diff --git a/.github/workflows/ci-python-sam.yaml b/.github/workflows/ci-python-sam.yaml
index b7ce42f..a66dc25 100644
--- a/.github/workflows/ci-python-sam.yaml
+++ b/.github/workflows/ci-python-sam.yaml
@@ -125,11 +125,14 @@ jobs:
                 warn "SAM template: Lambda found but no explicit log retention"
               fi
             fi
-            # Check for secrets in environment variables
-            if grep -qiE '(API_KEY|SECRET|TOKEN|PASSWORD|WEBHOOK)' "$TEMPLATE" 2>/dev/null; then
-              if grep -A5 'Environment:' "$TEMPLATE" | grep -qiE '(API_KEY|SECRET|TOKEN|PASSWORD|WEBHOOK)' 2>/dev/null; then
-                fail "SAM template: possible secret in Lambda environment variables — use Secrets Manager"
-              fi
+            # Flag HARDCODED secret values in the template. Secrets Manager
+            # references (e.g. SLACK_BOT_TOKEN_SECRET: my-app/slack-token) and
+            # intrinsic functions (!Ref/!Sub/{{resolve:...}}) are the correct
+            # pattern, so match on the value's shape — not the key name, which
+            # legitimately contains words like TOKEN/SECRET when pointing at a
+            # Secrets Manager id.
+            if grep -qiE '(xox[abprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|gh[posu]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk-[A-Za-z0-9]{20,}|-----BEGIN[[:space:]][A-Z ]*PRIVATE KEY-----)' "$TEMPLATE" 2>/dev/null; then
+              fail "SAM template: hardcoded secret in template — use Secrets Manager"
             fi
           fi