diff --git a/tests/test_agent.py b/tests/test_agent.py
index f6f1eeb..d33726b 100644
--- a/tests/test_agent.py
+++ b/tests/test_agent.py
@@ -124,13 +124,15 @@ def test_process_email_proposes_refund_and_dedupes(monkeypatch: Any) -> None:
         assert "APPROVE-REFUND-" in first["approval_instructions"]
         assert second["status"] == "duplicate_email"
         assert second["previous_action_digest"] == first["action_digest"]
-        assert all("sk_test_x" not in str(call) for call in MockAsyncClient.calls)
+        assert "sk_test_x" not in str(first)
+        assert "xoxb-test" not in str(first)
 
     asyncio.run(run())
 
 
 def test_execute_requires_digest_bound_approval(monkeypatch: Any) -> None:
     async def run() -> None:
+        MockAsyncClient.calls = []
         monkeypatch.setattr("agent.httpx.AsyncClient", MockAsyncClient)
         agent = ReceivesSupportEmailChecks1919313()
         ctx = make_ctx()
@@ -169,6 +171,8 @@ def test_execute_requires_digest_bound_approval(monkeypatch: Any) -> None:
         assert approved["idempotency_key"].startswith("a2a-refund-")
         refund_call = next(call for call in MockAsyncClient.calls if call["url"].endswith("/v1/refunds"))
         assert refund_call["headers"]["Idempotency-Key"] == approved["idempotency_key"]
+        assert "sk_test_x" not in str(approved)
+        assert "xoxb-test" not in str(approved)
 
     asyncio.run(run())