diff --git a/litellm/proxy/auth/password_policy.py b/litellm/proxy/auth/password_policy.py
index c27f276252a..7f06a0993d3 100644
--- a/litellm/proxy/auth/password_policy.py
+++ b/litellm/proxy/auth/password_policy.py
@@ -110,7 +110,7 @@ def validate_password_policy(password: str, general_settings: Mapping[str, objec
 def _hibp_client() -> AsyncHTTPHandler:
     return get_async_httpx_client(
         llm_provider=httpxSpecialProvider.PasswordBreachCheck,
-        params={"timeout": HIBP_TIMEOUT_SECONDS},
+        params={"timeout": HIBP_TIMEOUT_SECONDS},  # mutable-ok: callee takes a bare dict (PEP 589)
     )
 
 
@@ -125,14 +125,18 @@ def _is_suffix_in_range_response(response_body: str, hash_suffix: str) -> bool:
 async def _is_password_breached(password: str, client: AsyncHTTPHandler) -> bool:
     # usedforsecurity=False: SHA-1 is only a lookup key into the HIBP dataset, so no security property rests on it
     sha1_hex: Final = hashlib.sha1(password.encode("utf-8"), usedforsecurity=False).hexdigest().upper()
+    headers: Final = {  # mutable-ok: callee takes a bare dict (PEP 589)
+        "Add-Padding": "true",
+        "User-Agent": f"litellm-proxy/{version}",
+    }
     try:
         response: Final = await client.get(
             f"{HIBP_RANGE_API_BASE}/{sha1_hex[:5]}",
-            headers={"Add-Padding": "true", "User-Agent": f"litellm-proxy/{version}"},
+            headers=headers,
         )
         response.raise_for_status()
         breached: Final = _is_suffix_in_range_response(response.text, sha1_hex[5:])
-    except Exception as e:
+    except Exception as e:  # noqa: BLE001  # fail-open: any HIBP failure skips the check, never breaks the caller
         verbose_proxy_logger.warning("Breached-password check skipped, HIBP lookup failed: %s", e)
         return False
     return breached