diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 41f6f742..95c11d93 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -117,7 +117,7 @@ jobs:
                       }
 
                       $jobsResponse = gh api "repos/$env:GITHUB_REPOSITORY_NAME/actions/runs/$runId/jobs?per_page=100" | ConvertFrom-Json -Depth 20
-                      $job = $jobsResponse.jobs | Where-Object { $job.id -eq [Int64]$jobId -and $job.name -eq $requiredCheck.jobName }
+                      $job = $jobsResponse.jobs | Where-Object { $_.id -eq [Int64]$jobId -and $_.name -eq $requiredCheck.jobName }
                       if ($null -eq $job) {
                           continue
                       }
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index cd4afb1c..ed6e7b4d 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -80,6 +80,7 @@ jobs:
             /d:sonar.cs.opencover.reportsPaths="artifacts/coverage/**/coverage.opencover.xml" \
             /d:sonar.javascript.lcov.reportPaths="**/coverage/lcov.info" \
             /d:sonar.coverage.exclusions="src/SyncFactors.Api/Program.cs,src/SyncFactors.Worker/Program.cs,src/SyncFactors.Contracts/**,src/SyncFactors.Domain/Abstractions.cs,src/SyncFactors.Api/esbuild.config.mjs,src/SyncFactors.Api/vitest.config.mjs,src/SyncFactors.Api/frontend/*.entry.js,src/SyncFactors.Api/frontend/*.test.js,src/SyncFactors.Api/wwwroot/js/**,src/SyncFactors.MockSuccessFactors/wwwroot/js/**,src/SyncFactors.Automation/**,src/SyncFactors.Infrastructure/ActiveDirectory*.cs,src/SyncFactors.Infrastructure/PowerShellWorkerPreviewService.cs,src/SyncFactors.Infrastructure/SmtpEmailSender.cs,scripts/**,azure-pipelines.deploy.yml" \
+            /d:sonar.exclusions="src/SyncFactors.Api/wwwroot/dist/**" \
             /d:sonar.cpd.exclusions="scripts/**,azure-pipelines.deploy.yml" \
             /d:sonar.qualitygate.wait=true \
             /d:sonar.qualitygate.timeout=300
diff --git a/scripts/Assert-CiWorkflowSecurity.ps1 b/scripts/Assert-CiWorkflowSecurity.ps1
index 3a76ff8c..dfccadeb 100644
--- a/scripts/Assert-CiWorkflowSecurity.ps1
+++ b/scripts/Assert-CiWorkflowSecurity.ps1
@@ -119,7 +119,7 @@ if (Test-Path -Path $githubWorkflowRoot -PathType Container) {
 
             $hasWorkflowLookup = $content -match 'actions/workflows/\$workflowFile'
             $hasWorkflowBinding = $content -match '\$run\.workflow_id\s+-ne\s+\$workflowIds\[\$requiredCheck\.workflowFile\]'
-            $hasJobBinding = $content -match '\$job\.id\s+-eq\s+\[Int64\]\$jobId\s+-and\s+\$job\.name\s+-eq\s+\$requiredCheck\.jobName'
+            $hasJobBinding = $content -match '\$_\.id\s+-eq\s+\[Int64\]\$jobId\s+-and\s+\$_\.name\s+-eq\s+\$requiredCheck\.jobName'
             $keepsUntrustedChecksPending = $content -match '(?s)if\s*\(\$null\s+-eq\s+\$trustedCheck\)\s*\{.*?\$incompleteChecks\s*\+=\s*"\$\(\$requiredCheck\.checkName\)=untrusted-provenance"'
             if (-not ($hasWorkflowLookup -and $hasWorkflowBinding -and $hasJobBinding -and $keepsUntrustedChecksPending)) {
                 Add-PolicyError $workflowFile.FullName 'required CI check acceptance must bind same-name checks to their expected workflow and job provenance.'