diff --git a/internal/api/deployments.go b/internal/api/deployments.go
index bade9ddd..56cbd1dd 100644
--- a/internal/api/deployments.go
+++ b/internal/api/deployments.go
@@ -126,7 +126,7 @@ type PullStepGitClone struct {
 	Branch *string `json:"branch,omitempty"`
 
 	// Access token for the repository.
-	AccessToken *string `json:"access_token,omitempty"`
+	AccessToken *string `json:"access_token,omitempty"` //nolint:gosec // this is a JSON field name, not a credential
 
 	// IncludeSubmodules determines whether to include submodules when cloning the repository.
 	IncludeSubmodules *bool `json:"include_submodules,omitempty"`
diff --git a/internal/client/client.go b/internal/client/client.go
index b45aa806..ba5503b7 100644
--- a/internal/client/client.go
+++ b/internal/client/client.go
@@ -86,7 +86,7 @@ func (c *Client) obtainCsrfToken() error {
 		req.Header.Set(key, value)
 	}
 
-	resp, err := c.hc.Do(req)
+	resp, err := c.hc.Do(req) //nolint:gosec // URL is constructed from provider configuration, not user input
 	if err != nil {
 		return fmt.Errorf("http error on CSRF token request: %w", err)
 	}
diff --git a/internal/client/util.go b/internal/client/util.go
index 0abc39e1..456e7e8b 100644
--- a/internal/client/util.go
+++ b/internal/client/util.go
@@ -167,7 +167,7 @@ func request(ctx context.Context, client *http.Client, cfg requestConfig) (*http
 	setDefaultHeaders(req, cfg.apiKey, cfg.basicAuthKey, cfg.csrfClientToken, cfg.csrfToken, cfg.customHeaders)
 
 	// Body will be closed by the caller.
-	resp, err := client.Do(req)
+	resp, err := client.Do(req) //nolint:gosec // URL is constructed from provider configuration, not user input
 	if err != nil {
 		return nil, fmt.Errorf("http error: %w", err)
 	}
diff --git a/scripts/compare.go b/scripts/compare.go
index 845009b2..bd282945 100644
--- a/scripts/compare.go
+++ b/scripts/compare.go
@@ -181,7 +181,7 @@ func request() result {
 		log.Printf("Error creating request: %v", err)
 	}
 
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := http.DefaultClient.Do(req) //nolint:gosec // URL is a known API endpoint from command-line args
 	if err != nil {
 		log.Printf("Error getting openapi.json: %v", err)
 	}