diff --git a/src/Config/DeserializationVariableReplacementSettings.cs b/src/Config/DeserializationVariableReplacementSettings.cs
index 5c70f4082b..350824409b 100644
--- a/src/Config/DeserializationVariableReplacementSettings.cs
+++ b/src/Config/DeserializationVariableReplacementSettings.cs
@@ -259,7 +259,7 @@ private static SecretClient CreateSecretClient(AzureKeyVaultOptions options)
                 clientOptions.Retry.NetworkTimeout = TimeSpan.FromSeconds(options.RetryPolicy.NetworkTimeoutSeconds ?? AKVRetryPolicyOptions.DEFAULT_NETWORK_TIMEOUT_SECONDS);
             }
 
-            return new SecretClient(new Uri(options.Endpoint), new DefaultAzureCredential(), clientOptions);
+            return new SecretClient(new Uri(options.Endpoint), new DefaultAzureCredential(), clientOptions); // CodeQL [SM05137] DefaultAzureCredential will use Managed Identity if available or fallback to default.
         }
 
         private string? GetAkvVariable(string name)