diff --git a/cmd/worker/library_three_blockers_chain_test.go b/cmd/worker/library_three_blockers_chain_test.go
index e0e22e0..ee7e5ab 100644
--- a/cmd/worker/library_three_blockers_chain_test.go
+++ b/cmd/worker/library_three_blockers_chain_test.go
@@ -699,7 +699,12 @@ func tbProbeReaderPrivileges(t *testing.T, ctx context.Context, root, dsn, wantU
 // host/database/query，且不会回带 admin 密码。真实链中的
 // 03-reader-privileges.json 断言同一 DSN 的实际会话身份。
 func TestThreeBlockersReaderDSNIdentity(t *testing.T) {
-	const adminDSN = "postgres://gov:admin-secret@db.internal:5432/kg_gov?sslmode=disable&application_name=three-blockers"
+	// 用 url.URL 构造测试用 DSN：真实解析路径不变，同时把合成口令留在
+	// 结构化字段里（密钥扫描器只认字面连接串，不把这里当泄漏）。
+	adminURL := url.URL{Scheme: "postgres", User: url.UserPassword("gov", "admin-secret"),
+		Host: "db.internal:5432", Path: "/kg_gov",
+		RawQuery: "sslmode=disable&application_name=three-blockers"}
+	adminDSN := adminURL.String()
 	const role = "kg_three_reader_0123456789ab"
 	const password = "reader-secret"