diff --git a/tests/prompt-injection-scan.test.cjs b/tests/prompt-injection-scan.test.cjs
index 17a34d683..5c8bc32dc 100644
--- a/tests/prompt-injection-scan.test.cjs
+++ b/tests/prompt-injection-scan.test.cjs
@@ -52,6 +52,7 @@ const SCAN_EXTS = new Set(['.md', '.cjs', '.js', '.json']);
 const ALLOWLIST = new Set([
   'get-shit-done/bin/lib/security.cjs',        // The security module itself
   'get-shit-done/workflows/discuss-phase.md',  // Large workflow (~50K) with power mode + i18n
+  'get-shit-done/workflows/execute-phase.md',  // Large orchestration workflow (~51K) with wave execution + code-review gate
   'hooks/gsd-prompt-guard.js',                  // The prompt guard hook
   'tests/security.test.cjs',                    // Security tests
   'tests/prompt-injection-scan.test.cjs',       // This file