diff --git a/scripts/lib/transport-authentication.mjs b/scripts/lib/transport-authentication.mjs
index 7e50e33592..af911b987b 100644
--- a/scripts/lib/transport-authentication.mjs
+++ b/scripts/lib/transport-authentication.mjs
@@ -1,6 +1,6 @@
 /** Redact only HTTP URL authentication; keep paths, names, queries and other text. */
 export function redactTransportAuthentication(text) {
-  return text.replace(/https?:\/\/[^\s"<>\\]+/gu, (value) => {
+  return text.replace(/https?:\/\/[^\s"<>\\]+/giu, (value) => {
     try {
       const parsed = new URL(value);
       if (!parsed.username && !parsed.password) return value;
diff --git a/tests/boundary/filesystem/dependencySecurity.test.ts b/tests/boundary/filesystem/dependencySecurity.test.ts
index 8670f8fed6..9dfe9fbbe6 100644
--- a/tests/boundary/filesystem/dependencySecurity.test.ts
+++ b/tests/boundary/filesystem/dependencySecurity.test.ts
@@ -115,6 +115,13 @@ it("accepts only supported registry identities and redacts only transport authen
   expect(redactTransportAuthentication(text)).toBe(
     "name=secret token=caller-value /tmp/secret https://EXAMPLE.com/a?q=token#keep",
   );
+  for (const scheme of ["HTTPS", "hTtPs", "HTTP"]) {
+    expect(
+      redactTransportAuthentication(
+        `${scheme}://user:fixture-secret@EXAMPLE.com/a?q=token#keep`,
+      ),
+    ).toBe(`${scheme}://EXAMPLE.com/a?q=token#keep`);
+  }
   expect(() =>
     lockedPackages({
       lockfileVersion: 3,