diff --git a/.gitleaks.toml b/.gitleaks.toml
index 416b4cd..074ff6f 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -67,11 +67,11 @@ regexes = ['''^Password=<password>$''']
 # These values must remain tied to these exact paths, not entire test files.
 [[allowlists]]
 targetRules = ["npgsql-keyword-password", "sqlserver-keyword-password"]
-description = "Disposable integration roles and invalid-configuration diagnostic marker"
+description = "Disposable integration roles, interpolated disposable role constant and diagnostic markers"
 condition = "AND"
 paths = ['''^tools/PostgreSqlMcp\.Verify/Integration\.cs$''']
 regexTarget = "match"
-regexes = ['''^Password=(?:reader-disposable|writer-disposable|sensitive-configuration-marker)$''']
+regexes = ['''^Password=(?:reader-disposable|writer-disposable|sensitive-configuration-marker|sensitive-tls-marker|\{password\})$''']
 
 [[allowlists]]
 targetRules = ["npgsql-keyword-password", "sqlserver-keyword-password"]
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 42a7054..ede42c8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@
 - CodeQL: new same-repository-only `pull-request-upload` job uploads the candidate SARIF so PR heads get a code-scanning check run, which Scorecard SAST counts. Scan jobs stay read-only and fork PRs get no upload. No PR code is built or executed with the write token.
 - OpenSSF Best Practices: propose answers for all 67 passing criteria in `.bestpractices.json` (previously 34), after the owner chose to answer previously deferred criteria. Developer-knowledge answers rest on the owner's attestation; response and fix answers cite zero issues, security advisories and Dependabot alerts and no open CodeQL alerts as of 2026-10-10; cryptographic answers describe Npgsql/.NET/OS defaults and operator-controlled TLS; `test_most` is Unmet because coverage is not measured. Nothing is saved on the badge website until the owner reviews and saves it.
 - Document the repository's git and GitHub workflow in [docs/git-workflow.md](docs/git-workflow.md), including tested worktree limits on the VMware shared folder and the repository's merge settings and rulesets. Add bug/feature issue forms with a private security route, a pull-request template, CODEOWNERS and label-based categories for generated GitHub Release notes. Dependabot now uses an explicit `build(deps)` commit prefix and groups GitHub Actions updates into one pull request.
+- Secret scanning: allow two more exact disposable values in `tools/PostgreSqlMcp.Verify/Integration.cs`, the interpolated `Password={password}` role constant and the `sensitive-tls-marker` diagnostic marker used by the privilege/TLS warning scenarios. Other values in that file, and these values in any other file, still fail.
 
 ## 0.4.0