diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9a85ced57f6..76069b7c42c 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -62,10 +62,9 @@ jobs:
       # a content-integrity hash, not a password or secret hash. SHA-256 is mandated
       # by Oracle for this header; see
       # https://docs.oracle.com/en-us/iaas/Content/API/Concepts/signingrequests.htm
-      # The `usedforsecurity=False` flag on the hashlib.sha256 call already declares
-      # non-security intent, but CodeQL's taint flow still re-fires when callers
-      # further up the stack are modified. The suppression is scoped to this one
-      # file/rule pair via SARIF post-filtering so every other callsite of
+      # The sha256 call carries no usedforsecurity=False flag (FIPS builds reject the hint), so
+      # CodeQL's taint flow fires whenever callers further up the stack are modified. The
+      # suppression is scoped to this one file/rule pair via SARIF post-filtering so every other callsite of
       # py/weak-sensitive-data-hashing in the repository continues to be analyzed.
       # The same query fires on the HIBP k-anonymity lookup in
       # litellm/proxy/auth/password_policy.py, where the password's SHA-1 is only
diff --git a/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_env_vars.py b/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_env_vars.py
index 5c17b9665f4..c536d893ec2 100644
--- a/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_env_vars.py
+++ b/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_env_vars.py
@@ -7,6 +7,7 @@ tests in tests/mcp_tests.
 """
 
 import hashlib
+from typing import Final
 
 import pytest
 
@@ -1728,14 +1729,14 @@ async def test_missing_user_env_vars_error_renders_in_mcp_call_tool():
 
 @pytest.mark.asyncio
 async def test_merge_user_env_vars_locks_the_sha256_key_for_user_and_server(env_vars_salt_key):
-    prisma = _transactional_env_vars_prisma()
+    prisma: Final = _transactional_env_vars_prisma()
     await merge_user_env_vars(prisma, "alice", "srv-1", {"TOKEN": "x"}, allowed_names=["TOKEN"])
 
-    expected = int.from_bytes(hashlib.sha256(b"alice:srv-1").digest()[:8], "big", signed=True)
+    expected: Final = int.from_bytes(hashlib.sha256(b"alice:srv-1").digest()[:8], "big", signed=True)
     assert list(prisma.db._store.locks) == [expected]
 
 
 def test_mcp_identifier_lock_keys_use_sha256_of_the_lowercased_identifier():
-    keys = _mcp_identifier_lock_keys("Name", "name", None)
+    keys: Final = _mcp_identifier_lock_keys("Name", "name", None)
 
     assert keys == (int.from_bytes(hashlib.sha256(b"mcp_identifier:name").digest()[:8], "big", signed=True),)
diff --git a/tests/test_litellm/proxy/management_endpoints/test_saml_sso.py b/tests/test_litellm/proxy/management_endpoints/test_saml_sso.py
index 49599ec67c1..fac24d37fb0 100644
--- a/tests/test_litellm/proxy/management_endpoints/test_saml_sso.py
+++ b/tests/test_litellm/proxy/management_endpoints/test_saml_sso.py
@@ -10,6 +10,7 @@ makes a test fail.
 import base64
 import datetime
 import time
+from typing import Final, cast
 
 import pytest
 from fastapi import HTTPException, Request
@@ -26,8 +27,6 @@ from onelogin.saml2.settings import OneLogin_Saml2_Settings
 from onelogin.saml2.utils import OneLogin_Saml2_Utils
 from starlette.datastructures import URL
 
-from typing import cast
-
 from litellm.caching.dual_cache import DualCache
 from litellm.caching.in_memory_cache import InMemoryCache
 from litellm.caching.redis_cache import RedisCache
@@ -754,13 +753,13 @@ class TestSAMLAuthnCookieSecureFlag:
 
 @pytest.mark.asyncio
 async def test_effective_sp_settings_use_sha256_signature_and_digest(saml_env):
-    cache = DualCache()
-    idp_settings = await SAMLAuthHandler._load_idp_settings(cache)
-    settings = SAMLAuthHandler._build_settings(_fake_request(), idp_settings)
+    cache: Final = DualCache()
+    idp_settings: Final = await SAMLAuthHandler._load_idp_settings(cache)
+    settings: Final = SAMLAuthHandler._build_settings(_fake_request(), idp_settings)
 
-    security = settings["security"]
+    security: Final = settings["security"]
     assert security["signatureAlgorithm"] == "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"
     assert security["digestAlgorithm"] == "http://www.w3.org/2001/04/xmlenc#sha256"
-    effective = OneLogin_Saml2_Settings(settings, sp_validation_only=True).get_security_data()
+    effective: Final = OneLogin_Saml2_Settings(settings, sp_validation_only=True).get_security_data()
     assert effective["signatureAlgorithm"] == security["signatureAlgorithm"]
     assert effective["digestAlgorithm"] == security["digestAlgorithm"]