diff --git a/nursery/encrypt-data-using-salsa20-or-chacha.yml b/nursery/encrypt-data-using-salsa20-or-chacha.yml
index a57b855a..5fc26d21 100644
--- a/nursery/encrypt-data-using-salsa20-or-chacha.yml
+++ b/nursery/encrypt-data-using-salsa20-or-chacha.yml
@@ -21,6 +21,8 @@ rule:
         description: tau
       # if sigma and tau are in contiguous memory, may result in concatenated string
       - string: "expand 32-byte kexpand 16-byte k"
+      - bytes: 65 78 70 61 6E 64 20 33 32 2D 62 79 74 65 20 6B = "expand 32-byte k"
+      - bytes: 65 78 70 61 6E 64 20 31 36 2D 62 79 74 65 20 6B = "expand 16-byte k"
       - and:
         - string: "expa"
         - string: "nd 3"