diff --git a/benches/oracle_bench.rs b/benches/oracle_bench.rs
index a862526..f35f65d 100644
--- a/benches/oracle_bench.rs
+++ b/benches/oracle_bench.rs
@@ -66,7 +66,7 @@ fn secret_proposal() -> Proposal {
         action_type: ActionType::CreateFile {
             path: "src/config.rs".to_string(),
         },
-        content: r#"let api_key = "supersecretkey12345""#.to_string(),
+        content: r#"let api_key = "supersecretkey12345""#.to_string(),  // scanner-allow: rust-secrets
         files_affected: vec!["src/config.rs".to_string()],
         llm_confidence: 0.9,
     }
diff --git a/src/contract/src/lib.rs b/src/contract/src/lib.rs
index c56ad04..7a886f0 100644
--- a/src/contract/src/lib.rs
+++ b/src/contract/src/lib.rs
@@ -1565,7 +1565,7 @@ mod tests {
         let runner = ContractRunner::new();
         let request = GatingRequest::new(create_proposal(
             "config.rs",
-            r#"let password = "supersecret123456""#,
+            r#"let password = "supersecret123456""#,  // scanner-allow: rust-secrets
         ));
 
         let decision = runner.evaluate(&request).unwrap();
diff --git a/src/oracle/src/lib.rs b/src/oracle/src/lib.rs
index b755061..6a916e6 100644
--- a/src/oracle/src/lib.rs
+++ b/src/oracle/src/lib.rs
@@ -729,7 +729,7 @@ mod tests {
             action_type: ActionType::CreateFile {
                 path: "config.rs".to_string(),
             },
-            content: r#"let password = "supersecretpassword123""#.to_string(), // test fixture
+            content: r#"let password = "supersecretpassword123""#.to_string(), // test fixture — scanner-allow: rust-secrets
             files_affected: vec!["config.rs".to_string()],
             llm_confidence: 0.9,
         };
@@ -766,7 +766,7 @@ mod tests {
             action_type: ActionType::CreateFile {
                 path: "main.ts".to_string(),
             },
-            content: r#"const x: string = 'hello'; let password = "secret123""#.to_string(),
+            content: r#"const x: string = 'hello'; let password = "secret123""#.to_string(),  // scanner-allow: rust-secrets
             files_affected: vec!["main.ts".to_string()],
             llm_confidence: 0.9,
         };
@@ -1048,7 +1048,7 @@ mod tests {
             action_type: ActionType::CreateFile {
                 path: "config.rs".to_string(),
             },
-            content: r#"const API_KEY = "abcdef1234567890abcdef""#.to_string(), // test fixture
+            content: r#"const API_KEY = "abcdef1234567890abcdef""#.to_string(), // test fixture — scanner-allow: rust-secrets
             files_affected: vec!["config.rs".to_string()],
             llm_confidence: 0.9,
         };
diff --git a/tests/gating_pipeline_test.rs b/tests/gating_pipeline_test.rs
index efdad43..9b1b7fc 100644
--- a/tests/gating_pipeline_test.rs
+++ b/tests/gating_pipeline_test.rs
@@ -78,7 +78,7 @@ fn e2e_hardcoded_secret_blocked() {
     let runner = ContractRunner::new();
     let proposal = create_proposal(
         "config.rs",
-        r#"const password = "supersecretpassword123456789abcde""#,
+        r#"const password = "supersecretpassword123456789abcde""#,  // scanner-allow: rust-secrets
     );
     let request = GatingRequest::new(proposal);
 
diff --git a/tests/security_aspect_test.rs b/tests/security_aspect_test.rs
index 803ee78..56597df 100644
--- a/tests/security_aspect_test.rs
+++ b/tests/security_aspect_test.rs
@@ -309,7 +309,7 @@ fn security_forbidden_pattern_detection() {
 
     // Test secret patterns
     let secret_patterns = vec![
-        r#"password = "thisisasecret123456""#,
+        r#"password = "thisisasecret123456""#,  // scanner-allow: rust-secrets
         r#"secret = "thisisasecret123456""#,
         r#"api_key = "thisisasecret123456""#,
     ];