diff --git a/convex/migrations.publishAttempts.test.ts b/convex/migrations.publishAttempts.test.ts
index bd192b18..0cc22a17 100644
--- a/convex/migrations.publishAttempts.test.ts
+++ b/convex/migrations.publishAttempts.test.ts
@@ -41,6 +41,20 @@ function suspiciousAttempt(
 describe("suspicious publish attempt recovery", () => {
   it("selects only TruffleHog-clean attempts blocked by a stored suspicious verdict", () => {
     expect(hasStoredSuspiciousClawscanVerdict(suspiciousAttempt())).toBe(true);
+    expect(
+      hasStoredSuspiciousClawscanVerdict(
+        suspiciousAttempt({
+          checks: {
+            trufflehog: { status: "clean" },
+            clawscan: {
+              status: "blocked",
+              summary: "No malicious behavior was confirmed, but review is required.",
+              redactedFindings: ["status=completed; verdict=suspicious"],
+            },
+          },
+        }),
+      ),
+    ).toBe(true);
     expect(
       hasStoredSuspiciousClawscanVerdict(
         suspiciousAttempt({
diff --git a/convex/migrations.ts b/convex/migrations.ts
index 58d80792..92f792e6 100644
--- a/convex/migrations.ts
+++ b/convex/migrations.ts
@@ -118,7 +118,10 @@ export function hasStoredSuspiciousClawscanVerdict(attempt: Doc<"publishAttempts
     .filter((value): value is string => Boolean(value))
     .join(" ")
     .toLowerCase();
-  return storedReviewText.includes("verdict=suspicious") && !storedReviewText.includes("malicious");
+  return (
+    storedReviewText.includes("verdict=suspicious") &&
+    !storedReviewText.includes("verdict=malicious")
+  );
 }
 
 async function classifySuspiciousPublishAttemptPublicState(