diff --git a/src/lab/events/limits.ts b/src/lab/events/limits.ts
index f6b5ab1c91..b49ad75a5f 100644
--- a/src/lab/events/limits.ts
+++ b/src/lab/events/limits.ts
@@ -33,6 +33,7 @@ const FORBIDDEN_EXACT_KEYS = new Set([
 
 const RAW_POSIX_PATH_RE =
   /(?:^|[^A-Za-z0-9._~/])\/(?:(?=$|[^A-Za-z0-9._~/])|(?!\/)(?![ \t\r\n])(?:\/|[^/\0\r\n]+)+\/?(?=$|[^A-Za-z0-9._~/]))/u;
+const FILE_POSIX_URI_RE = /\bfile:\/\/\//i;
 
 function fieldPath(base: string, key: string | number): string {
   return base ? `${base}.${String(key)}` : String(key);
@@ -80,6 +81,7 @@ export function enforceEventStructureLimits(
     }
     if (
       /^[A-Za-z]:\\/.test(value) ||
+      FILE_POSIX_URI_RE.test(value) ||
       RAW_POSIX_PATH_RE.test(value) ||
       value.includes("\\Users\\")
     ) {
diff --git a/tests/lab-post-merge-hardening.test.ts b/tests/lab-post-merge-hardening.test.ts
index 7e5ef887c9..c42978f383 100644
--- a/tests/lab-post-merge-hardening.test.ts
+++ b/tests/lab-post-merge-hardening.test.ts
@@ -191,6 +191,8 @@ test("event privacy admission rejects raw POSIX path bypass forms", () => {
     "cwd=/home/@alice",
     "cwd=/home/josé/work",
     "x-/home/alice",
+    "detail=file:///etc/passwd",
+    "detail=file:///home/alice/secret.txt",
   ]) {
     try {
       enforceEventStructureLimits({ detail });