diff --git a/composer.lock b/composer.lock
index 18989e0..940544f 100644
--- a/composer.lock
+++ b/composer.lock
@@ -335,16 +335,16 @@
         },
         {
             "name": "humanmade/coding-standards",
-            "version": "v2.2.0",
+            "version": "v2.2.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/humanmade/coding-standards.git",
-                "reference": "96fb170e1b81307ca4e73dbc22b44a62fe5f8534"
+                "reference": "601ff015e90254a7be77c5b1ce262df6df089fdb"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/humanmade/coding-standards/zipball/96fb170e1b81307ca4e73dbc22b44a62fe5f8534",
-                "reference": "96fb170e1b81307ca4e73dbc22b44a62fe5f8534",
+                "url": "https://api.github.com/repos/humanmade/coding-standards/zipball/601ff015e90254a7be77c5b1ce262df6df089fdb",
+                "reference": "601ff015e90254a7be77c5b1ce262df6df089fdb",
                 "shasum": ""
             },
             "require": {
@@ -367,9 +367,9 @@
             "description": "Human Made Coding Standards",
             "support": {
                 "issues": "https://github.com/humanmade/coding-standards/issues",
-                "source": "https://github.com/humanmade/coding-standards/tree/v2.2.0"
+                "source": "https://github.com/humanmade/coding-standards/tree/v2.2.1"
             },
-            "time": "2026-06-22T17:25:44+00:00"
+            "time": "2026-06-23T13:24:51+00:00"
         },
         {
             "name": "phpcompatibility/php-compatibility",
diff --git a/inc/namespace.php b/inc/namespace.php
index 6457f8f..63829fe 100644
--- a/inc/namespace.php
+++ b/inc/namespace.php
@@ -179,10 +179,12 @@ function render_block_search( string $block_content, array $block, \WP_Block $in
 	$action = str_replace( '/page/'. get_query_var( 'paged', 1 ), '', add_query_arg( [ $query_var => '' ] ) );
 
 	// Note sanitize_text_field trims whitespace from start/end of string causing unexpected behaviour.
+	// phpcs:ignore HM.Security.ValidatedSanitizedInput.InputNotSanitized
 	$value = wp_unslash( $_GET[ $query_var ] ?? '' );
 	$value = urldecode( $value );
 	$value = wp_check_invalid_utf8( $value );
 	$value = wp_pre_kses_less_than( $value );
+	// phpcs:ignore WordPress.WP.AlternativeFunctions.strip_tags_strip_tags -- need to preserve whitespace.
 	$value = strip_tags( $value );
 
 	wp_interactivity_state( 'query-filter', [
diff --git a/src/post-type/render.php b/src/post-type/render.php
index 70d43f2..774e771 100644
--- a/src/post-type/render.php
+++ b/src/post-type/render.php
@@ -48,7 +48,7 @@
 	<select class="wp-block-query-filter-post-type__select wp-block-query-filter__select" id="<?php echo esc_attr( $id ); ?>" data-wp-on--change="actions.navigate">
 		<option value="<?php echo esc_attr( $base_url ) ?>"><?php echo esc_html( $attributes['emptyLabel'] ?: __( 'All', 'query-filter' ) ); ?></option>
 		<?php foreach ( $post_types as $post_type ) : ?>
-			<option value="<?php echo esc_attr( add_query_arg( [ $query_var => $post_type->name, $page_var => false ], $base_url ) ) ?>" <?php selected( $post_type->name, wp_unslash( $_GET[ $query_var ] ?? '' ) ); ?>><?php echo esc_html( $post_type->label ); ?></option>
+			<option value="<?php echo esc_attr( add_query_arg( [ $query_var => $post_type->name, $page_var => false ], $base_url ) ) ?>" <?php selected( $post_type->name, sanitize_key( wp_unslash( $_GET[ $query_var ] ?? '' ) ) ); ?>><?php echo esc_html( $post_type->label ); ?></option>
 		<?php endforeach; ?>
 	</select>
 </div>
diff --git a/src/taxonomy/render.php b/src/taxonomy/render.php
index 97258b4..362966a 100644
--- a/src/taxonomy/render.php
+++ b/src/taxonomy/render.php
@@ -36,7 +36,7 @@
 	<select class="wp-block-query-filter-post-type__select wp-block-query-filter__select" id="<?php echo esc_attr( $id ); ?>" data-wp-on--change="actions.navigate">
 		<option value="<?php echo esc_attr( $base_url ) ?>"><?php echo esc_html( $attributes['emptyLabel'] ?: __( 'All', 'query-filter' ) ); ?></option>
 		<?php foreach ( $terms as $term ) : ?>
-			<option value="<?php echo esc_attr( add_query_arg( [ $query_var => $term->slug, $page_var => false ], $base_url ) ) ?>" <?php selected( $term->slug, wp_unslash( $_GET[ $query_var ] ?? '' ) ); ?>><?php echo esc_html( $term->name ); ?></option>
+			<option value="<?php echo esc_attr( add_query_arg( [ $query_var => $term->slug, $page_var => false ], $base_url ) ) ?>" <?php selected( $term->slug, sanitize_key( wp_unslash( $_GET[ $query_var ] ?? '' ) ) ); ?>><?php echo esc_html( $term->name ); ?></option>
 		<?php endforeach; ?>
 	</select>
 </div>