diff --git a/internal/cli/crypto.go b/internal/cli/crypto.go
index 4de16f9..f9595fe 100644
--- a/internal/cli/crypto.go
+++ b/internal/cli/crypto.go
@@ -74,7 +74,7 @@ func (cli *Instance) Encrypt(secretName, inputFile, outputFile string) error {
 		return fmt.Errorf("failed to check if secret exists: %w", err)
 	}
 
-	if !exists {
+	if !exists { //nolint:nestif // Clear conditional logic for secret generation vs retrieval
 		// Secret doesn't exist, generate new age key and store it
 		identity, err := age.GenerateX25519Identity()
 		if err != nil {
diff --git a/internal/cli/secrets.go b/internal/cli/secrets.go
index d3ece2d..409e8e2 100644
--- a/internal/cli/secrets.go
+++ b/internal/cli/secrets.go
@@ -214,7 +214,7 @@ func (cli *Instance) ListSecrets(cmd *cobra.Command, jsonOutput bool, filter str
 		filteredSecrets = secrets
 	}
 
-	if jsonOutput {
+	if jsonOutput { //nolint:nestif // Separate JSON and table output formatting logic
 		// For JSON output, get metadata for each secret
 		secretsWithMetadata := make([]map[string]interface{}, 0, len(filteredSecrets))
 
diff --git a/internal/cli/vault.go b/internal/cli/vault.go
index b7f6c2e..0f661d4 100644
--- a/internal/cli/vault.go
+++ b/internal/cli/vault.go
@@ -98,7 +98,7 @@ func (cli *Instance) ListVaults(cmd *cobra.Command, jsonOutput bool) error {
 		return err
 	}
 
-	if jsonOutput {
+	if jsonOutput { //nolint:nestif // Separate JSON and text output formatting logic
 		// Get current vault name for context
 		currentVault := ""
 		if currentVlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir); err == nil {
diff --git a/pkg/bip85/bip85.go b/pkg/bip85/bip85.go
index ae5dd88..cb0c812 100644
--- a/pkg/bip85/bip85.go
+++ b/pkg/bip85/bip85.go
@@ -355,24 +355,30 @@ func encodeBase85WithRFC1924Charset(data []byte) string {
 	// RFC1924 character set
 	charset := "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz!#$%&()*+-;<=>?@^_`{|}~"
 
+	const (
+		base85ChunkSize  = 4  // Process 4 bytes at a time
+		base85DigitCount = 5  // Each chunk produces 5 digits
+		base85Base       = 85 // Base85 encoding uses base 85
+	)
+
 	// Pad data to multiple of 4
-	padded := make([]byte, ((len(data)+3)/4)*4)
+	padded := make([]byte, ((len(data)+base85ChunkSize-1)/base85ChunkSize)*base85ChunkSize)
 	copy(padded, data)
 
 	var buf strings.Builder
-	buf.Grow(len(padded) * 5 / 4) // Each 4 bytes becomes 5 Base85 characters
+	buf.Grow(len(padded) * base85DigitCount / base85ChunkSize) // Each 4 bytes becomes 5 Base85 characters
 
 	// Process in 4-byte chunks
-	for i := 0; i < len(padded); i += 4 {
+	for i := 0; i < len(padded); i += base85ChunkSize {
 		// Convert 4 bytes to uint32 (big-endian)
-		chunk := binary.BigEndian.Uint32(padded[i : i+4])
+		chunk := binary.BigEndian.Uint32(padded[i : i+base85ChunkSize])
 
 		// Convert to 5 base-85 digits
-		digits := make([]byte, 5)
-		for j := 4; j >= 0; j-- {
-			idx := chunk % 85
+		digits := make([]byte, base85DigitCount)
+		for j := base85DigitCount - 1; j >= 0; j-- {
+			idx := chunk % base85Base
 			digits[j] = charset[idx]
-			chunk /= 85
+			chunk /= base85Base
 		}
 
 		buf.Write(digits)