diff --git a/internal/secret/debug.go b/internal/secret/debug.go
index 34f4f77..29d7acc 100644
--- a/internal/secret/debug.go
+++ b/internal/secret/debug.go
@@ -13,8 +13,8 @@ import (
 )
 
 var (
-	debugEnabled bool
-	debugLogger  *slog.Logger
+	debugEnabled bool         //nolint:gochecknoglobals // Package-wide debug state is necessary
+	debugLogger  *slog.Logger //nolint:gochecknoglobals // Package-wide logger instance is necessary
 )
 
 func init() {
diff --git a/internal/secret/pgpunlocker.go b/internal/secret/pgpunlocker.go
index 20e803e..963d291 100644
--- a/internal/secret/pgpunlocker.go
+++ b/internal/secret/pgpunlocker.go
@@ -20,11 +20,11 @@ import (
 var (
 	// GPGEncryptFunc is the function used for GPG encryption
 	// Can be overridden in tests to provide a non-interactive implementation
-	GPGEncryptFunc = gpgEncryptDefault
+	GPGEncryptFunc = gpgEncryptDefault //nolint:gochecknoglobals // Required for test mocking
 
 	// GPGDecryptFunc is the function used for GPG decryption
 	// Can be overridden in tests to provide a non-interactive implementation
-	GPGDecryptFunc = gpgDecryptDefault
+	GPGDecryptFunc = gpgDecryptDefault //nolint:gochecknoglobals // Required for test mocking
 
 	// gpgKeyIDRegex validates GPG key IDs
 	// Allows either:
diff --git a/internal/secret/secret.go b/internal/secret/secret.go
index c5b95c5..8a8d70e 100644
--- a/internal/secret/secret.go
+++ b/internal/secret/secret.go
@@ -286,7 +286,7 @@ func GetCurrentVault(fs afero.Fs, stateDir string) (VaultInterface, error) {
 
 // getCurrentVaultFunc is a function variable that will be set by the vault package
 // to implement the actual GetCurrentVault functionality
-var getCurrentVaultFunc func(fs afero.Fs, stateDir string) (VaultInterface, error)
+var getCurrentVaultFunc func(fs afero.Fs, stateDir string) (VaultInterface, error) //nolint:gochecknoglobals // Required to break import cycle
 
 // RegisterGetCurrentVaultFunc allows the vault package to register its implementation
 // of GetCurrentVault to break the import cycle