diff --git a/ci/static.sh b/ci/static.sh
index d81eda3..a026410 100755
--- a/ci/static.sh
+++ b/ci/static.sh
@@ -215,9 +215,18 @@ secrets_scanned=0
 while IFS= read -r -d '' f; do
   [ -f "$f" ] || continue
   secrets_scanned=$((secrets_scanned + 1))
-  if LC_ALL=C grep -nEI "$secret_value_pat" "$f"; then
+  # No -I here, deliberately, and the two rules differ on this for a reason.
+  # grep -I SILENTLY SKIPS a file it decides is binary, so a PEM header inside
+  # one would be waved through without a word. Without -I the same file reports
+  # "binary file matches" and fails, which is the right direction to be wrong
+  # in. (Narrowed by accident when the name rule was added, and caught only by
+  # asking what the flag actually does — the tree has no binary files today, so
+  # nothing went red to announce it.)
+  if LC_ALL=C grep -nE "$secret_value_pat" "$f"; then
     note_fail "$f looks like it contains a credential. It cannot be unpushed — rotate it."
   fi
+  # -I is right HERE: this rule is heuristic and name-anchored, so a chance
+  # match inside a compiled asset is noise, not a finding.
   if LC_ALL=C grep -nEI "$secret_name_pat" "$f" | LC_ALL=C grep -vE "$placeholder_pat"; then
     note_fail "$f assigns a long opaque value to something the code calls a secret. If it is one, it cannot be unpushed — rotate it."
   fi