diff --git a/scripts/redis_acl_safety.py b/scripts/redis_acl_safety.py
old mode 100644
new mode 100755
index 38907ff..fbee1f0
--- a/scripts/redis_acl_safety.py
+++ b/scripts/redis_acl_safety.py
@@ -68,9 +68,9 @@
 from __future__ import annotations
 
 import secrets
+from collections.abc import Sequence
 from dataclasses import dataclass
-from typing import Sequence
-from urllib.parse import urlsplit
+from typing import Self
 
 import redis
 
@@ -238,7 +238,7 @@ def classify_environment(
         if probe is not None:
             try:
                 probe.close()
-            except Exception:  # noqa: BLE001 -- best-effort cleanup only
+            except Exception:  # noqa: S110, BLE001 -- best-effort cleanup only, deliberately silent
                 pass
     if got != attestation.nonce_value:
         raise EnvironmentClassificationError(
@@ -460,7 +460,7 @@ class AuthenticatedSession:
     for exactly what is and is not enforced.
     """
 
-    def __init__(self, *, environment: RedisEnvironment, gate: CommandGate, client: "redis.Redis"):
+    def __init__(self, *, environment: RedisEnvironment, gate: CommandGate, client: redis.Redis):
         self.environment = environment
         self._gate = gate
         self._client = client
@@ -478,10 +478,10 @@ def close(self) -> None:
         self._closed = True
         try:
             self._client.close()
-        except Exception:  # noqa: BLE001 -- best-effort cleanup only
+        except Exception:  # noqa: S110, BLE001 -- best-effort cleanup only, deliberately silent
             pass
 
-    def __enter__(self) -> "AuthenticatedSession":
+    def __enter__(self) -> Self:
         return self
 
     def __exit__(self, exc_type, exc, tb) -> None:
@@ -558,7 +558,7 @@ def authenticate(
         if client is not None:
             client.close()
         raise
-    except Exception as exc:  # noqa: BLE001 -- convert anything unexpected to a safety error, never leak it raw
+    except Exception as exc:  # convert anything unexpected to a safety error, never leak it raw
         if client is not None:
             client.close()
         raise AuthenticationFailedError(
diff --git a/tests/test_redis_acl_safety.py b/tests/test_redis_acl_safety.py
index 9104fd6..97f8cea 100644
--- a/tests/test_redis_acl_safety.py
+++ b/tests/test_redis_acl_safety.py
@@ -32,7 +32,6 @@
 import redis
 
 from scripts.redis_acl_safety import (
-    DANGEROUS_COMMANDS,
     PRODUCTION_ALLOWED_COMMANDS,
     PRODUCTION_PORT,
     AuthenticatedSession,
@@ -231,7 +230,7 @@ def test_authenticate_production_rejects_non_production_port(self):
 
 
 def _run(cmd, **kw):
-    return subprocess.run(cmd, capture_output=True, text=True, timeout=30, **kw)
+    return subprocess.run(cmd, capture_output=True, text=True, timeout=30, check=False, **kw)
 
 
 @pytest.fixture(scope="session")