *testing.T) {
+	resetCustomRulesForTest(t)
+
+	var buf bytes.Buffer
+	restore := captureSlogForTest(&buf)
+	defer restore()
+
+	pack := &Pack{
+		Name:    "ok",
+		Version: "1.0.0",
+		Rules: []Rule{
+			{
+				ID:    "match",
+				Regex: `T_[a-z]{6}`,
+				Samples: []Sample{
+					{Input: "T_abcdef", Redacted: true},
+					{Input: "T_short", Redacted: false},
+				},
+			},
+		},
+		sourcePath: "ok.yaml",
+	}
+
+	ConfigureCustomRules(CustomRulesConfig{Packs: []*Pack{pack}})
+
+	if strings.Contains(buf.String(), `"sample"`) {
+		t.Errorf("expected no sample warnings, got logs: %s", buf.String())
+	}
+}
+
+func TestConfigureCustomRules_SamplesFailEmitWarnButKeepRule(t *testing.T) {
+	resetCustomRulesForTest(t)
+
+	var buf bytes.Buffer
+	restore := captureSlogForTest(&buf)
+	defer restore()
+
+	pack := &Pack{
+		Name:    "bad-sample",
+		Version: "1.0.0",
+		Rules: []Rule{
+			{
+				ID:    "match",
+				Regex: `T_[a-z]{6}`,
+				Samples: []Sample{
+					{Input: "no_match", Redacted: true},
+				},
+			},
+		},
+		sourcePath: "bad-sample.yaml",
+	}
+
+	ConfigureCustomRules(CustomRulesConfig{Packs: []*Pack{pack}})
+
+	logs := buf.String()
+	if !strings.Contains(logs, `bad-sample.yaml`) {
+		t.Errorf("warn missing pack path: %s", logs)
+	}
+	if !strings.Contains(logs, `"rule":"match"`) {
+		t.Errorf("warn missing rule id: %s", logs)
+	}
+
+	cfg := getCustomRulesConfig()
+	if cfg == nil || len(cfg.rules) != 1 {
+		t.Fatalf("rule should remain active despite failing sample, have %v", cfg)
+	}
+}
+
+func TestConfigureCustomRules_SampleMismatchWarnDoesNotLogRawInput(t *testing.T) {
+	resetCustomRulesForTest(t)
+
+	var buf bytes.Buffer
+	restore := captureSlogForTest(&buf)
+	defer restore()
+
+	const sample = "ACME_TOKEN_should_not_appear_in_logs_1234567890"
+	pack := &Pack{
+		Name:    "safe-logs",
+		Version: "1.0.0",
+		Rules: []Rule{
+			{
+				ID:      "sample",
+				Regex:   `NEVER_MATCHES`,
+				Samples: []Sample{{Input: sample, Redacted: true}},
+			},
+		},
+		sourcePath: "safe-logs.yaml",
+	}
+
+	ConfigureCustomRules(CustomRulesConfig{Packs: []*Pack{pack}})
+
+	logs := buf.String()
+	if strings.Contains(logs, sample) {
+		t.Fatalf("sample mismatch log leaked raw sample: %s", logs)
+	}
+	if !strings.Contains(logs, `"sample_index":0`) {
+		t.Errorf("warn missing sample index: %s", logs)
+	}
+	if !strings.Contains(logs, `"sample_length":`) {
+		t.Errorf("warn missing sample length: %s", logs)
+	}
+}
diff --git a/redact/packs.go b/redact/packs.go
new file mode 100644
index 0000000000..50927420d3
--- /dev/null
+++ b/redact/packs.go
@@ -0,0 +1,183 @@
+package redact
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"gopkg.in/yaml.v3"
+)
+
+// RedactorsDirName is the .entire subdirectory used for user-defined rule packs.
+const RedactorsDirName = "redactors"
+
+// Pack is a versioned bundle of redaction rules loaded from a single file
+// under .entire/redactors/. Both YAML and JSON encodings are accepted; the
+// schema is identical.
+type Pack struct {
+	Name        string `json:"name"                  yaml:"name"`
+	Version     string `json:"version"               yaml:"version"`
+	Description string `json:"description,omitempty" yaml:"description"`
+	Rules       []Rule `json:"rules"                 yaml:"rules"`
+
+	// sourcePath is the file the pack was loaded from. Populated by
+	// ParsePack; used in log lines so users can find the offending file.
