diff --git a/CHANGELOG.md b/CHANGELOG.md
index 764a4f9..e2689f6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,6 +21,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   every target framework at once, where autobuild could pick a single TFM and analyse half
   the code. Adopts the revised canonical `codeql.yml` verbatim; no query coverage changes.
 
+- **Rewrote the provider-match guard in `FileCredentialManager.ListCredentialsAsync`**
+  from `credential?.ProviderName.Equals(…) == true` to an explicit
+  `credential is not null && …`. Behavior is identical, but the null state now flows into
+  the block body — which dereferences `credential` throughout — so both the compiler and
+  CodeQL can prove the accesses safe. Resolves the `cs/dereferenced-value-may-be-null`
+  alert the corrected buildless analysis surfaced (a genuine code fix, not a dismissal).
+
 ## [1.0.0] — 2026-08-21
 
 First stable release. Headline: whole-store **export/import** to move credentials
diff --git a/src/NextIteration.SpectreConsole.Auth/Persistence/FileCredentialManager.cs b/src/NextIteration.SpectreConsole.Auth/Persistence/FileCredentialManager.cs
index 751ba67..581845e 100644
--- a/src/NextIteration.SpectreConsole.Auth/Persistence/FileCredentialManager.cs
+++ b/src/NextIteration.SpectreConsole.Auth/Persistence/FileCredentialManager.cs
@@ -74,7 +74,11 @@ public async Task<IEnumerable<CredentialSummary>> ListCredentialsAsync(string pr
                     // Defensive re-check: the glob should only match this
                     // provider's files, but if a stray file sneaks in we want
                     // to ignore it rather than report a mis-attributed row.
-                    if (credential?.ProviderName.Equals(providerName, StringComparison.OrdinalIgnoreCase) == true)
+                    // `is not null` (rather than `?.… == true`) so the null
+                    // state flows into the block — the whole body dereferences
+                    // `credential`, and this lets the analyzer prove it safe.
+                    if (credential is not null &&
+                        credential.ProviderName.Equals(providerName, StringComparison.OrdinalIgnoreCase))
                     {
                         var isSelected = selections.TryGetValue($"{credential.ProviderName}", out var selectedId) &&
                                        selectedId.Equals(credential.AccountId, StringComparison.OrdinalIgnoreCase);