diff --git a/bots/echidnabot/Cargo.lock b/bots/echidnabot/Cargo.lock
index f6b7e3b3..2a95a139 100644
--- a/bots/echidnabot/Cargo.lock
+++ b/bots/echidnabot/Cargo.lock
@@ -581,9 +581,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",
@@ -1309,11 +1309,10 @@ dependencies = [
 
 [[package]]
 name = "event-listener"
-version = "5.4.1"
+version = "5.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
+checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2"
 dependencies = [
- "concurrent-queue",
  "parking",
  "pin-project-lite",
 ]
@@ -3881,9 +3880,9 @@ dependencies = [
 
 [[package]]
 name = "spin"
-version = "0.9.8"
+version = "0.9.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
 dependencies = [
  "lock_api",
 ]
diff --git a/bots/echidnabot/FLEET-SYNC.json b/bots/echidnabot/FLEET-SYNC.json
index 95b15b20..8f96931b 100644
--- a/bots/echidnabot/FLEET-SYNC.json
+++ b/bots/echidnabot/FLEET-SYNC.json
@@ -1 +1 @@
-{"fleet_owned":["CANONICAL_SOURCE.adoc","FLEET-SYNC.json"],"include":[".cargo","Cargo.lock","Cargo.toml","Containerfile","LICENSE","LICENSES","README.adoc","benches","config","echidnabot.example.toml","fuzz","migrations","mise.toml","proofs","rust-toolchain.toml","scripts/bootstrap.sh","src","tests"],"repo":"https://github.com/hyperpolymath/echidnabot","rev":"1443adfabb98a9e0daea562bc8dbe764442c14cc","schema":"gitbot-fleet.vendor-sync/1","upstream_branch":"main"}
+{"fleet_owned":["CANONICAL_SOURCE.adoc","FLEET-SYNC.json"],"include":[".cargo","Cargo.lock","Cargo.toml","Containerfile","LICENSE","LICENSES","README.adoc","benches","config","echidnabot.example.toml","fuzz","migrations","mise.toml","proofs","rust-toolchain.toml","scripts/bootstrap.sh","src","tests"],"repo":"https://github.com/hyperpolymath/echidnabot","rev":"a045184cc0afc59d7136501c80d5c4a75c38d411","schema":"gitbot-fleet.vendor-sync/1","upstream_branch":"main"}
diff --git a/bots/echidnabot/src/api/auth.rs b/bots/echidnabot/src/api/auth.rs
index a19eef22..196c3271 100644
--- a/bots/echidnabot/src/api/auth.rs
+++ b/bots/echidnabot/src/api/auth.rs
@@ -41,11 +41,15 @@ use super::graphql::EchidnabotSchema;
 use super::rate_limit::WebhookRateLimiter;
 use crate::trust::solver_integrity::constant_time_eq;
 
+// The 2 values below are names of environment variables, not credentials.
+// The pragma says so to the Rust rule of the estate secret scan, which reads
+// a `TOKEN` constant with a string literal as a possible secret.
+
 /// Environment variable holding the route credential.
-pub const ROUTE_TOKEN_ENV: &str = "ECHIDNABOT_API_ROUTE_TOKEN";
+pub const ROUTE_TOKEN_ENV: &str = "ECHIDNABOT_API_ROUTE_TOKEN"; // scanner-allow: rust-secrets
 
 /// Environment variable holding the administrative credential.
-pub const ADMIN_TOKEN_ENV: &str = "ECHIDNABOT_API_ADMIN_TOKEN";
+pub const ADMIN_TOKEN_ENV: &str = "ECHIDNABOT_API_ADMIN_TOKEN"; // scanner-allow: rust-secrets
 
 /// Shortest credential accepted, in bytes. Generate one with
 /// `openssl rand -hex 32` (64 characters).
diff --git a/bots/echidnabot/tests/protocol_contract.rs b/bots/echidnabot/tests/protocol_contract.rs
index 6a810329..5fa9cb6b 100644
--- a/bots/echidnabot/tests/protocol_contract.rs
+++ b/bots/echidnabot/tests/protocol_contract.rs
@@ -308,15 +308,30 @@ async fn invalid_obligations_are_graphql_errors_not_success_false() {
 // for anything that executes the schema directly.
 // ---------------------------------------------------------------------------
 
-const UPDATE_SETTINGS: &str =
-    "mutation { updateRepoSettings(repoId: \"00000000-0000-0000-0000-000000000000\", \
-     settings: { webhookSecret: \"forged\" }) { id } }";
+/// A well-formed repository ID that names no repository: the nil UUID. It
+/// comes from the type, because the estate UUID gate refuses a UUID literal
+/// that is not version 8.
+fn absent_repo_id() -> uuid::Uuid {
+    uuid::Uuid::nil()
+}
+
+fn update_settings() -> String {
+    format!(
+        "mutation {{ updateRepoSettings(repoId: \"{}\", \
+         settings: {{ webhookSecret: \"forged\" }}) {{ id }} }}",
+        absent_repo_id()
+    )
+}
 const RECORD_OUTCOME: &str = "mutation { recordTacticOutcome(input: { \
      prover: COQ, goalState: \"g\", tactic: \"auto\", succeeded: true, durationMs: 1 }) { id } }";
 const REGISTER_REPO: &str = "mutation { registerRepository(input: { \
      platform: GIT_HUB, owner: \"someone-else\", name: \"repo\", webhookSecret: \"forged\" }) { id } }";
-const TRIGGER_CHECK: &str =
-    "mutation { triggerCheck(repoId: \"00000000-0000-0000-0000-000000000000\") { id } }";
+fn trigger_check() -> String {
+    format!(
+        "mutation {{ triggerCheck(repoId: \"{}\") {{ id }} }}",
+        absent_repo_id()
+    )
+}
 
