diff --git a/cmd/olcrtc/main.go b/cmd/olcrtc/main.go
index 363154e..3ce6bc2 100644
--- a/cmd/olcrtc/main.go
+++ b/cmd/olcrtc/main.go
@@ -25,10 +25,8 @@ const modeGen = "gen"
 // ErrDataDirRequired is returned when no data directory is specified.
 var ErrDataDirRequired = errors.New("data directory required (use -data data)")
 
-//nolint:gochecknoglobals // Tests replace the long-running session runner with a bounded function.
 var runSession = session.Run
 
-//nolint:gochecknoglobals // Tests replace gen runner with a stub.
 var runGen = execGen
 
 type config struct {
diff --git a/cmd/olcrtc/main_test.go b/cmd/olcrtc/main_test.go
index fb55c44..6d80b61 100644
--- a/cmd/olcrtc/main_test.go
+++ b/cmd/olcrtc/main_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package main
 
 import (
diff --git a/internal/app/session/session_test.go b/internal/app/session/session_test.go
index dfd9e91..cc8f1a3 100644
--- a/internal/app/session/session_test.go
+++ b/internal/app/session/session_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package session
 
 import (
diff --git a/internal/carrier/builtin/provider_adapter_test.go b/internal/carrier/builtin/provider_adapter_test.go
index 864bd84..908b27f 100644
--- a/internal/carrier/builtin/provider_adapter_test.go
+++ b/internal/carrier/builtin/provider_adapter_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package builtin
 
 import (
diff --git a/internal/carrier/carrier.go b/internal/carrier/carrier.go
index 04bf68c..9c70261 100644
--- a/internal/carrier/carrier.go
+++ b/internal/carrier/carrier.go
@@ -49,7 +49,6 @@ type Config struct {
 // Factory creates a new carrier session.
 type Factory func(ctx context.Context, cfg Config) (Session, error)
 
-//nolint:gochecknoglobals
 var registry = make(map[string]Factory)
 
 // Register adds a carrier factory to the registry.
diff --git a/internal/client/client_test.go b/internal/client/client_test.go
index 9ddd79f..f27823e 100644
--- a/internal/client/client_test.go
+++ b/internal/client/client_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package client
 
 import (
diff --git a/internal/e2e/tunnel_test.go b/internal/e2e/tunnel_test.go
index b81d5ab..d73cde7 100644
--- a/internal/e2e/tunnel_test.go
+++ b/internal/e2e/tunnel_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package e2e
 
 import (
diff --git a/internal/link/direct/direct_test.go b/internal/link/direct/direct_test.go
index 7d93390..ffe291c 100644
--- a/internal/link/direct/direct_test.go
+++ b/internal/link/direct/direct_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package direct
 
 import (
diff --git a/internal/link/link.go b/internal/link/link.go
index 29e39c9..69f49b1 100644
--- a/internal/link/link.go
+++ b/internal/link/link.go
@@ -55,7 +55,6 @@ type Config struct {
 // Factory creates a link instance.
 type Factory func(ctx context.Context, cfg Config) (Link, error)
 
-//nolint:gochecknoglobals
 var registry = make(map[string]Factory)
 
 // Register adds a link factory to the registry.
diff --git a/internal/link/link_test.go b/internal/link/link_test.go
index 94b24d9..b53dd38 100644
--- a/internal/link/link_test.go
+++ b/internal/link/link_test.go
@@ -9,14 +9,14 @@ import (
 
 type stubLink struct{}
 
-func (s *stubLink) Connect(context.Context) error           { return nil }
-func (s *stubLink) Send([]byte) error                       { return nil }
-func (s *stubLink) Close() error                            { return nil }
-func (s *stubLink) SetReconnectCallback(func())             {}
-func (s *stubLink) SetShouldReconnect(func() bool)          {}
-func (s *stubLink) SetEndedCallback(func(string))           {}
-func (s *stubLink) WatchConnection(context.Context)         {}
-func (s *stubLink) CanSend() bool                           { return true }
+func (s *stubLink) Connect(context.Context) error   { return nil }
+func (s *stubLink) Send([]byte) error               { return nil }
+func (s *stubLink) Close() error                    { return nil }
+func (s *stubLink) SetReconnectCallback(func())     {}
+func (s *stubLink) SetShouldReconnect(func() bool)  {}
+func (s *stubLink) SetEndedCallback(func(string))   {}
+func (s *stubLink) WatchConnection(context.Context) {}
+func (s *stubLink) CanSend() bool                   { return true }
 
 func snapshotLinkRegistry() map[string]Factory {
 	out := make(map[string]Factory, len(registry))
diff --git a/internal/logger/logger.go b/internal/logger/logger.go
index 3510e57..0f6cb7c 100644
--- a/internal/logger/logger.go
+++ b/internal/logger/logger.go
@@ -7,8 +7,6 @@ import (
 )
 
