diff --git a/services/git-token-service/src/gitlab-runtime-token-resolver.ts b/services/git-token-service/src/gitlab-runtime-token-resolver.ts
index 11601fb1e1..d40cbd423f 100644
--- a/services/git-token-service/src/gitlab-runtime-token-resolver.ts
+++ b/services/git-token-service/src/gitlab-runtime-token-resolver.ts
@@ -77,7 +77,7 @@ type GitLabCandidateEvaluation =
   | { status: 'lookup_failed' }
   | { status: 'token_failed'; failure: GetGitLabTokenFailure };
 
-const GitLabProjectIdentitySchema = z.object({ id: z.number().int().positive() }).strict();
+const GitLabProjectIdentitySchema = z.object({ id: z.number().int().positive() });
 const MAX_PROJECT_LOOKUP_RESPONSE_BYTES = 16_000;
 
 function mapCredentialFailure(status: string, project = false): GetGitLabTokenFailure {
diff --git a/services/git-token-service/src/index.test.ts b/services/git-token-service/src/index.test.ts
index 11c298d9fd..f3bf34a9fd 100644
--- a/services/git-token-service/src/index.test.ts
+++ b/services/git-token-service/src/index.test.ts
@@ -1765,8 +1765,18 @@ describe('GitTokenRPCEntrypoint GitLab session capability RPCs', () => {
     }
   );
 
-  it('issues an opaque project-source capability for a code-review repository without exposing its token', async () => {
-    vi.stubGlobal('fetch', vi.fn().mockResolvedValue(Response.json({ id: 42 })));
+  it('issues an opaque project-source capability from a GitLab project response without exposing its token', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn().mockResolvedValue(
+        Response.json({
+          id: 42,
+          name: 'widgets',
+          path_with_namespace: 'acme/widgets',
+          web_url: 'https://gitlab.com/acme/widgets',
+        })
+      )
+    );
     serviceMocks.findAuthorizedGitLabIntegrations.mockResolvedValueOnce({
       success: true,
       integrations: [