diff --git a/controller/security_account_test.go b/controller/security_account_test.go
index 809a57921..60c5414e2 100644
--- a/controller/security_account_test.go
+++ b/controller/security_account_test.go
@@ -645,7 +645,9 @@ func TestSecurityAccountEmailConfirmationAndAudit(t *testing.T) {
 			require.NoError(t, err)
 			assert.Contains(t, string(encoded), "user.binding_bind")
 			assert.NotContains(t, string(encoded), flow.FlowToken)
-			assert.NotContains(t, string(encoded), newCode)
+			// Audit event and request IDs are long runs of time digits that can
+			// contain the six-digit code by chance; only the whole code is a leak.
+			assert.NotRegexp(t, `(^|\D)`+newCode+`(\D|$)`, string(encoded))
 		})
 	}
 }