diff --git a/src/tools/glob/cli.test.ts b/src/tools/glob/cli.test.ts
index 5d1ba0683..dcc393eb4 100644
--- a/src/tools/glob/cli.test.ts
+++ b/src/tools/glob/cli.test.ts
@@ -57,8 +57,10 @@ describe("buildRgArgs", () => {
 
   // Regression for #3726: broken/dangling symlinks should not surface as
   // tool errors. --no-messages silences ripgrep's non-fatal stderr warnings
-  // so the downstream "exit code > 2 && stderr.trim()" gate sees a clean
-  // stream when only I/O warnings were emitted.
+  // for I/O issues (broken symlinks, permission denied) without suppressing
+  // fatal-error messages, so the existing "exit code > 1 && stderr.trim()"
+  // gate sees a clean stream for soft I/O issues but still triggers on real
+  // fatal ripgrep errors.
   it("includes --no-messages so broken symlinks do not error the tool (#3726)", () => {
     const args = buildRgArgs({ pattern: "*.ts" })
     expect(args).toContain("--no-messages")
diff --git a/src/tools/glob/cli.ts b/src/tools/glob/cli.ts
index 271405a21..9ba34c32a 100644
--- a/src/tools/glob/cli.ts
+++ b/src/tools/glob/cli.ts
@@ -152,10 +152,7 @@ async function runRgFilesInternal(
     const stderr = await new Response(proc.stderr).text()
     const exitCode = await proc.exited
 
-    // ripgrep exits 2 on non-fatal I/O errors (broken symlinks, permission
-    // denied) even when stdout still contains valid file matches; treat only
-    // exit codes >2 as fatal so partial results survive. See #3726.
-    if (exitCode > 2 && stderr.trim()) {
+    if (exitCode > 1 && stderr.trim()) {
       return {
         files: [],
         totalFiles: 0,
diff --git a/src/tools/grep/cli.ts b/src/tools/grep/cli.ts
index abef23804..4b9684c66 100644
--- a/src/tools/grep/cli.ts
+++ b/src/tools/grep/cli.ts
@@ -197,10 +197,7 @@ async function runRgInternal(options: GrepOptions, resolvedCli?: ResolvedCli): P
     const truncated = stdout.length >= DEFAULT_MAX_OUTPUT_BYTES
     const outputToProcess = truncated ? stdout.substring(0, DEFAULT_MAX_OUTPUT_BYTES) : stdout
 
-    // ripgrep exits 2 on non-fatal I/O errors (broken symlinks, permission
-    // denied) even when stdout still contains valid matches; treat only
-    // exit codes >2 as fatal so partial results survive. See #3726.
-    if (exitCode > 2 && stderr.trim()) {
+    if (exitCode > 1 && stderr.trim()) {
       return {
         matches: [],
         totalMatches: 0,