diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
new file mode 100644
index 0000000..a1a1261
--- /dev/null
+++ b/.github/codeql/codeql-config.yml
@@ -0,0 +1,32 @@
+# Shared CodeQL configuration for every language in .github/workflows/codeql.yml.
+# Scope suppressions as narrowly as the mechanism allows: prefer a rule-level
+# exclusion with a recorded reason over widening paths-ignore.
+
+name: src-control CodeQL config
+
+paths-ignore:
+  # The vendored glib source is third-party code, byte-identical to the
+  # published crate except for the documented soundness backport and lint cap.
+  # Its upstream FFI triggers false-positive pointer alerts.
+  - vendor/glib-0.18.5-patched/**
+
+query-filters:
+  # rust/cleartext-logging taints anything flowing out of a type or function
+  # whose name contains "Secret", then flags every println!/eprintln!
+  # downstream. In this codebase that is the entire secrets API by design, so
+  # the rule fires on metadata that is public by construction: file paths
+  # ("skipped (no key): {path}"), secret *names* from the public registry,
+  # snapshot ids, and TLS fingerprints. It produced 145 alerts, none of which
+  # printed plaintext.
+  #
+  # Secret plaintext has exactly one sanctioned egress — the child-process env
+  # injected by `sc run` (ADR-0008). There is no `sc secret show`; `sc secret
+  # list` emits names plus a recipient count. The one intentional plaintext
+  # print is `sc serve token add`, which prints a freshly minted token once and
+  # stores only its hash (ADR-0040). None of that is what this rule is for.
+  #
+  # If a real cleartext-logging egress is ever added, this exclusion hides it —
+  # so the compensating control is docs/THREAT-MODEL.md plus the commit-time
+  # secret scanner (P5), not this query.
+  - exclude:
+      id: rust/cleartext-logging
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 03167e9..1972b5f 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -37,12 +37,9 @@ jobs:
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
-          # The vendored glib source is third-party code, byte-identical to the
-          # published crate except for the documented soundness backport and
-          # lint cap. Its upstream FFI triggers false-positive pointer alerts.
-          config: |
-            paths-ignore:
-              - vendor/glib-0.18.5-patched/**
+          # Path and rule exclusions, each with its reason, live in the config
+          # file so they are reviewable in one place.
+          config-file: ./.github/codeql/codeql-config.yml
       - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: "/language:${{ matrix.language }}"