diff --git a/sonar-project.properties b/sonar-project.properties
index f1246d96..e0127b78 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -17,6 +17,14 @@ sonar.exclusions=tests/**,.tox/**
 # constructor (not {...} literals) for readability and consistency across the
 # collection. Suppress python:S7498 ("prefer literal syntax"), which conflicts
 # with that convention and otherwise re-fires on every new module argument.
-sonar.issue.ignore.multicriteria=e1
+sonar.issue.ignore.multicriteria=e1,e2
 sonar.issue.ignore.multicriteria.e1.ruleKey=python:S7498
 sonar.issue.ignore.multicriteria.e1.resourceKey=**/*.py
+
+# Unit tests pass hardcoded '/tmp/...' strings as fake module arguments (e.g.
+# chart_ref) to fully mocked commands; no file is ever created there. Suppress
+# python:S5443 ("temporary files in publicly writable directories") for test
+# code only. Production code creates temp files via tempfile.mkstemp /
+# NamedTemporaryFile and stays covered by the rule.
+sonar.issue.ignore.multicriteria.e2.ruleKey=python:S5443
+sonar.issue.ignore.multicriteria.e2.resourceKey=tests/**/*.py