diff --git a/tests/ZB.MOM.WW.ScadaBridge.CentralUI.PlaywrightTests/Notifications/SmsNotificationE2ETests.cs b/tests/ZB.MOM.WW.ScadaBridge.CentralUI.PlaywrightTests/Notifications/SmsNotificationE2ETests.cs
index 61b53bad..1db08449 100644
--- a/tests/ZB.MOM.WW.ScadaBridge.CentralUI.PlaywrightTests/Notifications/SmsNotificationE2ETests.cs
+++ b/tests/ZB.MOM.WW.ScadaBridge.CentralUI.PlaywrightTests/Notifications/SmsNotificationE2ETests.cs
@@ -24,7 +24,7 @@ namespace ZB.MOM.WW.ScadaBridge.CentralUI.PlaywrightTests.Notifications;
 /// </list>
 ///
 /// <para>
-/// Idempotency: the SMS-config fact uses a STABLE Account SID (<c>ACtest123</c>) and probes
+/// Idempotency: the SMS-config fact uses a STABLE Account SID (<c>AC000…0001</c>) and probes
 /// <c>notification sms list</c> first — if a prior run already created it, the fact SKIPS the
 /// create and verifies the existing row instead (the page exposes no delete verb — neither UI
 /// nor CLI — so we never create a second copy we could not clean up; the render-crash +
@@ -41,7 +41,9 @@ public class SmsNotificationE2ETests
     // Stable test fixture values. The Account SID is stable (not random) so reruns find the
     // prior config via 'notification sms list' and skip re-creation — the SMS config page has
     // no delete verb, so a unique-per-run SID would leak a config on every run.
-    private const string TestAccountSid = "ACtest123";
+    // Must match the ManagementActor create guard ^AC[0-9a-fA-F]{32}$ (added 2026-07-10) or
+    // the create is rejected and the config-card / secret-non-leak assertions never run.
+    private const string TestAccountSid = "AC00000000000000000000000000000001";
     private const string TestFromNumber = "+15551230000";
     // The Auth Token VALUE that must NEVER be echoed back to the page (presence flag only).
     private const string TestAuthTokenValue = "e2e-secret-token-xyz";