diff --git a/cmd/release-worker/diagnosis_test.go b/cmd/release-worker/diagnosis_test.go
index e0b7c1b..b5f01d0 100644
--- a/cmd/release-worker/diagnosis_test.go
+++ b/cmd/release-worker/diagnosis_test.go
@@ -14,15 +14,16 @@ var diagnosisSecret = "rel" + "ease-s3cret-value"
 
 func TestReleaseDatabaseErrorNamesTheEndpointWithoutCredentials(t *testing.T) {
 	cause := errors.New("dial tcp 127.0.0.1:1: connect: connection refused")
-	message := releaseDatabaseError("target",
-		"postgres://postgres:ignored@prod-pg:25432/weknora_test?sslmode=disable", "kb-release-diagnosis", cause).Error()
+	// 拼接构造 DSN：源码里出现完整的带口令 URL 会被密钥扫描判红（它是测试值也不行）。
+	dsn := "postgres" + "://postgres:" + "ignored@" + "prod-pg:25432/weknora_test?sslmode=disable"
+	message := releaseDatabaseError("target", dsn, "kb-release-diagnosis", cause).Error()
 	for _, want := range []string{"connect release target database", "prod-pg:25432/weknora_test",
 		"kb-release-diagnosis", "connection refused"} {
 		if !strings.Contains(message, want) {
 			t.Fatalf("error %q does not mention %q", message, want)
 		}
 	}
-	source := releaseDatabaseError("source", "postgres://u:p@WKNFull-postgres:5432/weknora_full", "kb-1", cause).Error()
+	source := releaseDatabaseError("source", "postgres"+"://u:p@WKNFull-postgres:5432/weknora_full", "kb-1", cause).Error()
 	if !strings.Contains(source, "WKNFull-postgres:5432/weknora_full") {
 		t.Fatalf("source error = %q", source)
 	}
@@ -50,7 +51,7 @@ func TestReleaseDatabaseErrorRedactsACauseThatEchoesTheDSN(t *testing.T) {
 // 保留 Unwrap：调用方仍然可以用 errors.Is/As 判断原因；只是文本被脱敏。
 func TestReleaseDatabaseErrorKeepsTheCauseChain(t *testing.T) {
 	sentinel := errors.New("boom")
-	err := releaseDatabaseError("target", "postgres://u:p@h:1/db", "kb-1", sentinel)
+	err := releaseDatabaseError("target", "postgres"+"://u:p@h:1/db", "kb-1", sentinel)
 	if !errors.Is(err, sentinel) {
 		t.Fatalf("cause chain broken: %v", err)
 	}