diff --git a/hermes_cli/debug_redaction.py b/hermes_cli/debug_redaction.py
index 99459d1db9..67b965fc64 100644
--- a/hermes_cli/debug_redaction.py
+++ b/hermes_cli/debug_redaction.py
@@ -54,9 +54,9 @@ _QUOTED_HEADER_RE = re.compile(
 _BARE_HEADER_RE = re.compile(
     rf"(?P<prefix>\b(?:{_HEADER_NAME_PATTERN})\b\s*[:=]\s*)"
     # agent.redact masks the scheme of ``x-api-key: Basic <key>`` to ``***`` and
-    # keeps the key, so ``***`` before a same-line value (not another secret
-    # header) is a scheme too, and the key after it is the value.
-    r"(?P<value>(?>(?:(?:Bearer|Basic|Digest)\s+|\*\*\*[ \t]+(?=[^\s,}\]])"
+    # keeps the key, so ``***`` before a same-line token-shaped value (not prose
+    # and not another secret header) is a scheme too, and the key is the value.
+    r"(?P<value>(?>(?:(?:Bearer|Basic|Digest)\s+|\*\*\*[ \t]+(?=[A-Za-z0-9._~+/-]{8,}=*(?![A-Za-z0-9._~+/=-]))"
     rf"(?!(?:{_HEADER_NAME_PATTERN})\b\s*[:=]))?)(?!\[REDACTED\])[^\s,}}\]]+)",
     re.IGNORECASE,
 )
diff --git a/tests/tui_gateway/test_diagnostics_share_nous.py b/tests/tui_gateway/test_diagnostics_share_nous.py
index d508b2a0d6..2c88d2ecc9 100644
--- a/tests/tui_gateway/test_diagnostics_share_nous.py
+++ b/tests/tui_gateway/test_diagnostics_share_nous.py
@@ -189,6 +189,9 @@ def test_redacted_support_egress_scrubs_structured_values_and_errors(
     assert "[REDACTED]]" not in failure["error"]
     assert failure["error"].endswith(" --header X-API-Key Basic [REDACTED]")
     assert real_redact(failure["error"]) == failure["error"]
+    # Prose after an already-masked value is not a key: kept, and a fixed point.
+    benign = real_redact("x-api-key: *** see docs")
+    assert benign.endswith(" see docs") and real_redact(benign) == benign
 
 
 def test_share_nous_linkless_success_is_a_failure(monkeypatch):