diff --git a/hermes-agent/leoclean-bin/cloudsql_memory_tool.py b/hermes-agent/leoclean-bin/cloudsql_memory_tool.py
index 15a5894..50b90f8 100755
--- a/hermes-agent/leoclean-bin/cloudsql_memory_tool.py
+++ b/hermes-agent/leoclean-bin/cloudsql_memory_tool.py
@@ -879,7 +879,7 @@ def database_read_marker(args: argparse.Namespace) -> dict[str, Any]:
 select jsonb_build_object(
   'database', current_database(),
   'database_user', current_user,
-  'server_addr', inet_server_addr()::text,
+  'server_addr', pg_catalog.host(pg_catalog.inet_server_addr()),
   'server_port', inet_server_port(),
   'ssl', coalesce((select ssl from pg_catalog.pg_stat_ssl where pid = pg_backend_pid()), false),
   'ssl_version', (select version from pg_catalog.pg_stat_ssl where pid = pg_backend_pid()),
diff --git a/ops/derive_leoclean_runtime_query_contract.py b/ops/derive_leoclean_runtime_query_contract.py
index 045a012..610ab4b 100644
--- a/ops/derive_leoclean_runtime_query_contract.py
+++ b/ops/derive_leoclean_runtime_query_contract.py
@@ -48,7 +48,7 @@ DYNAMIC_SQL_VALUE = "__teleo_dynamic_sql_value__"
 UNREVIEWED_DYNAMIC_SQL = "__teleo_unreviewed_dynamic_sql__"
 REVIEWED_SQL_INTERPOLATION_CALLS = frozenset({"sql_array", "sql_integer", "sql_json_array", "sql_literal"})
 QUERY_RUNNERS = frozenset({"run_psql", "psql_json_lines"})
-REVIEWED_RUNTIME_SOURCE_SHA256 = "5f98218622803e0a1bbedc1e23e538d1f152ecb516e31a387a5eb39080aaf2cd"
+REVIEWED_RUNTIME_SOURCE_SHA256 = "f86bf2236a4b47ec8af29c83e1fd1a4b6e7ef27dd894f62f4acf5985fe3277d4"
 DYNAMIC_CALL_BUILTINS = frozenset({"eval", "exec", "globals", "locals"})
 READ_CAPABILITY = "read"
 STAGE_PROPOSAL_CAPABILITY = "stage-proposal"
diff --git a/ops/verify_gcp_leoclean_runtime_permissions.py b/ops/verify_gcp_leoclean_runtime_permissions.py
index 4eb1ac5..fced89f 100644
--- a/ops/verify_gcp_leoclean_runtime_permissions.py
+++ b/ops/verify_gcp_leoclean_runtime_permissions.py
@@ -1028,7 +1028,7 @@ select pg_catalog.jsonb_build_object(
   'database', pg_catalog.current_database(),
   'current_user', current_user,
   'session_user', session_user,
-  'server_addr', pg_catalog.inet_server_addr()::text,
+  'server_addr', pg_catalog.host(pg_catalog.inet_server_addr()),
   'server_port', pg_catalog.inet_server_port(),
   'ssl', coalesce(
     (select ssl from pg_catalog.pg_stat_ssl where pid = pg_catalog.pg_backend_pid()),
diff --git a/tests/test_gcp_leoclean_runtime_permissions.py b/tests/test_gcp_leoclean_runtime_permissions.py
index 4d46047..6effd23 100644
--- a/tests/test_gcp_leoclean_runtime_permissions.py
+++ b/tests/test_gcp_leoclean_runtime_permissions.py
@@ -1513,6 +1513,11 @@ def test_catalog_queries_use_exact_regprocedure_signatures_and_both_membership_d
     catalog_sql = verifier._catalog_privilege_posture_sql()
 
     assert "lo_compat_privileges" in identity_sql
+    assert (
+        "'server_addr', pg_catalog.host(pg_catalog.inet_server_addr()),"
+        in identity_sql
+    )
+    assert "pg_catalog.inet_server_addr()::text" not in identity_sql
     assert "pg_catalog.to_regprocedure(signature)" in function_sql
     for _name, signature, _exists, _execute in verifier.FUNCTION_PRIVILEGE_EXPECTATIONS:
         assert signature in function_sql
diff --git a/tests/test_hermes_leoclean_kb_bridge_source.py b/tests/test_hermes_leoclean_kb_bridge_source.py
index 589ec99..9976979 100644
--- a/tests/test_hermes_leoclean_kb_bridge_source.py
+++ b/tests/test_hermes_leoclean_kb_bridge_source.py
@@ -1072,7 +1072,11 @@ def test_cloudsql_runtime_read_marker_binds_database_user_private_server_and_ssl
 
     assert module.database_read_marker(args) == marker
     assert captured["db"] == module.RUNTIME_CLOUDSQL_DB
-    assert "inet_server_addr()" in str(captured["sql"])
+    assert (
+        "'server_addr', pg_catalog.host(pg_catalog.inet_server_addr()),"
+        in str(captured["sql"])
+    )
+    assert "inet_server_addr()::text" not in str(captured["sql"])
     assert "pg_stat_ssl" in str(captured["sql"])