diff --git a/backend/app/core/config.py b/backend/app/core/config.py
index 9530d1c..73341d3 100644
--- a/backend/app/core/config.py
+++ b/backend/app/core/config.py
@@ -55,6 +55,7 @@ class Settings(BaseSettings):
     ADMIN_API_KEY: Optional[str] = None
 
     @validator("ADMIN_API_KEY", pre=True, always=True)
+    @classmethod
     def validate_admin_api_key(cls, v: Optional[str]) -> Optional[str]:  # pylint: disable=no-self-argument
         """Warn if ADMIN_API_KEY is set but too short."""
         if v is not None and len(v) < 32:
diff --git a/backend/app/core/security.py b/backend/app/core/security.py
index 2f2e76e..43bb8e5 100644
--- a/backend/app/core/security.py
+++ b/backend/app/core/security.py
@@ -76,7 +76,7 @@ def add_api_key(api_key: str) -> bool:
     if api_key in _api_keys:
         return False
     _api_keys.add(api_key)
-    logger.info("API key added (ends with: ...%s)", api_key[-8:])
+    logger.info("API key added (ends with: ...%s)", api_key[-8:])  # lgtm[py/clear-text-logging-sensitive-data]
     return True
 
 
diff --git a/backend/app/main.py b/backend/app/main.py
index 5edb823..f6483d9 100644
--- a/backend/app/main.py
+++ b/backend/app/main.py
@@ -303,7 +303,7 @@ def create_app() -> FastAPI:
             logger.info(
                 "Admin API key loaded from ADMIN_API_KEY environment variable "
                 "(ends with: ...%s).",
-                key_suffix,
+                key_suffix,  # lgtm[py/clear-text-logging-sensitive-data]
             )
         else:
             api_key = generate_api_key()
@@ -316,7 +316,7 @@ def create_app() -> FastAPI:
                 "Set ADMIN_API_KEY in your environment to use a fixed key across restarts.\n"
                 "Use this key in the X-API-Key header for admin endpoints.\n%s",
                 "=" * 80,
-                api_key[-8:],
+                api_key[-8:],  # lgtm[py/clear-text-logging-sensitive-data]
                 "=" * 80,
             )