 // verboseEnabled controls whether verbose and debug logging is enabled.
-//
-//nolint:gochecknoglobals // Global log state is acceptable for CLI tools.
 var verboseEnabled atomic.Bool
 
 // SetVerbose enables or disables verbose/debug logging.
diff --git a/internal/muxconn/conn_test.go b/internal/muxconn/conn_test.go
index f63d00f..f628e1f 100644
--- a/internal/muxconn/conn_test.go
+++ b/internal/muxconn/conn_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package muxconn
 
 import (
diff --git a/internal/names/names.go b/internal/names/names.go
index f859d1b..ba043e5 100644
--- a/internal/names/names.go
+++ b/internal/names/names.go
@@ -17,7 +17,6 @@ var embeddedNames string
 //go:embed data/surnames
 var embeddedSurnames string
 
-//nolint:gochecknoglobals // Package-level state keeps the loaded name dictionaries cached for the process lifetime.
 var (
 	firstNames = parseEmbedded(embeddedNames)
 	lastNames  = parseEmbedded(embeddedSurnames)
@@ -36,7 +35,6 @@ func parseEmbedded(raw string) []string {
 }
 
 func loadNames(path string) ([]string, error) {
-	//nolint:gosec // Paths come from local CLI/runtime configuration; loading override files is intentional here.
 	file, err := os.Open(path)
 	if err != nil {
 		return nil, fmt.Errorf("open names file %q: %w", path, err)
diff --git a/internal/names/names_test.go b/internal/names/names_test.go
index b925652..b8cdb38 100644
--- a/internal/names/names_test.go
+++ b/internal/names/names_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package names
 
 import (
diff --git a/internal/protect/protect.go b/internal/protect/protect.go
index 87096cd..88bd23d 100644
--- a/internal/protect/protect.go
+++ b/internal/protect/protect.go
@@ -12,7 +12,7 @@ import (
 
 // Protector is called with a socket file descriptor before connect.
 // On Android, this calls VpnService.protect(fd) to bypass VPN routing.
-var Protector func(fd int) bool //nolint:gochecknoglobals
+var Protector func(fd int) bool
 
 func controlFunc(network, _ string, c syscall.RawConn) error {
 	if Protector == nil {
@@ -47,7 +47,7 @@ func NewHTTPClient() *http.Client {
 		ForceAttemptHTTP2:     true,
 		MaxIdleConns:          10,
 		IdleConnTimeout:       30 * time.Second,
-		TLSHandshakeTimeout:  10 * time.Second,
+		TLSHandshakeTimeout:   10 * time.Second,
 		ResponseHeaderTimeout: 10 * time.Second,
 	}
 	return &http.Client{Transport: transport}
@@ -78,4 +78,3 @@ func (d *ProxyDialer) Dial(network, addr string) (net.Conn, error) {
 func NewProxyDialer() *ProxyDialer {
 	return &ProxyDialer{}
 }
-
diff --git a/internal/protect/protect_test.go b/internal/protect/protect_test.go
index a55b6be..dc14c9b 100644
--- a/internal/protect/protect_test.go
+++ b/internal/protect/protect_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package protect
 
 import (
diff --git a/internal/provider/jazz/api.go b/internal/provider/jazz/api.go
index 4987249..6c291e0 100644
--- a/internal/provider/jazz/api.go
+++ b/internal/provider/jazz/api.go
@@ -20,7 +20,7 @@ const (
 	contentTypeJSON   = "application/json"
 )
 
-var apiBase = "https://bk.salutejazz.ru" //nolint:gochecknoglobals // Tests redirect HTTP API calls to httptest.
+var apiBase = "https://bk.salutejazz.ru"
 
