diff --git a/src/processPayrollEmail.js b/src/processPayrollEmail.js
index 161ffed..3979b06 100644
--- a/src/processPayrollEmail.js
+++ b/src/processPayrollEmail.js
@@ -36,6 +36,24 @@ const formatCurrency = (v) =>
     currency: "USD",
   }).format(Number(v || 0));
 
+function isAllowedGustoHost(hostname) {
+  const h = (hostname || "").toLowerCase();
+  return h === "gusto.com" || h.endsWith(".gusto.com");
+}
+
+function bodyMentionsAllowedGustoUrl(text) {
+  const urlMatches = (text || "").match(/\bhttps?:\/\/[^\s<>"')]+/gi) || [];
+  for (const rawUrl of urlMatches) {
+    try {
+      const parsed = new URL(rawUrl);
+      if (isAllowedGustoHost(parsed.hostname)) return true;
+    } catch {
+      // Ignore malformed URLs in email text.
+    }
+  }
+  return false;
+}
+
 function classifyEmail(from, subject, text) {
   const fromAddr = (from?.text || from || "").toLowerCase();
   const subj = (subject || "").toLowerCase();
@@ -54,8 +72,7 @@ function classifyEmail(from, subject, text) {
   }
 
   const strippedSubj = subj.replace(/^fwd?:\s*/i, "");
-  const body = (text || "").toLowerCase();
-  const bodyMentionsGusto = body.includes("gusto.com");
+  const bodyMentionsGusto = bodyMentionsAllowedGustoUrl(text || "");
 
   if (bodyMentionsGusto && strippedSubj.includes("payroll confirmation")) {
     return "employee";