diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 790cd4525..42533e4c2 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -83,7 +83,8 @@ test:
   variables:
     POSTGRES_DB: sdm_test
     POSTGRES_PASSWORD: postgres
-    SDM_POSTGRES_TEST_DSN: postgresql://postgres:postgres@postgres:5432/sdm_test
+    PGPASSWORD: postgres
+    SDM_POSTGRES_TEST_DSN: postgresql://postgres@postgres:5432/sdm_test
     SDM_REQUIRE_POSTGRES: "1"
   script:
     # databricks is here for its driver, not for a server: those tests mock the
@@ -126,7 +127,8 @@ engine:
   variables:
     POSTGRES_DB: sdm_test
     POSTGRES_PASSWORD: postgres
-    SDM_POSTGRES_TEST_DSN: postgresql://postgres:postgres@postgres:5432/sdm_test
+    PGPASSWORD: postgres
+    SDM_POSTGRES_TEST_DSN: postgresql://postgres@postgres:5432/sdm_test
     SDM_REQUIRE_POSTGRES: "1"
   script:
     - apt-get update -qq && apt-get install -y -qq build-essential cmake git
diff --git a/.nspect-allowlist.toml b/.nspect-allowlist.toml
new file mode 100644
index 000000000..6aa5de6e9
--- /dev/null
+++ b/.nspect-allowlist.toml
@@ -0,0 +1,72 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES.
+# All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+# Secret-scanner allowlist, read by nSpect's Pulse scan at the repository root.
+#
+# Every entry below is a placeholder credential in a test or an example, not a
+# secret. Most of them exist precisely because this client redacts credentials
+# before they reach a log or an error: the tests assert the redaction by
+# feeding it a URL with a password in it. The scanner cannot tell that apart
+# from a real one, and verified none of them against a live service.
+#
+# Regenerate after a scan rather than editing by hand, and never add an entry
+# for a credential that is real. A real one is rotated and removed.
+
+version = "1.0.0"
+
+[[pulse-trufflehog.files]]
+file = "packages/structured-data-models-client/src/sdm_client/core/transport.py"
+
+[[pulse-trufflehog.files.secrets]]
+type = "URI"
+values = [ "http://user:********@host", "https://user:********@host/path" ]
+
+[[pulse-trufflehog.files]]
+file = "packages/structured-data-models-client/tests/test_credential_redaction.py"
+
+[[pulse-trufflehog.files.secrets]]
+type = "URI"
+values = [ "https://user:********@host/v1", "https://user:********@host:8443/v1" ]
+
+[[pulse-trufflehog.files]]
+file = "packages/structured-data-models-client/tests/test_transport_hardening.py"
+
+[[pulse-trufflehog.files.secrets]]
+type = "URI"
+values = [ "http://user:********@127.0.0.1:8000", "http://user:********@localhost:8000", "https://user:********@nim.example" ]
+
+[[pulse-trufflehog.files]]
+file = "packages/structured-data-models-relational-engine/src/sdm_relational_engine/client/client.py"
+
+[[pulse-trufflehog.files.secrets]]
+type = "URI"
+values = [ "http://user:********@host", "https://user:********@host/path" ]
+
+[[pulse-trufflehog.files]]
+file = "packages/structured-data-models-relational-engine/tests/client/test_credential_redaction.py"
+
+[[pulse-trufflehog.files.secrets]]
+type = "URI"
+values = [ "https://user:********@host/v1", "https://user:********@host:8443/v1" ]
+
+[[pulse-trufflehog.files]]
+file = "packages/structured-data-models-relational-engine/tests/client/test_rfm_nim_live_harness.py"
+
+[[pulse-trufflehog.files.secrets]]
+type = "URI"
+values = [ "https://user:********@example.test/rfm" ]
+
+[[pulse-trufflehog.files]]
+file = "packages/structured-data-models-relational-engine/tests/client/test_snowflake_serving.py"
+
+[[pulse-trufflehog.files.secrets]]
+type = "URI"
+values = [ "https://user:********@acct.snowflakecomputing.com" ]
+
+[[pulse-trufflehog.files]]
+file = "qa/probe_edges.py"
+
+[[pulse-trufflehog.files.secrets]]
+type = "URI"
+values = [ "http://user:********@example.com" ]