 // RoomInfo contains connection details for a SaluteJazz room.
 type RoomInfo struct {
diff --git a/internal/provider/jazz/api_test.go b/internal/provider/jazz/api_test.go
index 545cb5b..65ac7c3 100644
--- a/internal/provider/jazz/api_test.go
+++ b/internal/provider/jazz/api_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package jazz
 
 import (
diff --git a/internal/provider/jazz/datapacket.go b/internal/provider/jazz/datapacket.go
index 6899287..4f276f1 100644
--- a/internal/provider/jazz/datapacket.go
+++ b/internal/provider/jazz/datapacket.go
@@ -16,7 +16,7 @@ func encodeVarint(value uint64) []byte {
 }
 
 func encodeField(fieldNumber int, wireType int, data []byte) []byte {
-	tag := encodeVarint(uint64(fieldNumber)<<3 | uint64(wireType)) //nolint:gosec
+	tag := encodeVarint(uint64(fieldNumber)<<3 | uint64(wireType))
 	switch wireType {
 	case 2:
 		length := encodeVarint(uint64(len(data)))
@@ -101,12 +101,12 @@ func handleWireType(reader *byteReader, wireType int, dataLen int) ([]byte, bool
 		if err != nil {
 			return nil, false
 		}
-		if length > uint64(dataLen)-uint64(reader.pos) { //nolint:gosec
+		if length > uint64(dataLen)-uint64(reader.pos) {
 			return nil, false
 		}
 		fieldData := make([]byte, length)
 		n, err := reader.Read(fieldData)
-		if err != nil || uint64(n) != length { //nolint:gosec
+		if err != nil || uint64(n) != length {
 			return nil, false
 		}
 		return fieldData, true
diff --git a/internal/provider/jazz/peer_helpers_test.go b/internal/provider/jazz/peer_helpers_test.go
index 12341b8..24729fc 100644
--- a/internal/provider/jazz/peer_helpers_test.go
+++ b/internal/provider/jazz/peer_helpers_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package jazz
 
 import (
diff --git a/internal/provider/telemost/api.go b/internal/provider/telemost/api.go
index 5ce63ad..32118e7 100644
--- a/internal/provider/telemost/api.go
+++ b/internal/provider/telemost/api.go
@@ -13,21 +13,20 @@ import (
 	"github.com/openlibrecommunity/olcrtc/internal/protect"
 )
 
-//nolint:gochecknoglobals // Tests redirect HTTP API calls to httptest.
 var apiBase = "https://cloud-api.yandex.ru/telemost_front/v2/telemost"
 
-var ErrAPI = errors.New("api error") //nolint:revive
+var ErrAPI = errors.New("api error")
 
-type ConnectionInfo struct { //nolint:revive
-	RoomID       string `json:"room_id"`     //nolint:tagliatelle
-	PeerID       string `json:"peer_id"`     //nolint:tagliatelle
-	Credentials  string `json:"credentials"` //nolint:tagliatelle
+type ConnectionInfo struct {
+	RoomID       string `json:"room_id"`
+	PeerID       string `json:"peer_id"`
+	Credentials  string `json:"credentials"`
 	ClientConfig struct {
-		MediaServerURL string `json:"media_server_url"` //nolint:tagliatelle
-	} `json:"client_configuration"` //nolint:tagliatelle
+		MediaServerURL string `json:"media_server_url"`
+	} `json:"client_configuration"`
 }
 
-func GetConnectionInfo(ctx context.Context, roomURL, displayName string) (*ConnectionInfo, error) { //nolint:revive
+func GetConnectionInfo(ctx context.Context, roomURL, displayName string) (*ConnectionInfo, error) {
 	u := fmt.Sprintf("%s/conferences/%s/connection", apiBase, url.QueryEscape(roomURL))
 
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u, nil)
diff --git a/internal/provider/telemost/api_test.go b/internal/provider/telemost/api_test.go
index b4c89b6..d072cfc 100644
--- a/internal/provider/telemost/api_test.go
+++ b/internal/provider/telemost/api_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package telemost
 
 import (
diff --git a/internal/provider/telemost/peer.go b/internal/provider/telemost/peer.go
index 608c6d2..eabb1c9 100644
--- a/internal/provider/telemost/peer.go
+++ b/internal/provider/telemost/peer.go
@@ -1469,7 +1469,6 @@ func (p *Peer) calculateDelay() time.Duration {
 	if maxDelay <= minDelay {
 		return minDelay
 	}
-	//nolint:gosec
 	return minDelay + time.Duration(rand.Int64N(int64(maxDelay-minDelay)))
 }
 
diff --git a/internal/provider/telemost/peer_helpers_test.go b/internal/provider/telemost/peer_helpers_test.go
index a62cab3..2c9d6f4 100644
--- a/internal/provider/telemost/peer_helpers_test.go
+++ b/internal/provider/telemost/peer_helpers_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package telemost
 
