diff --git a/CHANGELOG.md b/CHANGELOG.md
index d47be821b..71bcf2202 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -28,6 +28,7 @@ See [Legacy Airlock & migration](docs/azure-tre-overview/airlock.md#legacy-airlo
 * Add weekly and manual builds for Dockerfiles and Porter bundles, with selected pull request builds. Retry a failed target once and report final results. ([#5088](https://github.com/microsoft/AzureTRE/issues/5088))
 
 BUG FIXES:
+* Rename a test variable in the E2E polling tests so that CodeQL stops reporting false clear-text logging alerts. ([#5266](https://github.com/microsoft/AzureTRE/pull/5266))
 * Protect active validation environments and require successful smoke tests before custom tests. Validate shared-service command arguments and forward explicit Nexus EULA consent. (`devops` 0.6.20, `build-scripts` 1.1.4) ([#5255](https://github.com/microsoft/AzureTRE/pull/5255))
 * Give E2E cleanup separate deadlines and allow 30 seconds for smoke health requests. ([#5255](https://github.com/microsoft/AzureTRE/pull/5255))
 * Verify TLS for identity authentication and keep response content and URL parameters out of E2E operation polling logs. ([#5255](https://github.com/microsoft/AzureTRE/pull/5255))
diff --git a/e2e_tests/unit_tests/test_polling_diagnostics.py b/e2e_tests/unit_tests/test_polling_diagnostics.py
index caa6a23b6..75c53904f 100644
--- a/e2e_tests/unit_tests/test_polling_diagnostics.py
+++ b/e2e_tests/unit_tests/test_polling_diagnostics.py
@@ -184,12 +184,12 @@ async def test_cancellation_before_first_response_preserves_unknown_state(self):
         self.assertNotIn("token-secret", logs.output[0])
 
     async def test_unknown_paths_and_states_are_redacted_and_bounded(self):
-        secret = "response-secret" * 1000
-        check = AsyncMock(return_value=(False, secret, secret, secret))
+        untrusted_value = "response-secret" * 1000
+        check = AsyncMock(return_value=(False, untrusted_value, untrusted_value, untrusted_value))
         with patch.object(resource.asyncio, "sleep", new=AsyncMock(side_effect=asyncio.CancelledError)):
             with self.assertLogs(resource.LOGGER, level="INFO") as logs:
                 with self.assertRaises(asyncio.CancelledError):
-                    await resource.wait_for(check, None, "/api/operations/" + secret, "token-secret", [])
+                    await resource.wait_for(check, None, "/api/operations/" + untrusted_value, "token-secret", [])
         log = "\n".join(logs.output)
         self.assertIn("<redacted>", log)
         self.assertNotIn("response-secret", log)