+	sourcePath string
+}
+
+// Rule is a single redaction rule within a Pack.
+type Rule struct {
+	ID          string   `json:"id"                    yaml:"id"`
+	Description string   `json:"description,omitempty" yaml:"description"`
+	Regex       string   `json:"regex"                 yaml:"regex"`
+	Samples     []Sample `json:"samples,omitempty"     yaml:"samples"`
+}
+
+// Sample is a self-test entry for a Rule. The runner asserts whether the
+// rule's regex matching `Input` matches the `Redacted` expectation.
+type Sample struct {
+	Input    string `json:"input"    yaml:"input"`
+	Redacted bool   `json:"redacted" yaml:"redacted"`
+}
+
+// ParsePack decodes a single pack file. sourcePath is used both to pick
+// the encoding (YAML by default; JSON only when the extension is .json)
+// and to enforce that the pack's `name` matches the filename stem.
+func ParsePack(data []byte, sourcePath string) (*Pack, error) {
+	var pack Pack
+	switch strings.ToLower(filepath.Ext(sourcePath)) {
+	case ".json":
+		decoder := json.NewDecoder(bytes.NewReader(data))
+		decoder.DisallowUnknownFields()
+		if err := decoder.Decode(&pack); err != nil {
+			return nil, fmt.Errorf("parse %s: %w", sourcePath, err)
+		}
+		var extra any
+		if err := decoder.Decode(&extra); err == nil {
+			return nil, fmt.Errorf("parse %s: trailing content after pack", sourcePath)
+		} else if !errors.Is(err, io.EOF) {
+			return nil, fmt.Errorf("parse %s: %w", sourcePath, err)
+		}
+	default:
+		decoder := yaml.NewDecoder(bytes.NewReader(data))
+		decoder.KnownFields(true)
+		if err := decoder.Decode(&pack); err != nil {
+			return nil, fmt.Errorf("parse %s: %w", sourcePath, err)
+		}
+		var extra any
+		if err := decoder.Decode(&extra); err == nil {
+			return nil, fmt.Errorf("parse %s: trailing content after pack", sourcePath)
+		} else if !errors.Is(err, io.EOF) {
+			return nil, fmt.Errorf("parse %s: %w", sourcePath, err)
+		}
+	}
+	pack.sourcePath = sourcePath
+	if err := validatePack(&pack); err != nil {
+		return nil, err
+	}
+	return &pack, nil
+}
+
+// validatePack enforces required fields and schema invariants. Regex
+// compilation is NOT performed here — that happens during ConfigureCustomRules
+// so failures emit the same warn-and-skip path as inline rules.
+func validatePack(p *Pack) error {
+	if p.Name == "" {
+		return fmt.Errorf("%s: missing required field 'name'", p.sourcePath)
+	}
+	if p.Version == "" {
+		return fmt.Errorf("%s: missing required field 'version'", p.sourcePath)
+	}
+	if len(p.Rules) == 0 {
+		return fmt.Errorf("%s: 'rules' must contain at least one entry", p.sourcePath)
+	}
+
+	// Name must match filename stem so log lines and discovery stay consistent.
+	stem := strings.TrimSuffix(filepath.Base(p.sourcePath), filepath.Ext(p.sourcePath))
+	if stem != p.Name {
+		return fmt.Errorf("%s: pack name %q does not match filename stem %q", p.sourcePath, p.Name, stem)
+	}
+
+	seen := make(map[string]struct{}, len(p.Rules))
+	for i, r := range p.Rules {
+		if r.ID == "" {
+			return fmt.Errorf("%s: rules[%d] missing required field 'id'", p.sourcePath, i)
+		}
+		if r.Regex == "" {
+			return fmt.Errorf("%s: rules[%d] (%s) missing required field 'regex'", p.sourcePath, i, r.ID)
+		}
+		if _, dup := seen[r.ID]; dup {
+			return fmt.Errorf("%s: duplicate rule id %q", p.sourcePath, r.ID)
+		}
+		seen[r.ID] = struct{}{}
+	}
+	return nil
+}
+
+// LoadPacks discovers and parses all rule packs in dir, including any
+// subdirectories (so the conventional .entire/redactors/local/ path for
+// personal/uncommitted rules is picked up automatically). Files with the
+// extensions .yaml, .yml, and .json are considered packs; other files are
+// ignored. A missing directory is treated as "no packs configured" and
+// returns no error. Per-file parse errors are slog.Warn'd and the file is
+// skipped — never fatal — so one bad file does not silence the rest.