 #[tokio::test]
 async fn obligation_outside_the_route_scope_is_forbidden() {
@@ -331,12 +346,13 @@ async fn obligation_outside_the_route_scope_is_forbidden() {
 async fn schema_executed_without_a_principal_refuses_the_guarded_fields() {
     let schema = obligation_schema().await;
     let submit = fleet_mutation("hyperpolymath/echidnabot", "c", "d", "");
+    let (update_settings, trigger_check) = (update_settings(), trigger_check());
     for q in [
         submit.as_str(),
-        UPDATE_SETTINGS,
+        update_settings.as_str(),
         RECORD_OUTCOME,
         REGISTER_REPO,
-        TRIGGER_CHECK,
+        trigger_check.as_str(),
         "{ repositories { id } }",
     ] {
         let resp = run_as(&schema, q, None).await;
@@ -351,11 +367,12 @@ async fn schema_executed_without_a_principal_refuses_the_guarded_fields() {
 #[tokio::test]
 async fn route_credential_cannot_reach_administrative_fields() {
     let schema = obligation_schema().await;
+    let (update_settings, trigger_check) = (update_settings(), trigger_check());
     for q in [
-        UPDATE_SETTINGS,
+        update_settings.as_str(),
         RECORD_OUTCOME,
         REGISTER_REPO,
-        TRIGGER_CHECK,
+        trigger_check.as_str(),
         "{ repositories { id } }",
     ] {
         let resp = run(&schema, q).await;
diff --git a/bots/echidnabot/tests/smoke.rs b/bots/echidnabot/tests/smoke.rs
index 501878a6..527c7833 100644
--- a/bots/echidnabot/tests/smoke.rs
+++ b/bots/echidnabot/tests/smoke.rs
@@ -22,8 +22,10 @@ use echidnabot::store::SqliteStore;
 use std::sync::Arc;
 
 // Test-only credentials (the `test-` prefix marks them for the secret scanner).
-const ROUTE_TOKEN: &str = "test-route-credential-0123456789abcdef";
-const ADMIN_TOKEN: &str = "test-admin-credential-0123456789abcdef";
+// The Rust rule of that scan has no rule for the prefix: the pragma marks the
+// 2 values for it.
+const ROUTE_TOKEN: &str = "test-route-credential-0123456789abcdef"; // scanner-allow: rust-secrets
+const ADMIN_TOKEN: &str = "test-admin-credential-0123456789abcdef"; // scanner-allow: rust-secrets
 
 async fn make_test_server() -> TestServer {
     let config = Arc::new(Config::default());
@@ -253,9 +255,15 @@ async fn smoke_graphql_route_credential_cannot_rewrite_webhook_secret() {
     let response = server
         .post("/graphql")
         .authorization_bearer(ROUTE_TOKEN)
+        // The nil UUID is a well-formed ID that names no repository. It comes
+        // from the type: the estate UUID gate refuses a literal that is not
+        // version 8.
         .json(&serde_json::json!({
-            "query": "mutation { updateRepoSettings(repoId: \"00000000-0000-0000-0000-000000000000\", \
-                      settings: { webhookSecret: \"forged\" }) { id } }"
+            "query": format!(
+                "mutation {{ updateRepoSettings(repoId: \"{}\", \
+                 settings: {{ webhookSecret: \"forged\" }}) {{ id }} }}",
+                uuid::Uuid::nil()
+            )
         }))
         .await;
     response.assert_status_ok();
diff --git a/tests/echidnabot/api_gate_regressions.rs b/tests/echidnabot/api_gate_regressions.rs
index 8372914e..80035377 100644
--- a/tests/echidnabot/api_gate_regressions.rs
+++ b/tests/echidnabot/api_gate_regressions.rs
@@ -7,7 +7,9 @@ use axum_test::TestServer;
 use echidnabot::api::auth::{api_gate_middleware, ApiCredentials, ApiGate, Principal, RepoScope};
 use std::{net::SocketAddr, sync::Arc};
 
-const TOKEN: &str = "test-admin-credential-0123456789abcdef";
+// Test-only credential. The Rust rule of the secret scan has no rule for the
+// `test-` prefix: the pragma marks the value for it.
+const TOKEN: &str = "test-admin-credential-0123456789abcdef"; // scanner-allow: rust-secrets
 
 fn server(limit: Option<u32>, peer: Option<SocketAddr>) -> TestServer {
     let credentials = ApiCredentials::new(None, Some(TOKEN.into()), RepoScope::default()).unwrap();