diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
new file mode 100644
index 0000000..1987e87
--- /dev/null
+++ b/.github/codeql/codeql-config.yml
@@ -0,0 +1,9 @@
+name: "WireGUI CodeQL config"
+
+query-filters:
+  # API token hashing uses HMAC-SHA256 which is appropriate for high-entropy
+  # tokens (256-bit random). Actual password hashing uses bcrypt.
+  # CodeQL flags any SHA-family hash as "weak for password hashing" but this
+  # rule is not applicable to API token lookups.
+  - exclude:
+      id: py/weak-sensitive-data-hashing
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 6b888d2..66e11f8 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -26,6 +26,7 @@ jobs:
         uses: github/codeql-action/init@v3
         with:
           languages: python
+          config-file: .github/codeql/codeql-config.yml
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v3
\ No newline at end of file