diff --git a/.gitleaks.toml b/.gitleaks.toml
index ede3540..611add9 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -18,3 +18,7 @@ paths = ['''\.env\.example$''']
 [[allowlists]]
 description = "apps/api/.env.spike — dev/spike values, not production secrets"
 paths = ['''apps/api/\.env\.spike$''']
+
+[[allowlists]]
+description = "apps/api/tests/broker/crypto.test.ts — synthetic AES-256-GCM test key assigned to process.env.APP_PASSWORD_ENCRYPTION_KEY in a Vitest beforeAll; not a real credential"
+paths = ['''apps/api/tests/broker/crypto\.test\.ts''']