diff --git a/CHANGELOG.md b/CHANGELOG.md
index fb846bae..21f55ea7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,9 @@
 # Changelog
 All notable changes to this project will be documented in this file.
 
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
 <!--
 Please ADD ALL Changes to the UNRELEASED SECTION and not a specific release
 -->
@@ -50,6 +53,8 @@ Please ADD ALL Changes to the UNRELEASED SECTION and not a specific release
 - git/ignore-changelog: skip push hooks when pushing to target repositories
 - git/fetch and git/switchtomain now warn and skip a repo on error instead of aborting the whole run, so remaining repos still get processed.
 - development/buildtest now runs unit tests first, always excluding benchmark test projects, then runs any benchmark projects found individually without the --long-running/--parallel-algorithm flags, since some benchmark projects' test host rejects them as invalid arguments (exit code 5, zero tests ran) instead of running
+- development/buildtest: fixed the --no-benchmarks/--no-integration flag typos and the broken TEST_INTEGRATION filter assignment so --no-integration actually excludes integration tests
+- development/buildtest: disable shell pathname expansion (set -f) around the dotnet test invocation using the unquoted TEST_INTEGRATION filter, so a *.Integration.Tests(.*) file in the solution directory can no longer glob-expand and corrupt the --no-integration filter arguments
 ### Changed
 - Replace raw echo with standard output helpers (die/info/success) in github/cancel-workflows
 - Replace raw echo with standard output helpers (die/info/success) in git/update-repos-personal
diff --git a/development/buildtest b/development/buildtest
index a23b2a61..f6c912db 100755
--- a/development/buildtest
+++ b/development/buildtest
@@ -66,12 +66,12 @@ while [ $# -gt 0 ]; do
       [ -f "$SOURCE_DIR/release.rule-settings.json" ] && RULESET_ADJUSTMENT_FILE="$SOURCE_DIR/release.rule-settings.json"
       shift # past argument
       ;;
-    -b|--no-benchmmarks)
+    -b|--no-benchmarks)
       TEST_BENCHMARKS=1
       shift # past argument
       ;;
-    -i|--no-integratopn)
-      TEST_INTEGRATION=--filter-not-namespace "*.Integration.Tests" --filter-not-namespace "*.Integration.Tests.*"
+    -i|--no-integration)
+      TEST_INTEGRATION="--filter-not-namespace *.Integration.Tests --filter-not-namespace *.Integration.Tests.*"
       shift # past argument
       ;;
     *)    # unknown option
@@ -162,7 +162,7 @@ dotnet build \
 
 info "Testing..."
 # Every benchmark test project is always excluded here, regardless of the
-# -b/--no-benchmmarks flag; benchmarks (if any) are run separately below, one
+# -b/--no-benchmarks flag; benchmarks (if any) are run separately below, one
 # project per dotnet test invocation, since some benchmark projects' test
 # host rejects --long-running/--parallel-algorithm as invalid arguments when
 # passed to a combined run.
@@ -171,6 +171,10 @@ info "Testing..."
 # credfeto/credfeto-global-pre-commit - that repo is the source of truth for
 # this design; this file is a local fork/vendored copy, not consumed
 # directly from there (see credfeto/scripts#679, credfeto/scripts#723).
+# set -f disables pathname expansion for the unquoted $TEST_INTEGRATION below,
+# so a *.Integration.Tests(.*) file sitting in $SOURCE_DIR can't get glob-expanded
+# in place of the literal filter pattern; word splitting still applies.
+set -f
 # shellcheck disable=SC2086
 dotnet test \
           --configuration Release \
@@ -191,6 +195,7 @@ dotnet test \
           "-p:SuppressNETCoreSdkPreviewMessage=true" \
           "-p:Version=0.0.0.1-test" \
           || die "Tests Failed"
+set +f
 
 if [ -z "$TEST_BENCHMARKS" ]; then
   BENCH_PROJECTS=$(find "$SOURCE_DIR" -type f -iname "*.csproj" -not -path "*/obj/*" -not -path "*/bin/*" | while IFS= read -r proj; do