diff --git a/lib/services/integration-health.ts b/lib/services/integration-health.ts
index 709605e..91ce43e 100644
--- a/lib/services/integration-health.ts
+++ b/lib/services/integration-health.ts
@@ -19,6 +19,7 @@
 import { ListHostedZonesCommand } from '@aws-sdk/client-route-53';
 import { isRoute53Configured, getRoute53Client } from '@/lib/services/route53-factory';
 import { checkAllZoneDelegations } from '@/lib/services/route53-dns-delegation';
+import { sanitizeAwsError } from '@/lib/services/route53-record-validation';
 
 export type HealthStatus =
   | 'ok'              // configured, auth succeeded
@@ -201,29 +202,6 @@ async function checkDattoRmm(): Promise<IntegrationHealth> {
   }
 }
 
-/**
- * Redact an AWS SDK error down to a message safe to surface in the health
- * API response and (eventually) route53_audit_log.error_message.
- *
- * NOTE: this duplicates the `sanitizeAwsError` spec'd for
- * `lib/services/route53-record-validation.ts` in plan 24-03 (T-24-03). That
- * file did not exist in this plan's isolated worktree at execution time
- * (24-03 runs in a sibling parallel worktree and depends_on for this plan
- * only lists 24-01) — see this plan's SUMMARY "Deviations" section. This
- * local copy uses the identical redaction rules so behavior is consistent
- * regardless of which implementation ships; if 24-03 lands first in a
- * future merge, this local copy should be replaced with an import from
- * `@/lib/services/route53-record-validation` for a single source of truth.
- */
-function sanitizeAwsError(err: unknown): string {
-  const message = err instanceof Error ? err.message : String(err);
-  return message
-    .replace(/AKIA[0-9A-Z]{16}/g, '[redacted-key-id]')
-    .replace(/arn:aws:[^\s"']+/g, '[redacted-arn]')
-    .replace(/\b[0-9]{12}\b/g, '[redacted-account-id]')
-    .slice(0, 500);
-}
-
 const AWS_AUTH_ERROR_NAMES = new Set([
   'InvalidClientTokenId',
   'SignatureDoesNotMatch',