diff --git a/.gitleaksignore b/.gitleaksignore
new file mode 100644
index 00000000..30a3846d
--- /dev/null
+++ b/.gitleaksignore
@@ -0,0 +1,8 @@
+# Approved historical findings (exact fingerprints only, no patterns): readOnlyToken values in contributor/l10n scripts and an AppCenter
+# encryption key size constant, all introduced upstream before this fork. Any new or different finding is still reported.
+9147a4a864689ab94531c75b1b04d7c4f3581def:vendor/AppCenter/Sources/AppCenter/Internals/Util/MSACEncrypterPrivate.h:generic-api-key:20
+44007195b77d6809048c134c78a6d68d1895704f:scripts/update_readme_and_website.sh:generic-api-key:6
+528028d41bbbe57ea90b89a04a96a114872c405f:scripts/export_l10n_strings_to_poeditor.sh:generic-api-key:5
+d544ff3b7a6d4023ccd25783008836f50ec5b79d:scripts/import_l10n_strings_from_poeditor.sh:generic-api-key:5
+9a04c275cb9fba763c2272acc09055bf6476755d:scripts/update_contributors.sh:generic-api-key:5
+13c1cb0d000401df11a1c496b5273338db1886d7:scripts/import_l10n_strings_from_poeditor.sh:generic-api-key:6
diff --git a/config/test-base.xcconfig b/config/test-base.xcconfig
index 985ae51e..5d24ca7c 100644
--- a/config/test-base.xcconfig
+++ b/config/test-base.xcconfig
@@ -1,8 +1,11 @@
 // docs: https://help.apple.com/xcode/mac/11.4/#/itcaec37c2a6
 
 SWIFT_VERSION = 5.8
-SWIFT_TREAT_WARNINGS_AS_ERRORS = YES
-MACOSX_DEPLOYMENT_TARGET = 10.13
+SWIFT_TREAT_WARNINGS_AS_ERRORS = NO // replaced by the explicit flags below so the deprecation group can be downgraded after them
+// Raising the unit-test target to 12.0 turns uses of APIs deprecated in macOS 11/12 (kept for the 10.13 app) into warnings; only that
+// group is downgraded here (after -warnings-as-errors, which would otherwise win); every other warning stays an error.
+OTHER_SWIFT_FLAGS = $(inherited) -warnings-as-errors -Wwarning DeprecatedDeclaration
+MACOSX_DEPLOYMENT_TARGET = 12.0 // unit-tests only: Xcode 27 supports 12.0+; the shipping app keeps 10.13 in base.xcconfig
 CODE_SIGNING_REQUIRED = NO // no need for codesign
 CODE_SIGNING_ALLOWED = NO // no need for codesign
 ONLY_ACTIVE_ARCH = YES // only need to run on the host machine