diff --git a/CHANGELOG.md b/CHANGELOG.md
index e7ea7de..7081cbf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Development
+
+- **Tightened three DNS corpus assertions in `tests/test_dns.py` from substring/`endswith` checks to exact equality, closing 3 open CodeQL `py/incomplete-url-substring-sanitization` alerts (#166).** `test_names_decompress_to_real_domains` asserted `"example.com" in names` / `"accounts.youtube.com" in names` against a `set` decoded from a fixed pcap corpus, and `test_answers_parse_to_real_records` asserted `cname.rdata_text.endswith("google.com")` against the same corpus — not security-relevant trust checks, but exactly the substring/suffix pattern the rule flags regardless of what the value's actually validating. Both now compare against the known exact decoded values instead (`names == {"example.com", "accounts.youtube.com"}`, `rdata_text == "www3.l.google.com"`), which removes the pattern CodeQL keys on and is strictly more precise than the checks it replaces.
+
 ## [2.2.1] - 2026-09-07
 
 ### Fixed
diff --git a/tests/test_dns.py b/tests/test_dns.py
index 3b93bb3..8a7ed12 100644
--- a/tests/test_dns.py
+++ b/tests/test_dns.py
@@ -134,8 +134,7 @@ def test_every_corpus_frame_round_trips_byte_exact(self):
 
     def test_names_decompress_to_real_domains(self):
         names = {walk(frame)[0][-1].question_name for frame in CORPUS_DNS}
-        assert "example.com" in names
-        assert "accounts.youtube.com" in names
+        assert names == {"example.com", "accounts.youtube.com"}
 
     def test_answers_parse_to_real_records(self):
         records = [
@@ -148,9 +147,9 @@ def test_answers_parse_to_real_records(self):
         # An A record's RDATA decodes to the dotted IPv4 in rdata_text.
         a = next(r for r in records if r.rtype_name == "A")
         assert a.rdata == socket.inet_aton(a.rdata_text)
-        # A CNAME's RDATA decompresses to a real target domain.
+        # A CNAME's RDATA decompresses to the real target domain.
         cname = next(r for r in records if r.rtype_name == "CNAME")
-        assert cname.rdata_text.endswith("google.com")
+        assert cname.rdata_text == "www3.l.google.com"
 
     def test_authority_soa_and_additional_opt(self):
         stacks = [walk(frame)[0][-1] for frame in CORPUS_DNS]