diff --git a/spec/factories/scheme.rb b/spec/factories/scheme.rb
index 3860bdcf2..a882fd9ea 100644
--- a/spec/factories/scheme.rb
+++ b/spec/factories/scheme.rb
@@ -1,7 +1,7 @@
 FactoryBot.define do
   factory :scheme do
     service_name { "#{Faker::Name.name}'s Housing & Co." }
-    sensitive { 0 }
+    sensitive { Faker::Number.within(range: 0..1) }
     registered_under_care_act { 1 }
     support_type { [0, 2, 3, 4].sample }
     scheme_type { 4 }
diff --git a/spec/services/bulk_upload/lettings/year2026/row_parser_spec.rb b/spec/services/bulk_upload/lettings/year2026/row_parser_spec.rb
index e7e552ca4..adcc262fb 100644
--- a/spec/services/bulk_upload/lettings/year2026/row_parser_spec.rb
+++ b/spec/services/bulk_upload/lettings/year2026/row_parser_spec.rb
@@ -11,7 +11,9 @@ RSpec.describe BulkUpload::Lettings::Year2026::RowParser do
 
   let(:owning_org) { create(:organisation, :with_old_visible_id) }
   let(:managing_org) { create(:organisation, :with_old_visible_id, rent_periods: [4, 1]) }
-  let(:scheme) { create(:scheme, :with_old_visible_id, owning_organisation: owning_org) }
+  # Pinned non-confidential so the address/UPRN validations run as these tests expect;
+  # the confidential-scheme behaviour is covered by its own describe below (sensitive: 1).
+  let(:scheme) { create(:scheme, :with_old_visible_id, owning_organisation: owning_org, sensitive: 0) }
   let(:postcode_first_part) { "AA1".freeze }
   let(:postcode_second_part) { "1AA".freeze }
   let(:postcode) { "#{postcode_first_part} #{postcode_second_part}" }