diff --git a/src/gateway/server-methods/plugins.test.ts b/src/gateway/server-methods/plugins.test.ts
index 2ead2dc5d037..69705ecdb0a4 100644
--- a/src/gateway/server-methods/plugins.test.ts
+++ b/src/gateway/server-methods/plugins.test.ts
@@ -5,10 +5,11 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 import type {
   InstallPolicyWarningDetails,
   InstallPolicyWarningOccurrence,
-  InstallPolicyWarningScanIdentity,
 } from "../../plugins/install-security-scan.types.js";
 import type { ManagedPluginSourceInstallRequest } from "../../plugins/management-service.js";
 
+type InstallPolicyWarningScanIdentity = InstallPolicyWarningOccurrence["scan"];
+
 const managementMocks = vi.hoisted(() => {
   class ManagedPluginLifecycleError extends Error {
     readonly kind: "invalid-request" | "unavailable";
diff --git a/src/plugins/install-security-scan.types.ts b/src/plugins/install-security-scan.types.ts
index b106db4da904..d79a9af0239b 100644
--- a/src/plugins/install-security-scan.types.ts
+++ b/src/plugins/install-security-scan.types.ts
@@ -11,7 +11,7 @@ export type InstallPolicyWarningDetails = {
 };
 
 /** Stable policy-stage facts that scope an approval without exposing scan internals to clients. */
-export type InstallPolicyWarningScanIdentity = {
+type InstallPolicyWarningScanIdentity = {
   requestKind: InstallPolicyRequestKind;
   originType: string;
   pluginContentType?: "bundle" | "package" | "file" | "dependency-tree";