diff --git a/fuzz/fuzz_targets/fuzz_hmac.rs b/fuzz/fuzz_targets/fuzz_hmac.rs
index 4980490..ad81bb3 100644
--- a/fuzz/fuzz_targets/fuzz_hmac.rs
+++ b/fuzz/fuzz_targets/fuzz_hmac.rs
@@ -14,7 +14,7 @@ use hmac::{Hmac, Mac};
 use sha2::Sha256;
 
 // Fixed secret — we're testing the parsing/comparison path, not the secret itself
-const SECRET: &[u8] = b"fuzz-test-secret-key-not-real";
+const SECRET: &[u8] = b"fuzz-test-secret-key-not-real";  // scanner-allow: rust-secrets
 
 fuzz_target!(|data: &[u8]| {
     // Split data: first 32 bytes treated as a "claimed signature", rest as body