diff --git a/internal/config/cachesize.go b/internal/config/cachesize.go
index 5937cfe..8f7a014 100644
--- a/internal/config/cachesize.go
+++ b/internal/config/cachesize.go
@@ -66,6 +66,10 @@ func ComputeDefaultCacheMaxBytes(
 	computed := freeBytes / freeSpaceFractionDenominator * freeSpaceFractionNumerator
 	computed = min(computed, math.MaxInt64)
 
+	// gosec cannot see that min() above bounds computed, so it reads
+	// this conversion as potentially overflowing. It cannot: computed is
+	// at most math.MaxInt64 on every path here.
+	//nolint:gosec // G115: clamped to MaxInt64 by min above
 	limit := int64(computed)
 	limit = max(limit, DefaultCacheMaxBytesFloor)
 
diff --git a/internal/imgcache/eviction_internal_test.go b/internal/imgcache/eviction_internal_test.go
index 0ff2ed8..7a75e32 100644
--- a/internal/imgcache/eviction_internal_test.go
+++ b/internal/imgcache/eviction_internal_test.go
@@ -20,9 +20,13 @@ import (
 // implementation writes.
 const sqliteTimestampFormat = "2006-01-02 15:04:05"
 
-// testVariantKeyOne is the variant cache key reused across the eviction
-// tests as the first stored variant.
-const testVariantKeyOne VariantKey = "aabbccdd0001"
+// testVariantKeyOne and testVariantKeyTwo are the variant cache keys
+// reused across the eviction tests as the first and second stored
+// variants.
+const (
+	testVariantKeyOne VariantKey = "aabbccdd0001"
+	testVariantKeyTwo VariantKey = "aabbccdd0002"
+)
 
 // evictionTestDB creates an in-memory SQLite database with the real
 // production schema, limited to a single connection so the background
@@ -287,7 +291,7 @@ func TestUsageBytesAccountsSourceAndVariantBytes(t *testing.T) {
 		bytes.Repeat([]byte{0xAB}, 2000))
 	storeEvictionTestVariant(t, cache, testVariantKeyOne,
 		bytes.Repeat([]byte{0xAC}, 500))
-	storeEvictionTestVariant(t, cache, "aabbccdd0002",
+	storeEvictionTestVariant(t, cache, testVariantKeyTwo,
 		bytes.Repeat([]byte{0xAD}, 250))
 
 	usage, err := cache.UsageBytes(context.Background())
@@ -336,7 +340,7 @@ func TestEvictToLimitEvictsLeastRecentlyUsedFirst(t *testing.T) {
 
 	now := time.Now()
 	keys := []VariantKey{
-		testVariantKeyOne, "aabbccdd0002", "aabbccdd0003", "aabbccdd0004",
+		testVariantKeyOne, testVariantKeyTwo, "aabbccdd0003", "aabbccdd0004",
 	}
 	fills := []byte{0x01, 0x02, 0x03, 0x04}
 	ages := []time.Duration{4 * time.Hour, 3 * time.Hour, 2 * time.Hour, 1 * time.Hour}
@@ -652,7 +656,7 @@ func TestEvictionRunsUnderWritePressure(t *testing.T) {
 	cache.StartEviction(time.Hour)
 	defer cache.StopEviction()
 
-	keys := []VariantKey{testVariantKeyOne, "aabbccdd0002", "aabbccdd0003"}
+	keys := []VariantKey{testVariantKeyOne, testVariantKeyTwo, "aabbccdd0003"}
 	fills := []byte{0x11, 0x12, 0x13}
 
 	for i, key := range keys {
@@ -683,7 +687,7 @@ func TestEvictionRunsOnPeriodicSchedule(t *testing.T) {
 	cache.StartEviction(100 * time.Millisecond)
 	defer cache.StopEviction()
 
-	keys := []VariantKey{testVariantKeyOne, "aabbccdd0002", "aabbccdd0003"}
+	keys := []VariantKey{testVariantKeyOne, testVariantKeyTwo, "aabbccdd0003"}
 	fills := []byte{0x21, 0x22, 0x23}
 
 	for i, key := range keys {
@@ -860,6 +864,8 @@ func TestPeriodicReconciliationAdoptsFileThatAppearsAfterStartup(t *testing.T) {
 // mid-unlink, and must not lose its own store once eviction has fully
 // released the content hash.
 func TestEvictSourceBlobExcludesConcurrentStoreOfIdenticalContent(t *testing.T) {
+	t.Parallel()
+
 	cache, _ := newEvictionTestCache(t, 1<<30)
 	ctx := context.Background()