diff --git a/src/shared/utils/maskEmail.ts b/src/shared/utils/maskEmail.ts
index d31d1c2ecf..420183ec89 100644
--- a/src/shared/utils/maskEmail.ts
+++ b/src/shared/utils/maskEmail.ts
@@ -5,7 +5,7 @@
  * to prevent identity exposure in dashboards and logs.
  *
  * @example
- *   maskEmail("diego.souza@gmail.com")  // "di*********@g****.com"
+ *   maskEmail("diego.souza@gmail.com")  // "die********@gmail.com"
  *   maskEmail("a@b.com")                // "a@b.com"  (too short to mask)
  */
 export function maskEmail(email: string | null | undefined, visibleChars = 3): string {
diff --git a/tests/unit/mask-email.test.mjs b/tests/unit/mask-email.test.mjs
index 90ecaaa20f..5bed1839e7 100644
--- a/tests/unit/mask-email.test.mjs
+++ b/tests/unit/mask-email.test.mjs
@@ -8,7 +8,7 @@ import {
 
 describe("maskEmail", () => {
   it("masks standard email correctly", () => {
-    assert.equal(maskEmail("diego.souza@gmail.com"), "di*********@g****.com");
+    assert.equal(maskEmail("diego.souza@gmail.com"), "die********@gmail.com");
   });
 
   it("masks email with short username (exactly visibleChars)", () => {
@@ -18,7 +18,7 @@ describe("maskEmail", () => {
 
   it("masks email with longer username", () => {
     const result = maskEmail("hello@example.com");
-    assert.equal(result, "he***@e******.com");
+    assert.equal(result, "hel**@example.com");
   });
 
   it("returns empty string for null", () => {
@@ -54,14 +54,14 @@ describe("maskEmail", () => {
   });
 
   it("masks email-like values stored in generic labels", () => {
-    assert.equal(maskEmailLikeValue("person@example.com"), "pe****@e******.com");
+    assert.equal(maskEmailLikeValue("person@example.com"), "per***@example.com");
     assert.equal(maskEmailLikeValue("Work Account"), "Work Account");
   });
 
   it("picks the first non-empty masked display value", () => {
     assert.equal(
       pickMaskedDisplayValue(["", "person@example.com", "fallback"], "fallback"),
-      "pe****@e******.com"
+      "per***@example.com"
     );
     assert.equal(pickMaskedDisplayValue([null, "Workspace"], "fallback"), "Workspace");
   });
diff --git a/tests/unit/model-sync-route.test.mjs b/tests/unit/model-sync-route.test.mjs
index e7e1706ce6..89838d0834 100644
--- a/tests/unit/model-sync-route.test.mjs
+++ b/tests/unit/model-sync-route.test.mjs
@@ -435,7 +435,7 @@ test("model sync route records added, removed, and updated model diffs with fall
   assert.equal(logs.length, 1);
   assert.equal(logs[0].status, 200);
   assert.equal(logs[0].provider, "openrouter");
-  assert.ok(logs[0].account.includes("**"), `Expected masked email, got: ${logs[0].account}`);
+  assert.ok(logs[0].account.includes("*"), `Expected masked email, got: ${logs[0].account}`);
 });
 
 test("model sync route accepts external API-key auth, forwards cookies, filters built-ins, and syncs aliases", async () => {