diff --git a/PSScriptAnalyzerSettings.psd1 b/PSScriptAnalyzerSettings.psd1
index 00c4c41..976f17b 100644
--- a/PSScriptAnalyzerSettings.psd1
+++ b/PSScriptAnalyzerSettings.psd1
@@ -9,7 +9,15 @@
         # (thousands of hits). Run locally with Invoke-ScriptAnalyzer -Fix to auto-format;
         # do not use as CI gate until the whole codebase has been reformatted.
         'PSUseConsistentIndentation',
-        'PSUseConsistentWhitespace'
+        'PSUseConsistentWhitespace',
+
+        # UTF-8 without BOM is the editor default; adding BOM to ~35 files is cosmetic
+        # and does not affect PS 5.1 execution.
+        'PSUseBOMForUnicodeEncodedFile',
+
+        # Plural nouns in internal helpers (Get-GuestDiagnostics, Remove-OldJobDirs, etc.)
+        # are intentional — they describe collections, not single objects.
+        'PSUseSingularNouns'
     )
 
     # ── Rule-specific configuration ──────────────────────────────────────────────
diff --git a/template/Install-CIToolchain-WinBuild2022.ps1 b/template/Install-CIToolchain-WinBuild2022.ps1
index 427f557..7c450d5 100644
--- a/template/Install-CIToolchain-WinBuild2022.ps1
+++ b/template/Install-CIToolchain-WinBuild2022.ps1
@@ -123,6 +123,8 @@
       Set-ExecutionPolicy Bypass -Scope Process -Force
       .\Install-CIToolchain-WinBuild2022.ps1 -BuildPassword 'YourPassword'
 #>
+[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingConvertToSecureStringWithPlainText', '',
+    Justification = 'Template setup script: plain-text password from CI credential store converted to SecureString for local user creation. Intentional by design.')]
 [CmdletBinding()]
 param(
     # Local username for the CI build account inside the VM
diff --git a/template/Install-CIToolchain-WinBuild2025.ps1 b/template/Install-CIToolchain-WinBuild2025.ps1
index 3fe7661..d02a8de 100644
--- a/template/Install-CIToolchain-WinBuild2025.ps1
+++ b/template/Install-CIToolchain-WinBuild2025.ps1
@@ -123,6 +123,8 @@
       Set-ExecutionPolicy Bypass -Scope Process -Force
       .\Install-CIToolchain-WinBuild2025.ps1 -BuildPassword 'YourPassword'
 #>
+[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingConvertToSecureStringWithPlainText', '',
+    Justification = 'Template setup script: plain-text password from CI credential store converted to SecureString for local user creation. Intentional by design.')]
 [CmdletBinding()]
 param(
     # Local username for the CI build account inside the VM
diff --git a/template/Prepare-WinBuild2022.ps1 b/template/Prepare-WinBuild2022.ps1
index 1e924ff..8f31821 100644
--- a/template/Prepare-WinBuild2022.ps1
+++ b/template/Prepare-WinBuild2022.ps1
@@ -113,6 +113,8 @@
         -VMXPath 'F:\CI\Templates\WinBuild\WinBuild.vmx' -VMIPAddress 192.168.79.130 `
         -BuildPassword 'StrongCIPass!2026' -StoreCredential
 #>
+[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingConvertToSecureStringWithPlainText', '',
+    Justification = 'Template setup script: plain-text password from CI credential store converted to SecureString for WinRM PSCredential. Intentional by design.')]
 [CmdletBinding()]
 param(
     # Path to the VM .vmx — enables auto power-on + IP detection + auto snapshot.
@@ -721,5 +723,5 @@ finally {
     }
     Write-Host "[Prepare] Host TrustedHosts restored."
 }
-
-
+
+
diff --git a/template/Prepare-WinBuild2025.ps1 b/template/Prepare-WinBuild2025.ps1
index 14c98fa..66e9a7c 100644
--- a/template/Prepare-WinBuild2025.ps1
+++ b/template/Prepare-WinBuild2025.ps1
@@ -113,6 +113,8 @@
         -VMXPath 'F:\CI\Templates\WinBuild\WinBuild.vmx' -VMIPAddress 192.168.79.130 `
         -BuildPassword 'StrongCIPass!2026' -StoreCredential
 #>
+[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingConvertToSecureStringWithPlainText', '',
+    Justification = 'Template setup script: plain-text password from CI credential store converted to SecureString for WinRM PSCredential. Intentional by design.')]
 [CmdletBinding()]
 param(
     # Path to the VM .vmx — enables auto power-on + IP detection + auto snapshot.
@@ -721,5 +723,5 @@ finally {
     }
     Write-Host "[Prepare] Host TrustedHosts restored."
 }
-
-
+
+
diff --git a/template/Validate-DeployState.ps1 b/template/Validate-DeployState.ps1
index e4c4359..94654c0 100644
--- a/template/Validate-DeployState.ps1
+++ b/template/Validate-DeployState.ps1
@@ -41,6 +41,8 @@
     # Linux
     .\Validate-DeployState.ps1 -VMIPAddress 192.168.79.200 -GuestOS Linux
 #>
+[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingConvertToSecureStringWithPlainText', '',
+    Justification = 'Template validation script: plain-text password converted to SecureString for WinRM PSCredential. Intentional by design.')]
 [CmdletBinding()]
 param(
     [Parameter(Mandatory)] [string] $VMIPAddress,