diff --git a/internal/cli/version.go b/internal/cli/version.go
index df74c8d..f7dcfa8 100644
--- a/internal/cli/version.go
+++ b/internal/cli/version.go
@@ -45,7 +45,7 @@ func VersionCommands(cli *Instance) *cobra.Command {
 		Use:   "promote <secret-name> <version>",
 		Short: "Promote a specific version to current",
 		Long:  "Updates the current symlink to point to the specified version without modifying timestamps",
-		Args:  cobra.ExactArgs(2),
+		Args:  cobra.ExactArgs(2), //nolint:mnd // Command requires exactly 2 arguments: secret-name and version
 		RunE: func(cmd *cobra.Command, args []string) error {
 			return cli.PromoteVersion(cmd, args[0], args[1])
 		},
diff --git a/internal/secret/secret.go b/internal/secret/secret.go
index 8a8d70e..de60c2f 100644
--- a/internal/secret/secret.go
+++ b/internal/secret/secret.go
@@ -286,7 +286,9 @@ func GetCurrentVault(fs afero.Fs, stateDir string) (VaultInterface, error) {
 
 // getCurrentVaultFunc is a function variable that will be set by the vault package
 // to implement the actual GetCurrentVault functionality
-var getCurrentVaultFunc func(fs afero.Fs, stateDir string) (VaultInterface, error) //nolint:gochecknoglobals // Required to break import cycle
+//
+//nolint:gochecknoglobals // Required to break import cycle
+var getCurrentVaultFunc func(fs afero.Fs, stateDir string) (VaultInterface, error)
 
 // RegisterGetCurrentVaultFunc allows the vault package to register its implementation
 // of GetCurrentVault to break the import cycle
diff --git a/pkg/agehd/agehd.go b/pkg/agehd/agehd.go
index 480ce00..88c2f8a 100644
--- a/pkg/agehd/agehd.go
+++ b/pkg/agehd/agehd.go
@@ -37,7 +37,8 @@ func clamp(k []byte) {
 // IdentityFromEntropy converts 32 deterministic bytes into an
 // *age.X25519Identity by round-tripping through Bech32.
 func IdentityFromEntropy(ent []byte) (*age.X25519Identity, error) {
-	if len(ent) != 32 { // 32 bytes = 256-bit key size for X25519
+	const x25519KeySize = 32 // 256-bit key size for X25519
+	if len(ent) != x25519KeySize {
 		return nil, fmt.Errorf("need 32-byte scalar, got %d", len(ent))
 	}
 
diff --git a/pkg/bip85/bip85.go b/pkg/bip85/bip85.go
index a76d4a7..a9e71b1 100644
--- a/pkg/bip85/bip85.go
+++ b/pkg/bip85/bip85.go
@@ -40,9 +40,9 @@ const (
 // Version bytes for extended keys
 var (
 	// MainNetPrivateKey is the version for mainnet private keys
-	MainNetPrivateKey = []byte{0x04, 0x88, 0xAD, 0xE4}
+	MainNetPrivateKey = []byte{0x04, 0x88, 0xAD, 0xE4} //nolint:gochecknoglobals // Standard BIP32 constant
 	// TestNetPrivateKey is the version for testnet private keys
-	TestNetPrivateKey = []byte{0x04, 0x35, 0x83, 0x94}
+	TestNetPrivateKey = []byte{0x04, 0x35, 0x83, 0x94} //nolint:gochecknoglobals // Standard BIP32 constant
 )
 
 // DRNG is a deterministic random number generator seeded by BIP85 entropy
@@ -59,7 +59,7 @@ func NewBIP85DRNG(entropy []byte) *DRNG {
 
 	// Initialize SHAKE256 with the entropy
 	shake := sha3.NewShake256()
-	shake.Write(entropy)
+	_, _ = shake.Write(entropy) // Write to hash functions never returns an error
 
 	return &DRNG{
 		shake: shake,