+func LoadPacks(dir string) ([]*Pack, error) {
+	var packs []*Pack
+	walkErr := filepath.WalkDir(dir, func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			if path == dir {
+				if os.IsNotExist(err) {
+					return nil
+				}
+				return fmt.Errorf("read redactors dir %s: %w", dir, err)
+			}
+			slog.Warn("skipping unreadable redactor pack path",
+				slog.String("path", path),
+				slog.String("error", err.Error()))
+			return nil
+		}
+		if path == dir && !d.IsDir() {
+			return fmt.Errorf("redactors path %s is not a directory", dir)
+		}
+		if d.Type()&fs.ModeSymlink != 0 {
+			slog.Warn("skipping symlinked redactor pack path", slog.String("path", path))
+			return nil
+		}
+		if d.IsDir() {
+			return nil
+		}
+		switch strings.ToLower(filepath.Ext(d.Name())) {
+		case ".yaml", ".yml", ".json":
+		default:
+			return nil
+		}
+
+		data, err := os.ReadFile(path) //nolint:gosec // path comes from WalkDir under a configured dir
+		if err != nil {
+			slog.Warn("skipping unreadable redactor pack",
+				slog.String("path", path),
+				slog.String("error", err.Error()))
+			return nil
+		}
+		pack, err := ParsePack(data, path)
+		if err != nil {
+			slog.Warn("skipping invalid redactor pack",
+				slog.String("path", path),
+				slog.String("error", err.Error()))
+			return nil
+		}
+		packs = append(packs, pack)
+		return nil
+	})
+	if walkErr != nil {
+		return nil, fmt.Errorf("walk redactors dir %s: %w", dir, walkErr)
+	}
+	return packs, nil
+}
diff --git a/redact/packs_test.go b/redact/packs_test.go
new file mode 100644
index 0000000000..e3052f3c55
--- /dev/null
+++ b/redact/packs_test.go
@@ -0,0 +1,349 @@
+package redact
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestParsePack_Valid(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name        string
+		sourcePath  string
+		body        string
+		wantRules   int
+		wantSamples int
+	}{
+		{
+			name:       "yaml",
+			sourcePath: "acme-internal.yaml",
+			body: `
+name: acme-internal
+version: 1.0.0
+description: Internal ACME tokens
+rules:
+  - id: acme-token
+    regex: 'ACME_TOKEN_[A-Za-z0-9]{20,}'
+    samples:
+      - { input: "ACME_TOKEN_abc123def456ghi789jkl", redacted: true }
+      - { input: "ACME_TOKEN_short", redacted: false }
+  - id: acme-session
+    regex: 'asess_[a-f0-9]{32}'
+`,
+			wantRules:   2,
+			wantSamples: 2,
+		},
+		{
+			name:       "json",
+			sourcePath: "acme-internal.json",
+			body: `{
+  "name": "acme-internal",
+  "version": "1.0.0",
+  "rules": [
+    {
+      "id": "acme-token",
+      "regex": "ACME_TOKEN_[A-Za-z0-9]{20,}"
+    }
+  ]
+}`,
+			wantRules: 1,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			pack, err := ParsePack([]byte(tc.body), tc.sourcePath)
+			if err != nil {
+				t.Fatalf("ParsePack: %v", err)
+			}
+			if pack.Name != "acme-internal" {
+				t.Errorf("Name: want acme-internal, have %q", pack.Name)
+			}
+			if pack.Version != "1.0.0" {
+				t.Errorf("Version: want 1.0.0, have %q", pack.Version)
+			}
+			if len(pack.Rules) != tc.wantRules {
+				t.Fatalf("Rules: want %d, have %d", tc.wantRules, len(pack.Rules))
+			}
+			if pack.Rules[0].ID != "acme-token" {
+				t.Errorf("Rules[0].ID: want acme-token, have %q", pack.Rules[0].ID)
+			}
+			if len(pack.Rules[0].Samples) != tc.wantSamples {
+				t.Errorf("Rules[0].Samples: want %d, have %d", tc.wantSamples, len(pack.Rules[0].Samples))
+			}
+		})
+	}
+}
+
+func TestParsePack_RejectsInvalidPacks(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name       string
+		sourcePath string
+		body       string
+		want       []string
