diff --git a/ci/selftest.sh b/ci/selftest.sh
index 91ce0ef..d17111f 100755
--- a/ci/selftest.sh
+++ b/ci/selftest.sh
@@ -44,31 +44,54 @@ cd "$work/repo"
 # stay quiet. An unfilled placeholder is not optional decoration: it is the one
 # string a settings screen is guaranteed to contain, so a rule without that
 # exclusion cries wolf on day one and gets commented out.
-printf 'aws = AKIAIOSFODNN7EXAMPLE\n'                                  > probe-aws.txt
-printf -- '-----BEGIN RSA PRIVATE KEY-----\nMIIEfake\n'                 > probe-pem.txt
-printf 'k = sk-ant-api03-AAAAAAAAAAAAAAAAAAAA\n'                        > probe-skant.txt
-printf 'k = ghp_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n'                   > probe-ghp.txt
-printf 'k = gho_BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB\n'                   > probe-gho.txt
-printf 'k = github_pat_%s\n' "$(printf 'C%.0s' $(seq 1 60))"            > probe-pat.txt
-printf 'k = sk-DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD\n'                   > probe-sk.txt
-printf "'api_key' => 'h8Kd92MsLp01QwErTyUiOp',\n"                       > probe-array.txt
-printf "define( 'WC_EDM_SECRET', 'h8Kd92MsLp01QwErTyUi' );\n"           > probe-define.txt
+# 🔴 Every fixture value below is ASSEMBLED from pieces, never written as a
+# literal. This script is itself a tracked file, so ci/static.sh scans it — and
+# a credential-shaped literal here makes the real tree go red. It did: CI
+# flagged ci/selftest.sh on this file's first push.
+#
+# Assembling is better than any exemption. A filename exemption would switch
+# the scan off in ci/ and tests/, which is exactly where a key gets pasted to
+# test it. A placeholder marker in the value would stop the fixture triggering
+# the check it exists to trigger. Split literals leave the written file fully
+# credential-shaped while the source contains no matching string at all, so
+# nothing has to be excused.
+akia="AKIA""IOSFODNN7EXAMPLE"
+pem="-----BEGIN RSA PRIVATE""  KEY-----"; pem="${pem/  / }"
+skant="sk-ant-""api03-AAAAAAAAAAAAAAAAAAAA"
+ghp="ghp_""AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+gho="gho_""BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
+pat="github_pat_""$(printf 'C%.0s' $(seq 1 60))"
+sk="sk-""DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD"
+opaque="h8Kd92MsLp01QwErTyUiOp"
+
+printf 'aws = %s\n'  "$akia"                        > probe-aws.txt
+printf -- '%s\nMIIEfake\n' "$pem"                   > probe-pem.txt
+printf 'k = %s\n'    "$skant"                       > probe-skant.txt
+printf 'k = %s\n'    "$ghp"                         > probe-ghp.txt
+printf 'k = %s\n'    "$gho"                         > probe-gho.txt
+printf 'k = %s\n'    "$pat"                         > probe-pat.txt
+printf 'k = %s\n'    "$sk"                          > probe-sk.txt
+printf "'api_key' => '%s',\n"              "$opaque" > probe-array.txt
+printf "define( 'WC_EDM_SECRET', '%s' );\n" "$opaque" > probe-define.txt
 
 # Directory coverage. .distignore removes all three from the zip, and a scan
 # reading the SHIPPED list instead of the tracked one therefore misses every CI
 # script, workflow and test fixture — which is exactly where a key gets pasted
 # to test it. A sibling plugin was missing 36 of 73 files this way.
 mkdir -p ci tests .github/workflows
-printf 'k = sk-ant-api03-AAAAAAAAAAAAAAAAAAAA\n' > ci/probe-dir.txt
-printf 'k = sk-ant-api03-AAAAAAAAAAAAAAAAAAAA\n' > tests/probe-dir.txt
-printf 'k = sk-ant-api03-AAAAAAAAAAAAAAAAAAAA\n' > .github/workflows/probe-dir.txt
+printf 'k = %s\n' "$skant" > ci/probe-dir.txt
+printf 'k = %s\n' "$skant" > tests/probe-dir.txt
+printf 'k = %s\n' "$skant" > .github/workflows/probe-dir.txt
 
 # A key inside a file grep calls binary. `grep -I` skips these SILENTLY, so the
 # value rule must not use it; the build going red is the right direction to be
 # wrong in. This fixture exists because that flag was added by accident and
 # nothing went red to announce it.
-printf 'PNG\x00\x00\x00fake-----BEGIN RSA PRIVATE KEY-----\nMIIE\n'     > probe-binary.bin
+printf 'PNG\x00\x00\x00fake%s\nMIIE\n' "$pem"       > probe-binary.bin
 
+# Controls need no assembling: each is either a placeholder the scan excludes
+# by design, or ordinary code that was never credential-shaped. If one of these
+# ever makes the real tree go red, that is a false positive worth knowing about.
 printf 'sha = 9f2b7c1e4a8d6b3f0e5c2a9d7b4f1e8c\nAKIA\n'                 > control-hash.txt
 printf "'api_key' => 'REPLACE_WITH_YOUR_API_KEY',\n"                    > control-placeholder.txt
 printf "'password' => 'xxxxxxxxxxxxxxxxxxxxxxxx',\n"                    > control-masked.txt