diff --git a/ingestor/io/data_sink.py b/ingestor/io/data_sink.py
index 290f0e4..c5806bc 100644
--- a/ingestor/io/data_sink.py
+++ b/ingestor/io/data_sink.py
@@ -54,7 +54,7 @@ class DataSink:
         # schema/table are allowlist-validated identifiers above; status/timestamp/model_id
         # are bound params below, never interpolated — not a real injection vector.
         stmt = text(
-            f'UPDATE {schema}.{table} SET write_status = :status '  # noqa: S608
+            f'UPDATE {schema}.{table} SET write_status = :status '  # noqa: S608 # nosec B608
             'WHERE timestamp = :timestamp AND model_id = :model_id'
         )
         params = {