diff --git a/packages/cli/src/doctor.test.ts b/packages/cli/src/doctor.test.ts
index c7199e9d..f4cfb38b 100644
--- a/packages/cli/src/doctor.test.ts
+++ b/packages/cli/src/doctor.test.ts
@@ -281,7 +281,7 @@ describe('runKtxDoctor', () => {
   });
 
   it('runs project checks against a valid ktx.yaml', async () => {
-    process.env.ANTHROPIC_API_KEY = 'test-key';
+    process.env.ANTHROPIC_API_KEY = 'test-key'; // pragma: allowlist secret
     await writeFile(
       join(tempDir, 'ktx.yaml'),
       [
@@ -306,7 +306,7 @@ describe('runKtxDoctor', () => {
       ].join('\n'),
       'utf-8',
     );
-    process.env.OPENAI_API_KEY = 'test-key';
+    process.env.OPENAI_API_KEY = 'test-key'; // pragma: allowlist secret
     const testIo = makeIo();
 
     await expect(
@@ -357,7 +357,7 @@ describe('runKtxDoctor', () => {
   });
 
   it('warns about stale and unsupported per-driver connection fields', async () => {
-    process.env.ANTHROPIC_API_KEY = 'test-key';
+    process.env.ANTHROPIC_API_KEY = 'test-key'; // pragma: allowlist secret
     process.env.WAREHOUSE_DATABASE_URL = 'postgresql://reader@example.test/warehouse';
     process.env.NOTION_TOKEN = 'notion-secret';
     await writeFile(
@@ -415,7 +415,7 @@ describe('runKtxDoctor', () => {
   });
 
   it('warns when semantic-search embeddings are not configured', async () => {
-    process.env.ANTHROPIC_API_KEY = 'test-key';
+    process.env.ANTHROPIC_API_KEY = 'test-key'; // pragma: allowlist secret
     await writeFile(
       join(tempDir, 'ktx.yaml'),
       [
diff --git a/packages/cli/src/setup-sources.test.ts b/packages/cli/src/setup-sources.test.ts
index 2aa7a654..339282e1 100644
--- a/packages/cli/src/setup-sources.test.ts
+++ b/packages/cli/src/setup-sources.test.ts
@@ -1109,13 +1109,13 @@ describe('setup sources step', () => {
     });
     expect(discoverMetabaseDatabases).toHaveBeenCalledWith({
       sourceUrl: 'https://metabase-new.example.com',
-      sourceApiKeyRef: 'env:METABASE_API_KEY',
+      sourceApiKeyRef: 'env:METABASE_API_KEY', // pragma: allowlist secret
       sourceConnectionId: 'metabase-main',
     });
     expect((await readConfig()).connections['metabase-main']).toMatchObject({
       driver: 'metabase',
       api_url: 'https://metabase-new.example.com',
-      api_key_ref: 'env:METABASE_API_KEY',
+      api_key_ref: 'env:METABASE_API_KEY', // pragma: allowlist secret
       mappings: {
         databaseMappings: { '2': 'warehouse' },
         syncEnabled: { '2': true },
diff --git a/packages/cli/src/standalone-smoke.test.ts b/packages/cli/src/standalone-smoke.test.ts
index 0f53cca0..ad30d254 100644
--- a/packages/cli/src/standalone-smoke.test.ts
+++ b/packages/cli/src/standalone-smoke.test.ts
@@ -197,10 +197,10 @@ describe('standalone built ktx CLI smoke', () => {
     expect(result.stderr).toContain("unknown command 'agent'");
   });
 
-  it('runs doctor setup through the built binary', async () => {
-    const result = await runBuiltCli(['status', '--no-input']);
+  it('runs status setup checks through the built binary', async () => {
+    const result = await runBuiltCli(['status', '--verbose', '--no-input']);
 
-    expect(result.stdout).toMatch(/KTX (setup|project) doctor/);
+    expect(result.stdout).toMatch(/KTX status/);
     expect(result.stdout).toContain('Node 22+');
     expect(result.stdout).toContain('Workspace-local CLI');
     expect(result.stderr === '' || result.stderr.startsWith('Project: ')).toBe(true);
diff --git a/scripts/package-artifacts.mjs b/scripts/package-artifacts.mjs
index ee785c27..f8ae92c0 100644
--- a/scripts/package-artifacts.mjs
+++ b/scripts/package-artifacts.mjs
@@ -935,9 +935,9 @@ try {
   requireStdout('ktx setup --help', setupHelp, /Usage: ktx setup/);
   requireStdout('ktx setup --help', setupHelp, /--no-input/);
 
-  const doctor = await run('pnpm', ['exec', 'ktx', 'status', '--no-input']);
+  const doctor = await run('pnpm', ['exec', 'ktx', 'status', '--verbose', '--no-input']);
   assert.ok([0, 1].includes(doctor.code), 'ktx status setup exit code must be 0 or 1');
-  requireStdout('ktx status setup', doctor, /KTX setup doctor/);
+  requireStdout('ktx status setup', doctor, /KTX status/);
   requireStdout('ktx status setup', doctor, /Node 22\\+/);
   assert.equal(doctor.stderr, '', 'ktx status setup wrote unexpected stderr');
 } finally {