diff --git a/cli/cliflag/cliflag_test.go b/cli/cliflag/cliflag_test.go
index 042fd04..7e9d1cc 100644
--- a/cli/cliflag/cliflag_test.go
+++ b/cli/cliflag/cliflag_test.go
@@ -113,9 +113,11 @@ func TestCliflag(t *testing.T) {
 		flagset, name, shorthand, env, usage := randomFlag()
 		def, _ := cryptorand.Intn(10)
 
+		//nolint:gosec
 		cliflag.Uint8VarP(flagset, &ptr, name, shorthand, env, uint8(def), usage)
 		got, err := flagset.GetUint8(name)
 		require.NoError(t, err)
+		//nolint:gosec
 		require.Equal(t, uint8(def), got)
 		require.Contains(t, flagset.FlagUsages(), usage)
 		require.Contains(t, flagset.FlagUsages(), fmt.Sprintf("Consumes $%s", env))
@@ -125,12 +127,14 @@ func TestCliflag(t *testing.T) {
 		var ptr uint8
 		flagset, name, shorthand, env, usage := randomFlag()
 		envValue, _ := cryptorand.Intn(10)
+		//nolint:gosec
 		t.Setenv(env, strconv.FormatUint(uint64(envValue), 10))
 		def, _ := cryptorand.Intn(10)
 
 		cliflag.Uint8VarP(flagset, &ptr, name, shorthand, env, uint8(def), usage)
 		got, err := flagset.GetUint8(name)
 		require.NoError(t, err)
+		//nolint:gosec
 		require.Equal(t, uint8(envValue), got)
 	})
 
@@ -141,9 +145,11 @@ func TestCliflag(t *testing.T) {
 		t.Setenv(env, envValue)
 		def, _ := cryptorand.Intn(10)
 
+		//nolint:gosec
 		cliflag.Uint8VarP(flagset, &ptr, name, shorthand, env, uint8(def), usage)
 		got, err := flagset.GetUint8(name)
 		require.NoError(t, err)
+		//nolint:gosec
 		require.Equal(t, uint8(def), got)
 	})
 
@@ -164,6 +170,7 @@ func TestCliflag(t *testing.T) {
 		var ptr int
 		flagset, name, shorthand, env, usage := randomFlag()
 		envValue, _ := cryptorand.Intn(10)
+		//nolint:gosec
 		t.Setenv(env, strconv.FormatUint(uint64(envValue), 10))
 		def, _ := cryptorand.Intn(10)
 
diff --git a/dockerutil/network.go b/dockerutil/network.go
index 7c613a9..158181c 100644
--- a/dockerutil/network.go
+++ b/dockerutil/network.go
@@ -36,6 +36,7 @@ func mustNextIPv4(ip net.IP, inc int) net.IP {
 	v += uint32(ip4[1]) << 16
 	v += uint32(ip4[2]) << 8
 	v += uint32(ip4[3])
+	//nolint:gosec
 	v += uint32(inc)
 	v3 := byte(v & 0xFF)
 	v2 := byte((v >> 8) & 0xFF)
diff --git a/xunix/device.go b/xunix/device.go
index e7c3332..0392af0 100644
--- a/xunix/device.go
+++ b/xunix/device.go
@@ -109,6 +109,7 @@ func createDevice(ctx context.Context, conf deviceConfig) error {
 		return xerrors.Errorf("ensure parent dir: %w", err)
 	}
 
+	//nolint:gosec
 	err = fs.Mknod(conf.path, conf.ftype|conf.mode, int(conf.dev))
 	if err != nil {
 		return xerrors.Errorf("mknod %s c %d %d: %w", conf.path, conf.major, conf.minor, err)