diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index d15ace6..00fa808 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -60,7 +60,8 @@ jobs:
           FOUND=0
 
           echo "Checking for private keys in config files..."
-          if grep -rn --include="*.json" --include="*.py" -E "(0x[a-fA-F0-9]{64}|-----BEGIN.*PRIVATE)" . | grep -v node_modules | grep -v "chainId\|genesisHash\|parentId\|currencyIdScale\|typeAlias\|signedExtensions"; then
+          # "account" fields hold public 32-byte account IDs (balance-test fixtures), not private keys
+          if grep -rn --include="*.json" --include="*.py" -E "(0x[a-fA-F0-9]{64}|-----BEGIN.*PRIVATE)" . | grep -v node_modules | grep -v "chainId\|genesisHash\|parentId\|currencyIdScale\|typeAlias\|signedExtensions\|\"account\":"; then
             echo "::error::Possible private key found"
             FOUND=1
           fi