diff --git a/test/gh-aw-research-online.test.ts b/test/gh-aw-research-online.test.ts
index 4dff755a3..e014edcec 100644
--- a/test/gh-aw-research-online.test.ts
+++ b/test/gh-aw-research-online.test.ts
@@ -117,6 +117,21 @@ describe('gh-aw: /squad research online-documentation capability', () => {
     expect(researchSkill).toContain('masquerade as one that consulted a source');
   });
 
+  it('preserves full public documentation URLs without weakening general URL sanitization', () => {
+    const safeOutputsMatch = frontmatter.match(
+      /^safe-outputs:\n((?:[ \t].*\n?)*)/m
+    );
+    expect(safeOutputsMatch, 'safe-outputs: block should exist in frontmatter').not.toBeNull();
+    expect(safeOutputsMatch![1]).toMatch(
+      /allowed-domains:\n\s+- learn\.microsoft\.com\n\s+- aspire\.dev/
+    );
+    expect(researchSkill).toMatch(/Preserve\s+each public documentation URL in full/);
+    expect(researchSkill).toContain('do not replace the path with `/redacted`');
+    expect(researchSkill).toMatch(
+      /Never include URL userinfo, credentials, access tokens,[\s\S]*secret-bearing query parameters/
+    );
+  });
+
   it('lists Online sources as a required labeled section of the artifact', () => {
     // The structural contract MUST-contain list includes Online sources. Bound
     // the match to the enumeration SENTENCE (up to its terminating period) so it
diff --git a/workflows/squad.md b/workflows/squad.md
index 44427433e..8bd4ec277 100644
--- a/workflows/squad.md
+++ b/workflows/squad.md
@@ -169,6 +169,9 @@ pre-agent-steps:
       SQUAD_CAST_VALIDATOR_RUNNER
       chmod 500 "$validator_runner"
 safe-outputs:
+  allowed-domains:
+    - learn.microsoft.com
+    - aspire.dev
   messages:
     append-only-comments: true
     run-success: "🤖 [{workflow_name}]({run_url}) finished processing. This completion message does not indicate Cast success. For Cast, only a linked Cast pull request indicates success."
@@ -1464,7 +1467,10 @@ section MUST state exactly one status so a later reader or test can assert on it
 instead of trusting silence:
 
 - `Online sources: consulted` — followed by the list of URLs actually fetched
-  this run (each URL also appears as a citation in the evidence table); or
+  this run (each URL also appears as a citation in the evidence table). Preserve
+  each public documentation URL in full, including its path; do not replace the
+  path with `/redacted`. Never include URL userinfo, credentials, access tokens,
+  or secret-bearing query parameters; omit those sensitive parts instead; or
 - `Online sources: unavailable — <reason>` — when no external documentation was
   fetched, e.g. the network policy disallowed it, no external source was needed,
   or a requested source-of-truth site was unreachable.