+	}{
+		{
+			name:       "missing name",
+			sourcePath: "noname.yaml",
+			body: `
+version: 1.0.0
+rules:
+  - id: x
+    regex: 'X+'
+`,
+			want: []string{"name"},
+		},
+		{
+			name:       "empty rules",
+			sourcePath: "empty.yaml",
+			body: `
+name: empty
+version: 1.0.0
+rules: []
+`,
+			want: []string{"rules"},
+		},
+		{
+			name:       "duplicate rule ids",
+			sourcePath: "dupe.yaml",
+			body: `
+name: dupe
+version: 1.0.0
+rules:
+  - id: same
+    regex: 'A+'
+  - id: same
+    regex: 'B+'
+`,
+			want: []string{"duplicate"},
+		},
+		{
+			name:       "name must match filename stem",
+			sourcePath: "actual-filename.yaml",
+			body: `
+name: not-the-filename
+version: 1.0.0
+rules:
+  - id: x
+    regex: 'X+'
+`,
+			want: []string{"name", "filename"},
+		},
+		{
+			name:       "unknown yaml field",
+			sourcePath: "unknown-yaml.yaml",
+			body: `
+name: unknown-yaml
+version: 1.0.0
+rules:
+  - id: x
+    regex: 'X+'
+    samplez: []
+`,
+			want: []string{"samplez"},
+		},
+		{
+			name:       "unknown json field",
+			sourcePath: "unknown-json.json",
+			body: `{
+  "name": "unknown-json",
+  "version": "1.0.0",
+  "rules": [
+    {"id": "x", "regex": "X+", "samplez": []}
+  ]
+}`,
+			want: []string{"samplez"},
+		},
+		{
+			name:       "trailing json content",
+			sourcePath: "trailing-json.json",
+			body: `{
+  "name": "trailing-json",
+  "version": "1.0.0",
+  "rules": [{"id": "x", "regex": "X+"}]
+}
+{
+  "name": "second"
+}`,
+			want: []string{"trailing"},
+		},
+		{
+			name:       "multiple yaml documents",
+			sourcePath: "multiple-yaml.yaml",
+			body: `
+name: multiple-yaml
+version: 1.0.0
+rules:
+  - id: x
+    regex: 'X+'
+---
+name: second
+`,
+			want: []string{"trailing"},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			_, err := ParsePack([]byte(tc.body), tc.sourcePath)
+			if err == nil {
+				t.Fatal("expected error")
+			}
+			for _, want := range tc.want {
+				if !strings.Contains(err.Error(), want) {
+					t.Errorf("error should mention %q, got: %v", want, err)
+				}
+			}
+		})
+	}
+}
+
+func TestLoadPacks_ReadsMultipleFilesAndIgnoresOthers(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+
+	mustWrite(t, dir, "alpha.yaml", `
+name: alpha
+version: 1.0.0
+rules:
+  - id: a
+    regex: 'A+'
+`)
+	mustWrite(t, dir, "beta.json", `{
+  "name": "beta",
+  "version": "1.0.0",
+  "rules": [{"id": "b", "regex": "B+"}]
+}`)
+	mustWrite(t, dir, "ignored.txt", `not a pack`)
+	mustWrite(t, dir, "broken.yaml", `name: [this is malformed`)
+
+	packs, err := LoadPacks(dir)
+	if err != nil {
+		t.Fatalf("LoadPacks: %v", err)
+	}
+	if len(packs) != 2 {
+		t.Fatalf("packs: want 2 (alpha, beta), have %d", len(packs))
+	}
+
+	got := map[string]bool{}
+	for _, p := range packs {
+		got[p.Name] = true
+	}
+	if !got["alpha"] || !got["beta"] {
+		t.Errorf("expected packs alpha+beta, got %v", got)
+	}
+}
+
+func TestLoadPacks_MissingDirReturnsEmpty(t *testing.T) {
+	t.Parallel()
+
+	dir := filepath.Join(t.TempDir(), "does-not-exist")
+	packs, err := LoadPacks(dir)
+	if err != nil {
+		t.Fatalf("LoadPacks should be tolerant of missing dirs, got: %v", err)
+	}
+	if len(packs) != 0 {
+		t.Errorf("packs: want 0, have %d", len(packs))
+	}
+}
+
+func TestLoadPacks_RejectsNonDirectory(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	path := filepath.Join(dir, "redactors")
+	if err := os.WriteFile(path, []byte("not a directory"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	_, err := LoadPacks(path)
+	if err == nil {
+		t.Fatal("expected error for non-directory redactors path")
