diff --git a/scripts/security-strings.sh b/scripts/security-strings.sh
index c7ff54843..9d6587e5b 100755
--- a/scripts/security-strings.sh
+++ b/scripts/security-strings.sh
@@ -246,6 +246,7 @@ DANGEROUS_CMDS='wget|netcat|ncat|/dev/tcp|telnet'
 # evaluation. Document the source so reviewers can verify the false positive.
 ALLOWED_DANGEROUS=(
     '^telnet$'  # rst tree-sitter grammar: valid_schemas[] in vendored/grammars/rst/tree_sitter_rst/chars.c
+    '^wget$'    # src/pipeline/pass_shell.c: the program name a script's curl / wget HTTP_CALLS compares and records as `via`
 )
 if grep -wE "$DANGEROUS_CMDS" "$STRINGS_FILE" > "$SEC_CMDS" 2>/dev/null && [ -s "$SEC_CMDS" ]; then
     for allow in "${ALLOWED_DANGEROUS[@]}"; do
diff --git a/tests/test_security_strings_allowlist.sh b/tests/test_security_strings_allowlist.sh
index 921a10e63..0a6bdf90f 100755
--- a/tests/test_security_strings_allowlist.sh
+++ b/tests/test_security_strings_allowlist.sh
@@ -170,6 +170,12 @@ done
 # content, not all tokenizer arrays or all boolean password assignments.
 make_fixture "$TMP/lookalike.bin" 'const keywords=["wget","telnet"];'
 assert_audit 1 "$COMMAND_BLOCKED" 'unreviewed command keyword array is blocked' "$TMP/lookalike.bin"
+# pass_shell.c compares a script's program name with the bare string "wget" (its
+# curl / wget HTTP_CALLS). Only that whole line is exempt; a command is not.
+make_fixture "$TMP/token.bin" 'wget'
+assert_audit 0 "$AUDIT_PASSED" 'bare wget token (pass_shell.c program name) is allowed' "$TMP/token.bin"
+make_fixture "$TMP/token.bin" 'wget -O /tmp/payload'
+assert_audit 1 "$COMMAND_BLOCKED" 'a wget command line remains blocked' "$TMP/token.bin"
 make_fixture "$TMP/lookalike.bin" 'this.password=!1;'
 assert_audit 1 "$CREDENTIAL_BLOCKED" 'unreviewed boolean password assignment is blocked' "$TMP/lookalike.bin"