diff --git a/CHANGELOG.md b/CHANGELOG.md
index 27d30ba..fe31c70 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- A guard now keeps literal credentials out of the tests, and keeps every generated credential's
+  purpose a single word, because secret scanners cannot tell a test password from a leaked one.
+  `laranail/package-tools`, which ships it, is now required at `^0.1.10`.
 - `require` declares what `src/` uses directly: `illuminate/routing` (the `Route` facade in the
   provider) and `laravel/framework`, for `Illuminate\Foundation\Http\FormRequest` in
   `LookupRequest`, which has no split package. `laravel/framework` replaces every `illuminate/*` split, so an application installs nothing
diff --git a/composer.json b/composer.json
index c5b1712..4e684d2 100644
--- a/composer.json
+++ b/composer.json
@@ -41,7 +41,7 @@
         "illuminate/support": "^13.0",
         "illuminate/validation": "^13.0",
         "laranail/atlas": "^0.1",
-        "laranail/package-tools": "^0.1",
+        "laranail/package-tools": "^0.1.10",
         "laravel/framework": "^13.0"
     },
     "require-dev": {
diff --git a/tests/Architecture/NoLiteralCredentialsTest.php b/tests/Architecture/NoLiteralCredentialsTest.php
new file mode 100644
index 0000000..9810473
--- /dev/null
+++ b/tests/Architecture/NoLiteralCredentialsTest.php
@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+use Simtabi\Laranail\Package\Tools\Testing\AssertsNoLiteralCredentials;
+
+/*
+ * Secret scanning cannot tell a test password from a leaked one, and reports both. Tests take
+ * their credentials from TestCredentials at run time; these fail on any literal left behind, and
+ * on any generated credential whose purpose is not a single word.
+ */
+uses(AssertsNoLiteralCredentials::class);
+
+it('keeps literal credentials out of the tests', function (): void {
+    $this->assertNoLiteralCredentialsIn([dirname(__DIR__)], minFiles: 5);
+    expect(true)->toBeTrue();
+});
+
+it('names every generated credential with a single word', function (): void {
+    $this->assertCredentialPurposesAreWordsIn([dirname(__DIR__)], minFiles: 5);
+    expect(true)->toBeTrue();
+});