+	}
+	if !strings.Contains(err.Error(), "not a directory") {
+		t.Errorf("error should mention non-directory path, got: %v", err)
+	}
+}
+
+func TestLoadPacks_SkipsSymlinkedPackFiles(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	outside := filepath.Join(t.TempDir(), "outside.yaml")
+	if err := os.WriteFile(outside, []byte(`
+name: symlinked
+version: 1.0.0
+rules:
+  - id: x
+    regex: 'X+'
+`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(outside, filepath.Join(dir, "symlinked.yaml")); err != nil {
+		t.Skipf("symlink not supported: %v", err)
+	}
+
+	packs, err := LoadPacks(dir)
+	if err != nil {
+		t.Fatalf("LoadPacks: %v", err)
+	}
+	if len(packs) != 0 {
+		t.Fatalf("symlinked pack should be skipped, loaded %d pack(s)", len(packs))
+	}
+}
+
+// TestLoadPacks_DescendsIntoSubdirs verifies that packs in subdirectories
+// (e.g. the conventional .entire/redactors/local/ for personal/uncommitted
+// rules) are discovered. Without recursion, the docs' "personal-only"
+// distribution path would silently no-op.
+func TestLoadPacks_DescendsIntoSubdirs(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	mustWrite(t, dir, "team.yaml", `
+name: team
+version: 1.0.0
+rules:
+  - id: t
+    regex: 'T+'
+`)
+	if err := os.MkdirAll(filepath.Join(dir, "local"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	mustWrite(t, filepath.Join(dir, "local"), "personal.yaml", `
+name: personal
+version: 1.0.0
+rules:
+  - id: p
+    regex: 'P+'
+`)
+
+	packs, err := LoadPacks(dir)
+	if err != nil {
+		t.Fatalf("LoadPacks: %v", err)
+	}
+	got := map[string]bool{}
+	for _, p := range packs {
+		got[p.Name] = true
+	}
+	if !got["team"] || !got["personal"] {
+		t.Errorf("expected team+personal packs, got %v", got)
+	}
+}
+
+func mustWrite(t *testing.T, dir, name, body string) {
+	t.Helper()
+	if err := os.WriteFile(filepath.Join(dir, name), []byte(body), 0o600); err != nil {
+		t.Fatal(err)
+	}
+}
diff --git a/redact/redact.go b/redact/redact.go
index 7c9836c70b..8e743da4c7 100644
--- a/redact/redact.go
+++ b/redact/redact.go
@@ -159,8 +159,9 @@ var connectionStringRules = []connectionStringRule{
 // 2. Pattern-based: betterleaks regex rules (260+ known secret formats)
 // 3. Credentialed URIs: URLs containing userinfo passwords
 // 4. Database connection strings: JDBC, keyword DSNs, and semicolon strings
-// 5. Bounded credential key/value pairs: DB_PASSWORD=...
-// 6. PII detection: email, phone, address patterns (only when configured via ConfigurePII)
+// 5. User-defined custom rules: configured via ConfigureCustomRules
+// 6. Bounded credential key/value pairs: DB_PASSWORD=...
+// 7. PII detection: email, phone, address patterns (only when configured via ConfigurePII)
 // A string is redacted if ANY method flags it.
 func String(s string) string {
 	var regions []taggedRegion
@@ -217,10 +218,13 @@ func String(s string) string {
 	// 4. Database and connection-string detection (secrets — always on).
 	regions = append(regions, detectConnectionStrings(s)...)
 
-	// 5. Bounded credential key/value detection (secrets — always on).
+	// 5. User-defined custom rules (secrets — only runs when configured).
+	regions = append(regions, detectCustomRules(getCustomRulesConfig(), s)...)
+
+	// 6. Bounded credential key/value detection (secrets — always on).
 	regions = append(regions, detectCredentialValues(s)...)
 
-	// 6. PII detection (opt-in — only runs when configured).
+	// 7. PII detection (opt-in — only runs when configured).
 	regions = append(regions, detectPII(getPIIConfig(), s)...)
 
 	if len(regions) == 0 {