diff --git a/extension/src/rules/__tests__/encoded-payload-redact.test.ts b/extension/src/rules/__tests__/encoded-payload-redact.test.ts
index 766d05a..77ae610 100644
--- a/extension/src/rules/__tests__/encoded-payload-redact.test.ts
+++ b/extension/src/rules/__tests__/encoded-payload-redact.test.ts
@@ -541,6 +541,22 @@ describe("encoded-payload-redact text-cipher false-positive guards", () => {
     expect(document.querySelector(`.${PLACEHOLDER_CLASS}`)).toBeNull();
   });
 
+  it("leaves English prose carrying a leet-shaped version number alone", () => {
+    // Real changelog copy: a version string like "11.16.0" supplies four
+    // leet-shape digits (1,1,1,0), clearing the substitution-count floor.
+    // The text is already English, so `deleet` leaves it readable and it
+    // would clear the common-word floor on its own — the already-English
+    // gate is what keeps it visible. (github.blog npm v12 changelog FP.)
+    const prose =
+      "Upgrade to npm 11.16.0 or later, run your normal install, and " +
+      "review the warnings.";
+    document.body.innerHTML = `<p>${prose}</p>`;
+    encodedPayloadRedactRule.apply(document.body);
+
+    expect(document.querySelector(`.${PLACEHOLDER_CLASS}`)).toBeNull();
+    expect(document.body.textContent).toContain(prose);
+  });
+
   it("leaves a sparse dot/dash ASCII-art run alone (Morse valid-ratio floor)", () => {
     // Repeating `--- . --- . ---` style separators — many tokens but
     // most decode to letters with no decoded common-word hits, and the
diff --git a/extension/src/rules/encoded-payload-redact.ts b/extension/src/rules/encoded-payload-redact.ts
index 9bb09bd..afed4d5 100644
--- a/extension/src/rules/encoded-payload-redact.ts
+++ b/extension/src/rules/encoded-payload-redact.ts
@@ -321,9 +321,10 @@ function reverseText(text: string): string {
 
 // Leetspeak substitution table — only the substitutions that obscure a
 // letter behind a digit or symbol. Pure digits (`2nd`, `iPhone 13`) get
-// mapped too, which on its own would be a false positive; the
-// surrounding gate requires a minimum substitution count AND a decoded
-// common-word floor, so prose with incidental digits doesn't qualify.
+// mapped too, which on its own would be a false positive; the surrounding
+// gate requires a minimum substitution count, an already-English skip (so
+// prose carrying incidental version-number digits like `11.16.0` is left
+// alone), and a decoded common-word floor.
 const LEET_MAP: Record<string, string> = {
   "0": "o",
   "1": "i",
@@ -747,6 +748,16 @@ function collectLeet(text: string, matches: InlineMatch[]): void {
     ) {
       continue;
     }
+    // Same already-English gate the substitution ciphers use: deleet leaves
+    // genuine letters untouched, so ordinary prose carrying incidental
+    // leet-shaped digits (version strings like `11.16.0`, dates) survives
+    // `deleet` essentially unchanged and would clear the common-word floor
+    // on its own. A real leet payload obscures its letters behind digits, so
+    // its *raw* form is not yet English. Skip candidates that already read as
+    // English — only an actual encode reveals a hidden directive.
+    if (alreadyEnglish(candidate, SUB_RULES.leetspeak.minCommonWords)) {
+      continue;
+    }
     if (
       tryCipherDecode(candidate, deleet, SUB_RULES.leetspeak.minCommonWords) !==
       null