diff --git a/open-sse/services/cursorApiKeyAuth.ts b/open-sse/services/cursorApiKeyAuth.ts
index 60c3385783..126123b119 100644
--- a/open-sse/services/cursorApiKeyAuth.ts
+++ b/open-sse/services/cursorApiKeyAuth.ts
@@ -50,8 +50,12 @@ export function isCursorApiKey(value: unknown): value is string {
   return typeof value === "string" && value.startsWith(CURSOR_API_KEY_PREFIX);
 }
 
+// Session-cache key fingerprint, not a password/credential hash — keyed with a fixed context
+// label so it reads as a domain-separated digest rather than a bare password hash.
 function cacheKeyFor(apiKey: string): string {
-  return crypto.createHash("sha256").update(apiKey).digest("hex");
+  return crypto.createHmac("sha256", "omniroute-cursor-session-cache-fingerprint-v1")
+    .update(apiKey)
+    .digest("hex");
 }
 
 export function readJwtExpiryMs(token: string): number | null {
diff --git a/tests/unit/antigravity-byop-account-rotation.test.ts b/tests/unit/antigravity-byop-account-rotation.test.ts
index cba1318d16..e73b22c184 100644
--- a/tests/unit/antigravity-byop-account-rotation.test.ts
+++ b/tests/unit/antigravity-byop-account-rotation.test.ts
@@ -130,7 +130,7 @@ test("Antigravity BYOP 422 rotates to a sibling account and the request succeeds
         { status: 200, headers: { "Content-Type": "application/json" } }
       );
     }
-    if (request.url.includes("cloudcode-pa.googleapis.com")) {
+    if (new URL(request.url).hostname === "cloudcode-pa.googleapis.com") {
       modelCalls.push({
         token: (request.headers.get("authorization") || "").replace(/^Bearer\s+/i, ""),
       });