 import (
diff --git a/internal/provider/telemost/provider_test.go b/internal/provider/telemost/provider_test.go
index ec6aa51..d70c4e4 100644
--- a/internal/provider/telemost/provider_test.go
+++ b/internal/provider/telemost/provider_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package telemost
 
 import (
diff --git a/internal/provider/telemost/state_helpers_test.go b/internal/provider/telemost/state_helpers_test.go
index 26a32e9..f072429 100644
--- a/internal/provider/telemost/state_helpers_test.go
+++ b/internal/provider/telemost/state_helpers_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package telemost
 
 import (
diff --git a/internal/provider/wbstream/api.go b/internal/provider/wbstream/api.go
index 9f4a2f1..540745e 100644
--- a/internal/provider/wbstream/api.go
+++ b/internal/provider/wbstream/api.go
@@ -12,7 +12,7 @@ import (
 	"github.com/openlibrecommunity/olcrtc/internal/protect"
 )
 
-var apiBase = "https://stream.wb.ru" //nolint:gochecknoglobals // Tests redirect HTTP API calls to httptest.
+var apiBase = "https://stream.wb.ru"
 
 var (
 	errGuestRegister = errors.New("guest register failed")
diff --git a/internal/provider/wbstream/api_test.go b/internal/provider/wbstream/api_test.go
index 732f429..99ef8b1 100644
--- a/internal/provider/wbstream/api_test.go
+++ b/internal/provider/wbstream/api_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package wbstream
 
 import (
diff --git a/internal/provider/wbstream/peer_test.go b/internal/provider/wbstream/peer_test.go
index c7eedfc..17a7df4 100644
--- a/internal/provider/wbstream/peer_test.go
+++ b/internal/provider/wbstream/peer_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package wbstream
 
 import (
diff --git a/internal/provider/wbstream/provider_test.go b/internal/provider/wbstream/provider_test.go
index cb2eee0..f33f6f7 100644
--- a/internal/provider/wbstream/provider_test.go
+++ b/internal/provider/wbstream/provider_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package wbstream
 
 import (
diff --git a/internal/server/server.go b/internal/server/server.go
index b7b1be9..c83c94b 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -481,7 +481,7 @@ func (s *Server) socks5Connect(conn net.Conn, targetAddr string, targetPort int)
 	req := make([]byte, 0, 7+addrLen)
 	req = append(req, 5, 1, 0, 3, byte(addrLen))
 	req = append(req, []byte(targetAddr)...)
-	req = append(req, byte(targetPort>>8), byte(targetPort)) //nolint:gosec
+	req = append(req, byte(targetPort>>8), byte(targetPort))
 
 	if _, err := conn.Write(req); err != nil {
 		return fmt.Errorf("failed to write socks5 connect req: %w", err)
diff --git a/internal/server/server_test.go b/internal/server/server_test.go
index 5d2bbab..3717d9d 100644
--- a/internal/server/server_test.go
+++ b/internal/server/server_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package server
 
 import (
diff --git a/internal/transport/datachannel/transport_test.go b/internal/transport/datachannel/transport_test.go
index e279078..68d9efa 100644
--- a/internal/transport/datachannel/transport_test.go
+++ b/internal/transport/datachannel/transport_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package datachannel
 
 import (
diff --git a/internal/transport/seichannel/h264.go b/internal/transport/seichannel/h264.go
index cd3d623..b1f8892 100644
--- a/internal/transport/seichannel/h264.go
+++ b/internal/transport/seichannel/h264.go
@@ -16,7 +16,6 @@ var (
 	ErrSEIValueTruncated = errors.New("sei value truncated")
 )
 
-//nolint:gochecknoglobals
 var (
 	videoSEIUUID = [16]byte{
 		0x5d, 0xc0, 0x3b, 0xa8,
@@ -135,7 +134,7 @@ func appendSEIValue(dst []byte, value int) []byte {
 		dst = append(dst, 0xff)
 		value -= 0xff
 	}
-	return append(dst, byte(value)) //nolint:gosec
+	return append(dst, byte(value))
 }
 
 func consumeSEIValue(data []byte, pos int) (int, int, error) {
diff --git a/internal/transport/seichannel/inbound_test.go b/internal/transport/seichannel/inbound_test.go
index 29fd434..31b54ae 100644
--- a/internal/transport/seichannel/inbound_test.go
+++ b/internal/transport/seichannel/inbound_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package seichannel
 
