diff --git a/codex-rs/core/src/config_loader/macos.rs b/codex-rs/core/src/config_loader/macos.rs
index 56fb6251b8..fe4e3c4015 100644
--- a/codex-rs/core/src/config_loader/macos.rs
+++ b/codex-rs/core/src/config_loader/macos.rs
@@ -235,7 +235,7 @@ fn parse_managed_requirements_base64(encoded: &str) -> io::Result<ConfigRequirem
     {
         return Err(io::Error::new(
             io::ErrorKind::InvalidData,
-            format!("Error parsing managed requirements from {source}: {dropped_entry}"),
+            format!("Error parsing managed security controls from {source}: {dropped_entry}"),
         ));
     }
     for dropped_entry in &sanitized.dropped_entries {
diff --git a/codex-rs/core/src/config_loader/tests.rs b/codex-rs/core/src/config_loader/tests.rs
index a8a6222761..21d549540b 100644
--- a/codex-rs/core/src/config_loader/tests.rs
+++ b/codex-rs/core/src/config_loader/tests.rs
@@ -534,7 +534,7 @@ async fn managed_preferences_ignore_invalid_payload() -> anyhow::Result<()> {
 
 #[cfg(target_os = "macos")]
 #[tokio::test]
-async fn managed_preferences_invalid_requirements_fail_closed() -> anyhow::Result<()> {
+async fn managed_preferences_invalid_security_requirements_fail_closed() -> anyhow::Result<()> {
     use base64::Engine;
 
     for (payload, expected_fragment) in [
@@ -566,11 +566,11 @@ async fn managed_preferences_invalid_requirements_fail_closed() -> anyhow::Resul
             CloudRequirementsLoader::default(),
         )
         .await
-        .expect_err("invalid managed requirements should fail closed");
+        .expect_err("invalid managed security requirements should fail closed");
 
         assert_eq!(err.kind(), std::io::ErrorKind::InvalidData);
         let message = err.to_string();
-        assert!(message.contains("Error parsing managed requirements from MDM"));
+        assert!(message.contains("Error parsing managed security controls from MDM"));
         assert!(message.contains(expected_fragment), "{message}");
         assert!(message.contains("bogus"), "{message}");
     }