diff --git a/custom_components/nvidia_shield/diagnostics.py b/custom_components/nvidia_shield/diagnostics.py
index fd6de07..1a3f7ff 100644
--- a/custom_components/nvidia_shield/diagnostics.py
+++ b/custom_components/nvidia_shield/diagnostics.py
@@ -22,14 +22,18 @@ from .connection import ShieldConnectionManager
 _REDACT_KEY_MARKERS = ("pairing", "pin", "secret", "password", "token", "key_material")
 _REDACTED = "**REDACTED**"
 
-# G14: the documented explicit redaction field list (host paths stay
-# readable; pairing/key-shaped fields are masked by async_redact_data).
+# G14: the documented explicit redaction field list — the audit calls out
+# config fields like the hosts; pairing/key-shaped fields are masked by
+# async_redact_data and the marker scan adds a second layer.
 _TO_REDACT = {
     "pairing_code",
     "adb_pairing_code",
     "protocol_pairing_code",
     "serial_number",
     "uuid",
+    "adb_host",
+    "protocol_host",
+    "host",
 }