diff --git a/.gitleaks.toml b/.gitleaks.toml
index 5e0e276..fd3908d 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -6,13 +6,8 @@ title = "pi-commandcode-provider secret scan"
 [allowlist]
   description = "Known safe paths and test fixtures"
   paths = [
-    # Test helpers with mock credentials
-    "tests/test-oauth.ts",
-    "tests/test-retry.ts",
-    "tests/test-stream.ts",
-    "tests/test-pure-functions.ts",
-    "tests/test-pi-local.mjs",
-    "tests/test-omp-compat.mjs",
+    # Test fixtures use intentionally fake credentials.
+    "^tests/",
     # CI workflows reference NPM_TOKEN secret name
     ".github/workflows/publish.yml",
   ]