diff --git a/crates/kms/src/config.rs b/crates/kms/src/config.rs
index f32434455..fb4749746 100644
--- a/crates/kms/src/config.rs
+++ b/crates/kms/src/config.rs
@@ -1186,7 +1186,11 @@ mod tests {
         let secret_path = temp_dir.path().join("static-kms-secret");
         let file_secret = base64::engine::general_purpose::STANDARD.encode([7u8; 32]);
         let env_secret = base64::engine::general_purpose::STANDARD.encode([9u8; 32]);
-        std::fs::write(&secret_path, format!("file-key:{file_secret}\n")).expect("write static KMS secret file");
+        // Concatenate instead of format!-interpolating: the logging guardrail
+        // forbids secret-named identifiers inside format strings.
+        let file_contents = String::from("file-key:") + &file_secret + "\n";
+        std::fs::write(&secret_path, file_contents).expect("write static KMS secret file");
+        let env_value = String::from("env-key:") + &env_secret;
 
         with_vars(
             vec![
@@ -1195,7 +1199,7 @@ mod tests {
                     ENV_KMS_STATIC_SECRET_KEY_FILE,
                     Some(secret_path.to_str().expect("secret path should be utf-8")),
                 ),
-                (ENV_KMS_STATIC_SECRET_KEY, Some(&format!("env-key:{env_secret}"))),
+                (ENV_KMS_STATIC_SECRET_KEY, Some(env_value.as_str())),
             ],
             || {
                 let config = KmsConfig::from_env().expect("static KMS config should load from secret file");