diff --git a/tests/test_organization_commercial_readiness_loop_receipt_contract.py b/tests/test_organization_commercial_readiness_loop_receipt_contract.py
index 6ae9dfa595..27b3a2548d 100644
--- a/tests/test_organization_commercial_readiness_loop_receipt_contract.py
+++ b/tests/test_organization_commercial_readiness_loop_receipt_contract.py
@@ -14,6 +14,16 @@
     / "organization-commercial-readiness-loop.yml"
 )
 
+# Harden-runner egress entries the artifact upload needs. Asserted as whole
+# allowlist lines, not as substrings of the workflow text: an entry must stand
+# on its own line, so a longer host that merely ends with one of these cannot
+# satisfy the contract.
+ARTIFACT_UPLOAD_EGRESS_ENDPOINTS = (
+    "results-receiver.actions.githubusercontent.com:443",
+    "*.actions.githubusercontent.com:443",
+    "*.blob.core.windows.net:443",
+)
+
 
 def _harden_runner_allowed_endpoints(source: str) -> set[str]:
     """Return the harden-runner allowlist entries without substring URL heuristics."""
@@ -56,8 +66,8 @@ def test_json_receipt_is_retained_as_an_immutable_short_lived_artifact() -> None
     assert "path: ${{ runner.temp }}/organization-commercial-readiness-loop.json" in source
     assert "if-no-files-found: error" in source
     assert "retention-days: 3" in source
+
     endpoints = _harden_runner_allowed_endpoints(source)
-    assert "results-receiver.actions.githubusercontent.com:443" in endpoints
-    assert "*.actions.githubusercontent.com:443" in endpoints
-    assert "*.blob.core.windows.net:443" in endpoints
+    for endpoint in ARTIFACT_UPLOAD_EGRESS_ENDPOINTS:
+        assert endpoint in endpoints
     assert "- name: Checkout exact trusted coordinator source" not in endpoints