 import (
diff --git a/internal/transport/seichannel/transport.go b/internal/transport/seichannel/transport.go
index e832904..02e9c32 100644
--- a/internal/transport/seichannel/transport.go
+++ b/internal/transport/seichannel/transport.go
@@ -471,7 +471,7 @@ func (p *streamTransport) assembleMessage(msg *inboundMessage) []byte {
 	for _, frag := range msg.frags {
 		data = append(data, frag...)
 	}
-	if uint32(len(data)) > msg.totalLen { //nolint:gosec
+	if uint32(len(data)) > msg.totalLen {
 		data = data[:msg.totalLen]
 	}
 	return data
@@ -557,9 +557,9 @@ func encodeDataFrame(seq, crc uint32, totalLen, fragIdx, fragTotal int, payload
 	out[5] = frameTypeData
 	binary.BigEndian.PutUint32(out[6:10], seq)
 	binary.BigEndian.PutUint32(out[10:14], crc)
-	binary.BigEndian.PutUint32(out[14:18], uint32(totalLen))  //nolint:gosec
-	binary.BigEndian.PutUint16(out[18:20], uint16(fragIdx))   //nolint:gosec
-	binary.BigEndian.PutUint16(out[20:22], uint16(fragTotal)) //nolint:gosec
+	binary.BigEndian.PutUint32(out[14:18], uint32(totalLen))
+	binary.BigEndian.PutUint16(out[18:20], uint16(fragIdx))
+	binary.BigEndian.PutUint16(out[20:22], uint16(fragTotal))
 	copy(out[22:], payload)
 	return out
 }
diff --git a/internal/transport/seichannel/transport_unit_test.go b/internal/transport/seichannel/transport_unit_test.go
index 5626349..9ea68f2 100644
--- a/internal/transport/seichannel/transport_unit_test.go
+++ b/internal/transport/seichannel/transport_unit_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package seichannel
 
 import (
diff --git a/internal/transport/transport.go b/internal/transport/transport.go
index 7c9d5e8..7c36473 100644
--- a/internal/transport/transport.go
+++ b/internal/transport/transport.go
@@ -63,7 +63,6 @@ type Config struct {
 // Factory creates a transport instance.
 type Factory func(ctx context.Context, cfg Config) (Transport, error)
 
-//nolint:gochecknoglobals
 var registry = make(map[string]Factory)
 
 // Register adds a transport factory to the registry.
diff --git a/internal/transport/videochannel/ffmpeg.go b/internal/transport/videochannel/ffmpeg.go
index f43ef56..53b13dc 100644
--- a/internal/transport/videochannel/ffmpeg.go
+++ b/internal/transport/videochannel/ffmpeg.go
@@ -202,7 +202,7 @@ func newFFmpegEncoder(
 	vcodec := resolveEncoderCodec(spec, hw)
 	args := buildEncoderArgs(spec, vcodec, width, height, fps, bitrate)
 
-	cmd := exec.CommandContext(ctx, "ffmpeg", args...) //nolint:gosec
+	cmd := exec.CommandContext(ctx, "ffmpeg", args...)
 	stdin, err := cmd.StdinPipe()
 	if err != nil {
 		return nil, fmt.Errorf("encoder stdin: %w", err)
@@ -404,7 +404,7 @@ func newFFmpegDecoder(
 	decoderName := resolveDecoderName(spec, hw)
 	args := buildDecoderArgs(spec, decoderName, width, height, "gray")
 
-	cmd := exec.CommandContext(ctx, "ffmpeg", args...) //nolint:gosec
+	cmd := exec.CommandContext(ctx, "ffmpeg", args...)
 	stdin, err := cmd.StdinPipe()
 	if err != nil {
 		return nil, fmt.Errorf("decoder stdin: %w", err)
@@ -539,9 +539,9 @@ func writeIVFHeader(w io.Writer, fourCC string, width, height, frameRate int) er
 	binary.LittleEndian.PutUint16(header[4:6], 0)
 	binary.LittleEndian.PutUint16(header[6:8], 32)
 	copy(header[8:12], []byte(fourCC))
-	binary.LittleEndian.PutUint16(header[12:14], uint16(width))     //nolint:gosec
-	binary.LittleEndian.PutUint16(header[14:16], uint16(height))    //nolint:gosec
-	binary.LittleEndian.PutUint32(header[16:20], uint32(frameRate)) //nolint:gosec
+	binary.LittleEndian.PutUint16(header[12:14], uint16(width))
+	binary.LittleEndian.PutUint16(header[14:16], uint16(height))
+	binary.LittleEndian.PutUint32(header[16:20], uint32(frameRate))
 	binary.LittleEndian.PutUint32(header[20:24], 1)
 	binary.LittleEndian.PutUint32(header[24:28], 0)
 	binary.LittleEndian.PutUint32(header[28:32], 0)
@@ -550,7 +550,7 @@ func writeIVFHeader(w io.Writer, fourCC string, width, height, frameRate int) er
 
