diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 2afba11be..670262dcd 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -58,6 +58,9 @@
           "-W ignore::DeprecationWarning"
         ],
         "python.testing.cwd": "${workspaceFolder}",
+        "bandit.args": [
+          "--config=${workspaceFolder}/pyproject.toml"
+        ],
         "files.associations": {
           "*.terraform": "terraform"
         },
diff --git a/CHANGELOG.md b/CHANGELOG.md
index dbf2b6984..9a00f557a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,9 @@
 ENHANCEMENTS:
 * Update UI dependencies: `brace-expansion` to 1.1.18, `fast-uri` to 3.1.5, `immutable` to 5.1.9, `js-yaml` to 4.3.1, `nanoid` to 3.3.18, and `postcss` to 8.5.26. ([#5056](https://github.com/microsoft/AzureTRE/pull/5056))
 
+BUG FIXES:
+* Configure Bandit to ignore test directories. ([#5057](https://github.com/microsoft/AzureTRE/issues/5057))
+
 ## (0.29.0) (August 14, 2026)
 **BREAKING CHANGES**
 * Remove Windows 10 and dsvm image support from Guacamole. ([#4890](https://github.com/microsoft/AzureTRE/issues/4890))
diff --git a/pyproject.toml b/pyproject.toml
index 73f230679..5e5c39a6d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -3,3 +3,12 @@
 skip = "*.json,*.js,*.ts,*.tsx,*.map,package-lock.json,node_modules,.venv,.git,.yaspeller*,**/*devcontainer*,.gitignore,.gitattributes,LICENSE,Makefile,**/.dockerignore,**/Dockerfile,**/*.tf*,**/*.terraform*,**/requirements.txt,**/*.py,**/*.yml,**/*.yaml,**/*.sh,**/.env.tmpl,**/requirements-dev.txt"
 # Words to ignore
 ignore-words-list = "tre,aci,requestor,api,AspNet,az,AzureTRE,Codespaces,Conda,dataset,datasets,dev,Dev,DevOps,DotNet,exfiltration,Endpoints,GitHub,lifecycle,maintainer,maintainers,PowerShell,PyPi,QuickStart,quickstart,repo,repos,screenshots,terraform,Terraform,tfvars,tmpl,TREs,Xamarin,devcontainer,DevContainer,endpoints,pytest,tre,VNet,resourceType,isCurrent,msfttreacr,azurecr,io,azuretre,cnab,aci,westeurope,idempotent,Versioning,mixins,yml,microsoft,pre-emptively "
+
+[tool.bandit]
+exclude_dirs = [
+  ".venv",
+  "e2e_tests",
+  "api_app/tests_ma",
+  "resource_processor/tests_rp",
+  "airlock_processor/tests",
+]