diff --git a/container/lib/common.sh b/container/lib/common.sh
index add5e17..bba4782 100644
--- a/container/lib/common.sh
+++ b/container/lib/common.sh
@@ -26,8 +26,8 @@ die()  { printf '[%s] ERROR: %s\n' "${ARENA_LOG_TAG:-arena}" "$*" >&2; exit 1; }
 # credential. Log through this, or log field names and digests instead of values.
 redact() {
   sed -E \
-    -e 's|(https?://[^ "]*[?&](X-Amz-Signature|Signature|sig|token)=)[^ "&]*|\1REDACTED|Ig' \
-    -e 's|(Authorization: *)[^ ]*|\1REDACTED|I'
+    -e 's#([?&](X-Amz-Signature|Signature|sig|token)=)[^ "&]*#\1REDACTED#Ig' \
+    -e 's|(Authorization: *).*|\1REDACTED|I'
 }
 
 # curl with retries and no credential leakage into the log.