diff --git a/examples/voice/static/plain/index.html b/examples/voice/static/plain/index.html
index 016af5fe..445b89db 100644
--- a/examples/voice/static/plain/index.html
+++ b/examples/voice/static/plain/index.html
@@ -494,12 +494,10 @@ <h2 class="section">Rooms</h2>
           .with({ kind: 'voice-incoming-end' }, (m) => endIncoming(m.from))
           .with({ kind: 'system' }, () => { /* informational */ })
           .otherwise(() => {
-            // Log only the sanitized `kind` tag, never the raw server payload,
-            // so a crafted message can't forge console entries (CodeQL
-            // js/log-injection).
-            const kind =
-              typeof m?.kind === 'string' ? m.kind.replace(/[^\w.:-]/g, '') : '(unknown)';
-            console.debug('unhandled server msg kind:', kind);
+            // Encode the user-controlled value before logging so a crafted
+            // message can't forge console entries. encodeURIComponent is a
+            // sanitizer CodeQL recognises for js/log-injection.
+            console.debug('unhandled server msg kind:', encodeURIComponent(String(m?.kind ?? '')));
           });
       }