diff --git a/open-sse/config/codexIdentity.ts b/open-sse/config/codexIdentity.ts
index bc45fa1cf6..d743d81649 100644
--- a/open-sse/config/codexIdentity.ts
+++ b/open-sse/config/codexIdentity.ts
@@ -37,15 +37,26 @@ function nonEmptyString(value: unknown): string | null {
   return normalized || null;
 }
 
-/** Keep the historical installation-id layout so existing accounts stay stable. */
+/**
+ * Keep the historical installation-id layout so existing accounts stay stable.
+ * CodeQL: not password hashing — this derives a deterministic installation UUID
+ * from an account seed, never verified against a stored credential. Same
+ * false-positive class as src/lib/db/apiKeys.ts::hashKey.
+ * lgtm[js/insufficient-password-hash]
+ */
 function uuidFromLegacyInstallationValue(value: string): string {
-  const hash = createHash("sha256").update(value).digest("hex");
+  const hash = createHash("sha256").update(value).digest("hex"); // nosemgrep: insufficient-password-hash
   return `${hash.slice(0, 8)}-${hash.slice(8, 12)}-4${hash.slice(13, 16)}-a${hash.slice(17, 20)}-${hash.slice(20, 32)}`;
 }
 
-/** RFC4122 v4 from SHA-256. Same seed → same UUID. */
+/**
+ * RFC4122 v4 from SHA-256. Same seed → same UUID.
+ * CodeQL: not password hashing — deterministic ID derivation from an account
+ * seed, never verified against a stored credential.
+ * lgtm[js/insufficient-password-hash]
+ */
 export function deriveStableUUIDv4(seed: string): string {
-  const digest = createHash("sha256").update(seed).digest();
+  const digest = createHash("sha256").update(seed).digest(); // nosemgrep: insufficient-password-hash
   const bytes = Buffer.from(digest.subarray(0, 16));
   bytes[6] = (bytes[6] & 0x0f) | 0x40;
   bytes[8] = (bytes[8] & 0x3f) | 0x80;
diff --git a/open-sse/services/reasoningCache.ts b/open-sse/services/reasoningCache.ts
index bdf870e3fb..f4dddbfeba 100644
--- a/open-sse/services/reasoningCache.ts
+++ b/open-sse/services/reasoningCache.ts
@@ -302,7 +302,11 @@ export function buildAssistantMessageCacheKey(
   if (!message || message.role !== "assistant") return "";
 
   const transcript = messages.slice(0, messageIndex + 1).map(canonicalizeHistoryMessage);
-  const digest = createHash("sha256")
+  // CodeQL: not password hashing — this derives a cache-lookup key from the
+  // conversation transcript, never verified against a stored credential.
+  // Same false-positive class as src/lib/db/apiKeys.ts::hashKey.
+  // lgtm[js/insufficient-password-hash]
+  const digest = createHash("sha256") // nosemgrep: insufficient-password-hash
     .update(normalizedScope)
     .update("\x1f")
     .update(JSON.stringify(transcript))
diff --git a/tests/unit/early-sse-route-intent.test.ts b/tests/unit/early-sse-route-intent.test.ts
index b8b48918fc..486b176831 100644
--- a/tests/unit/early-sse-route-intent.test.ts
+++ b/tests/unit/early-sse-route-intent.test.ts
@@ -22,7 +22,7 @@ const ROUTES = [
 
 for (const route of ROUTES) {
   test(`${route.name} early-heartbeat gate uses the real stream resolver`, () => {
-    const escapedBodyExpression = route.bodyExpression.replace(/[?.]/g, "\\$&");
+    const escapedBodyExpression = route.bodyExpression.replace(/[.?\\]/g, "\\$&");
     assert.match(
       route.source,
       new RegExp(