diff --git a/claude-code/hooks/test_identity.py b/claude-code/hooks/test_identity.py
index b900cb65..a6e58bf2 100644
--- a/claude-code/hooks/test_identity.py
+++ b/claude-code/hooks/test_identity.py
@@ -233,8 +233,13 @@ def test_returns_full_identity(self):
     def test_keys_limited_to_identity_fields(self):
         self._write_config({})
         result = unbound.build_account_identity()
-        self.assertEqual(
-            set(result.keys()), {"org_id", "plan", "auth_mode", "email_domain"}
+        # Identity may also carry the full user_email and (env-dependent) the
+        # device_serial. Assert no key OUTSIDE the known identity fields leaks,
+        # rather than an exact set tied to optional fields.
+        self.assertLessEqual(
+            set(result.keys()),
+            {"org_id", "plan", "auth_mode", "email_domain",
+             "user_email", "device_serial"},
         )