diff --git a/.gitleaks.toml b/.gitleaks.toml
index 7666d76..1f076e1 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -17,10 +17,11 @@ useDefault = true
 # credential and has no secret analogue.
 [[allowlists]]
 description = "infra#317 — METRIC_KEY is a metrics identifier, not a credential"
-condition = "AND"
+# infra#344: `paths` removed. gitleaks ORs the clauses of a GLOBAL allowlist and
+# does not honour `condition = "AND"` there, so the path matched on its own and
+# granted the whole file immunity — every finding in it, not just this one.
+# Verified: a live-shaped credential planted in that file scanned clean before
+# this change and fires after it. The regex below is what was meant and works
+# regardless of which file the value appears in (infra#256).
 regexTarget = "line"
-paths = [
-  '''(^|/)scripts/var_breach\.py$''',
-  '''(^|/)tests/test_var_metric\.py$''',
-]
 regexes = ['''METRIC_KEY''']