diff --git a/client/internal/captcha/slider.go b/client/internal/captcha/slider.go
index 09bcaac..f9659bb 100644
--- a/client/internal/captcha/slider.go
+++ b/client/internal/captcha/slider.go
@@ -8,7 +8,7 @@ import (
 	"fmt"
 	"image"
 	"image/color"
-	_ "image/jpeg"
+	_ "image/jpeg" // register JPEG decoder for image.Decode
 	"log"
 	"math"
 	mathrand "math/rand"
diff --git a/client/internal/namegen/namegen_test.go b/client/internal/namegen/namegen_test.go
index 98076de..1a82029 100644
--- a/client/internal/namegen/namegen_test.go
+++ b/client/internal/namegen/namegen_test.go
@@ -143,7 +143,7 @@ func TestGenerateCoversBothGenders(t *testing.T) {
 	}
 
 	sawMale, sawFemale := false, false
-	for i := 0; i < 5000 && !(sawMale && sawFemale); i++ { //nolint:intrange // need early exit
+	for i := 0; i < 5000 && (!sawMale || !sawFemale); i++ { //nolint:intrange // need early exit
 		n := Generate()
 		first := strings.SplitN(n, " ", 2)[0]
 		if maleSet[first] {
diff --git a/client/wrap_test.go b/client/wrap_test.go
index 0cf9cbe..a2ad9d5 100644
--- a/client/wrap_test.go
+++ b/client/wrap_test.go
@@ -60,7 +60,10 @@ func TestWrapConnRoundTrip(t *testing.T) {
 
 func TestWrapPrefixLenInRange(t *testing.T) {
 	key := bytes.Repeat([]byte{0x42}, wrapKeyLen)
-	wc, _ := newWrapConn(key, false)
+	wc, err := newWrapConn(key, false)
+	if err != nil {
+		t.Fatalf("newWrapConn: %v", err)
+	}
 	payload := []byte("x")
 
 	// Run many trials; every prefix_len must fall in [1..8].
@@ -83,8 +86,14 @@ func TestWrapPrefixLenInRange(t *testing.T) {
 
 func TestWrapDirectionBit(t *testing.T) {
 	key := bytes.Repeat([]byte{0x42}, wrapKeyLen)
-	client, _ := newWrapConn(key, false)
-	server, _ := newWrapConn(key, true)
+	client, err := newWrapConn(key, false)
+	if err != nil {
+		t.Fatalf("newWrapConn(client): %v", err)
+	}
+	server, err := newWrapConn(key, true)
+	if err != nil {
+		t.Fatalf("newWrapConn(server): %v", err)
+	}
 
 	if client.sessionID[0]&0x80 != 0 {
 		t.Fatalf("client sessionID MSB should be 0, got 0x%02X", client.sessionID[0])
@@ -120,7 +129,10 @@ func TestDecodeWrapKeyRequiresValidKeyWhenEnabled(t *testing.T) {
 
 func TestUnwrapRejectsShortPacket(t *testing.T) {
 	key := bytes.Repeat([]byte{0x42}, wrapKeyLen)
-	wc, _ := newWrapConn(key, false)
+	wc, err := newWrapConn(key, false)
+	if err != nil {
+		t.Fatalf("newWrapConn: %v", err)
+	}
 	if _, err := wc.unwrapPacket([]byte("short"), make([]byte, 16)); err == nil {
 		t.Fatalf("unwrapPacket accepted short packet")
 	}
@@ -128,12 +140,21 @@ func TestUnwrapRejectsShortPacket(t *testing.T) {
 
 func TestUnwrapRejectsTamperedPacket(t *testing.T) {
 	key := bytes.Repeat([]byte{0x42}, wrapKeyLen)
-	client, _ := newWrapConn(key, false)
-	server, _ := newWrapConn(key, true)
+	client, err := newWrapConn(key, false)
+	if err != nil {
+		t.Fatalf("newWrapConn(client): %v", err)
+	}
+	server, err := newWrapConn(key, true)
+	if err != nil {
+		t.Fatalf("newWrapConn(server): %v", err)
+	}
 
 	payload := []byte("integrity test")
 	wire := make([]byte, wrapMaxWire(len(payload)))
-	n, _ := client.wrapInto(wire, payload)
+	n, err := client.wrapInto(wire, payload)
+	if err != nil {
+		t.Fatalf("wrapInto: %v", err)
+	}
 	wire = wire[:n]
 
 	// Flip a bit in the ciphertext (past prefix+nonce).
diff --git a/server/wrap.go b/server/wrap.go
index 8f7738c..81b43be 100644
--- a/server/wrap.go
+++ b/server/wrap.go
@@ -107,7 +107,7 @@ type wrapPacketConn struct {
 }
 
 func (c *wrapPacketConn) ReadFrom(p []byte) (int, net.Addr, error) {
-	bp := bufPool.Get().(*[]byte)
+	bp := bufPool.Get().(*[]byte) //nolint:errcheck // pool New always returns *[]byte
 	buf := *bp
 	need := len(p) + wrapPrefixMax + wrapNonceLen + wrapTagLen
 	if cap(buf) < need {
@@ -150,7 +150,7 @@ func (c *wrapPacketConn) WriteTo(p []byte, addr net.Addr) (int, error) {
 	prefixLen := wrapPrefixMin + int(hdr[0]&0x07)
 	wireLen := prefixLen + wrapNonceLen + len(p) + wrapTagLen
 
-	bp := bufPool.Get().(*[]byte)
+	bp := bufPool.Get().(*[]byte) //nolint:errcheck // pool New always returns *[]byte
 	out := *bp
 	if cap(out) < wireLen {
 		out = make([]byte, wireLen)