diff --git a/SECURITY.md b/SECURITY.md
index 74faec7..2b5a1d0 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -42,7 +42,7 @@ These measures are defense-in-depth. They are intended to reduce the chance of a
 
 The following are generally out of scope and should not be reported as Enroll vulnerabilities unless they also bypass one of Enroll’s explicit hardening mechanisms:
 
-* A malicious local user who can already control the root user’s command line, shell environment, config file, `PATH`, SSH config, working directory, or invoked binaries.
+* A malicious local user who can already control the root user’s command line, shell environment, config file, `PATH`, `XDG_CONFIG_HOME`, SSH config, working directory, or invoked binaries.
 * A root user loading an `enroll.ini` file whose contents intentionally request dangerous behavior.
 * A root user passing `--dangerous` and then observing that Enroll may collect sensitive information.
 * A root user passing `--assume-safe-path` and then observing that Enroll does not prompt about `PATH` safety.
diff --git a/tests.sh b/tests.sh
index 7e9a263..a9d8947 100755
--- a/tests.sh
+++ b/tests.sh
@@ -422,11 +422,6 @@ run_ansible_jinjaturtle_variant() {
 }
 
 run_jinjaturtle_manifest_tests() {
-  if is_rpm_family ; then
-    section "JinjaTurtle integration matrix"
-    printf 'Skipping JinjaTurtle package integration on RPM-family CI;\n'
-    return
-  fi
   ensure_jinjaturtle
   require_cmd jinjaturtle "Install JinjaTurtle before running the JinjaTurtle integration matrix."