diff --git a/platform/audit_query.go b/platform/audit_query.go
index 0d91cb450b..aaef68d416 100644
--- a/platform/audit_query.go
+++ b/platform/audit_query.go
@@ -67,6 +67,9 @@ func (f AuditQueryFilter) normalize() (AuditQueryFilter, error) {
 	if f.TenantID == "" {
 		return AuditQueryFilter{}, ErrTenantIDRequired
 	}
+	if err := validateAuditRedactedText("tenant_id", f.TenantID); err != nil {
+		return AuditQueryFilter{}, err
+	}
 	if err := validateAuditRedactedFields(
 		safeTextField{"app_id", f.AppID},
 		safeTextField{"audit_id", f.AuditID},
diff --git a/platform/audit_query_test.go b/platform/audit_query_test.go
index d0e85b5bd3..6073b454b5 100644
--- a/platform/audit_query_test.go
+++ b/platform/audit_query_test.go
@@ -106,6 +106,13 @@ func TestQueryAuditRequiresTenant(t *testing.T) {
 	}
 }
 
+func TestQueryAuditRejectsUnsafeTenantFilter(t *testing.T) {
+	_, err := QueryAudit(nil, AuditQueryFilter{TenantID: "tenant Authorization: Bearer raw-token"})
+	if err == nil || !strings.Contains(err.Error(), "tenant_id") {
+		t.Fatalf("expected unsafe tenant filter rejection, got %v", err)
+	}
+}
+
 func TestQueryAuditRejectsUnsafeFilterValues(t *testing.T) {
 	_, err := QueryAudit(nil, AuditQueryFilter{
 		TenantID: "tenant",