diff --git a/lambdas/wo/shoc_hmac_rotator/handler.py b/lambdas/wo/shoc_hmac_rotator/handler.py
index 8bcaad0..80a64ff 100644
--- a/lambdas/wo/shoc_hmac_rotator/handler.py
+++ b/lambdas/wo/shoc_hmac_rotator/handler.py
@@ -167,15 +167,13 @@ def _test_secret(client, secret_id: str, token: str) -> None:
         secret_value
     ):
         raise ValueError("AWSPENDING keys[0].secret is not 64 lowercase hex chars")
-    logger.info(
-        json.dumps(
-            {
-                "event": "hmac_rotation_test_ok",
-                "version_id": token,
-                "kid": head["kid"],
-            }
-        )
-    )
+    # Log only the rotation token, never a value pulled from the parsed
+    # secret dict. kid is non-sensitive (it rides X-SH-Key-Id in the clear)
+    # and is already logged at stage time in _create_secret, but subscripting
+    # the secret-bearing dict here trips CodeQL's clear-text-logging taint
+    # (py/clear-text-logging-sensitive-data) and is fragile if a later edit
+    # swaps the field -- version_id already correlates this step to the stage.
+    logger.info(json.dumps({"event": "hmac_rotation_test_ok", "version_id": token}))
 
 
 def _finish_secret(client, secret_id: str, token: str) -> None: