diff --git a/src/Game/Service/GameResponseService.php b/src/Game/Service/GameResponseService.php
index 5c80806..dd8fb7c 100644
--- a/src/Game/Service/GameResponseService.php
+++ b/src/Game/Service/GameResponseService.php
@@ -431,12 +431,12 @@ class GameResponseService
 
         $this->updateChatTracking($player, (int)$sendTo);
 
-        $this->checkAndRegenerateVerifyCodes($player, $chatMessage . ' ' . implode(' ', $messageParts));
+        $this->checkAndRegenerateVerifyCodes($player, $chatMessage . ' ' . implode(' ', $messageParts), (int)$sendTo);
 
         return true;
     }
 
-    private function checkAndRegenerateVerifyCodes(Player $player, string $messageContent): void
+    private function checkAndRegenerateVerifyCodes(Player $player, string $messageContent, int $sendTo): void
     {
         $screen = $player->getScreen();
         $session = $player->getSession();
@@ -456,10 +456,19 @@ class GameResponseService
         $regenerated = false;
 
         foreach ($codes as $targetPlayerScreen => $code) {
-            if (str_contains($messageContent, (string)$code)) {
-                $codes[$targetPlayerScreen] = bin2hex(random_bytes(3));
-                $regenerated = true;
+            if (!str_contains($messageContent, (string)$code)) {
+                continue;
             }
+
+            // Sending a code privately to its rightful recipient via /chat {agent-id}
+            // is the whole point of this puzzle - only a leak (broadcast, or sent to
+            // the wrong player) should regenerate it.
+            if ($sendTo === (int)$targetPlayerScreen) {
+                continue;
+            }
+
+            $codes[$targetPlayerScreen] = bin2hex(random_bytes(3));
+            $regenerated = true;
         }
 
         if ($regenerated) {