diff --git a/ingestor/io/data_sink.py b/ingestor/io/data_sink.py
index c5806bc..633e1df 100644
--- a/ingestor/io/data_sink.py
+++ b/ingestor/io/data_sink.py
@@ -6,7 +6,7 @@ import ingestor.metrics as metrics
 
 # fullmatch (no ^/$ anchors) so a trailing newline can't slip through — `$` would
 # match before a trailing '\n', which is not what we want for a SQL identifier.
-_IDENTIFIER_RE = re.compile(r'[A-Za-z0-9_]+')
+_IDENTIFIER_RE = re.compile(r'\w+', re.ASCII)
 
 
 class DataSink:
@@ -42,7 +42,7 @@ class DataSink:
                 },
             )
 
-    async def update_write_status(self, cmd: dict, result) -> None:
+    async def update_write_status(self, cmd: dict, result) -> None:  # NOSONAR
         """UPDATE the per-model prediction row's write_status (C3), by timestamp+model_id.
 
         schema/table_name are per-model SQL identifiers, not values — they can't be
diff --git a/sonar-project.properties b/sonar-project.properties
index fc43878..5c832c5 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -8,3 +8,7 @@ sonar.python.coverage.reportPaths=coverage.xml
 sonar.python.xunit.reportPath=pytest.xml
 sonar.python.version=3.11
 sonar.coverage.exclusions=ingestor/app.py
+# Generated protoc/grpcio-tools output - not hand-maintained; renaming its
+# ReadTag/etc. methods to satisfy naming-convention rules would break gRPC
+# wire compatibility (grpcio-tools dictates these names, not style choice).
+sonar.exclusions=ingestor/proto/**
diff --git a/tests/unit/adapters/test_grpc_server.py b/tests/unit/adapters/test_grpc_server.py
index 2e542a2..a5115f6 100644
--- a/tests/unit/adapters/test_grpc_server.py
+++ b/tests/unit/adapters/test_grpc_server.py
@@ -60,8 +60,9 @@ async def test_read_tag_aborts_with_internal_on_engine_failure():
     context = AsyncMock()
     context.abort.side_effect = grpc.RpcError('aborted')
 
+    request = make_request()
     with pytest.raises(grpc.RpcError):
-        await servicer.ReadTag(make_request(), context)
+        await servicer.ReadTag(request, context)
 
     context.abort.assert_awaited_once()
     args = context.abort.call_args.args