diff --git a/python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py b/python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py
index fe4f98c9dc99..4c8da0fb21bd 100644
--- a/python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py
+++ b/python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py
@@ -181,7 +181,10 @@ def _cert_thumbprint(cert_path: Path) -> str:
 
         pem_bytes = Path(cert_path).read_bytes()
         der_bytes = ssl.PEM_cert_to_DER_cert(pem_bytes.decode())
-        return hashlib.sha1(der_bytes, usedforsecurity=False).hexdigest().upper()
+        # SHA-1 is not used here as a security primitive; it is required to compute the X.509 certificate thumbprint
+        # (the `x5t` JWT header value), which MSAL and Microsoft Entra ID mandate to be a SHA-1 digest for the
+        # `thumbprint` client credential. Hence the `usedforsecurity=False` flag.
+        return hashlib.sha1(der_bytes, usedforsecurity=False).hexdigest().upper()  # CodeQL [SM02167] x5t thumbprint
 
 
 # endregion