diff --git a/scripts/ci/verify_release_maturin_tool_assets.py b/scripts/ci/verify_release_maturin_tool_assets.py
index 90fa1517b7..f38b7e0e89 100644
--- a/scripts/ci/verify_release_maturin_tool_assets.py
+++ b/scripts/ci/verify_release_maturin_tool_assets.py
@@ -33,7 +33,11 @@
 
 def _download(filename: str) -> bytes:
     url = f"https://github.com/PyO3/maturin/releases/download/v1.15.0/{filename}"
-    with urlopen(Request(url, headers={"User-Agent": "cwl-release-gate"}), timeout=60) as response:
+    # URL is a fixed https://github.com prefix; only the asset filename varies, and
+    # verify_assets admits only the fixed maturin v1.15.0 filename set before fetching.
+    with urlopen(  # nosemgrep: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected  # nosec B310
+        Request(url, headers={"User-Agent": "cwl-release-gate"}), timeout=60
+    ) as response:
         raw = response.read(MAX_ASSET_BYTES + 1)
     if len(raw) > MAX_ASSET_BYTES:
         raise ValueError("maturin release asset exceeds inspection limit")