 func writeIVFFrame(w io.Writer, pts uint64, frame []byte) error {
 	header := make([]byte, 12)
-	binary.LittleEndian.PutUint32(header[0:4], uint32(len(frame))) //nolint:gosec
+	binary.LittleEndian.PutUint32(header[0:4], uint32(len(frame)))
 	binary.LittleEndian.PutUint64(header[4:12], pts)
 	if err := writeAll(w, header); err != nil {
 		return err
diff --git a/internal/transport/videochannel/frame.go b/internal/transport/videochannel/frame.go
index 8f3e316..5a4f908 100644
--- a/internal/transport/videochannel/frame.go
+++ b/internal/transport/videochannel/frame.go
@@ -71,9 +71,9 @@ func encodeDataFrame(seq, crc uint32, totalLen, fragIdx, fragTotal int, payload
 	out[5] = frameTypeData
 	binary.BigEndian.PutUint32(out[6:10], seq)
 	binary.BigEndian.PutUint32(out[10:14], crc)
-	binary.BigEndian.PutUint32(out[14:18], uint32(totalLen))  //nolint:gosec
-	binary.BigEndian.PutUint16(out[18:20], uint16(fragIdx))   //nolint:gosec
-	binary.BigEndian.PutUint16(out[20:22], uint16(fragTotal)) //nolint:gosec
+	binary.BigEndian.PutUint32(out[14:18], uint32(totalLen))
+	binary.BigEndian.PutUint16(out[18:20], uint16(fragIdx))
+	binary.BigEndian.PutUint16(out[20:22], uint16(fragTotal))
 	copy(out[22:], payload)
 	return out
 }
diff --git a/internal/transport/videochannel/frame_extra_test.go b/internal/transport/videochannel/frame_extra_test.go
index e2d16ac..e55b960 100644
--- a/internal/transport/videochannel/frame_extra_test.go
+++ b/internal/transport/videochannel/frame_extra_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package videochannel
 
 import (
diff --git a/internal/transport/videochannel/inbound_test.go b/internal/transport/videochannel/inbound_test.go
index 3d17659..6a76c72 100644
--- a/internal/transport/videochannel/inbound_test.go
+++ b/internal/transport/videochannel/inbound_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package videochannel
 
 import (
diff --git a/internal/transport/videochannel/transport.go b/internal/transport/videochannel/transport.go
index dc91c77..5076c0d 100644
--- a/internal/transport/videochannel/transport.go
+++ b/internal/transport/videochannel/transport.go
@@ -70,7 +70,7 @@ type streamTransport struct {
 	videoCodec      string
 	videoTileModule int
 	videoTileRS     int
-	runCtx          context.Context //nolint:containedctx
+	runCtx          context.Context
 
 	idleFrame   []byte
 	idleFrameMu sync.Mutex
@@ -571,7 +571,7 @@ func (p *streamTransport) assembleMessage(msg *inboundMessage) []byte {
 	for _, frag := range msg.frags {
 		data = append(data, frag...)
 	}
-	if uint32(len(data)) > msg.totalLen { //nolint:gosec
+	if uint32(len(data)) > msg.totalLen {
 		data = data[:msg.totalLen]
 	}
 	return data
diff --git a/internal/transport/videochannel/transport_unit_test.go b/internal/transport/videochannel/transport_unit_test.go
index 6af613a..3a257a3 100644
--- a/internal/transport/videochannel/transport_unit_test.go
+++ b/internal/transport/videochannel/transport_unit_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package videochannel
 
 import (
diff --git a/internal/transport/videochannel/visual.go b/internal/transport/videochannel/visual.go
index cff3964..8339d93 100644
--- a/internal/transport/videochannel/visual.go
+++ b/internal/transport/videochannel/visual.go
@@ -129,7 +129,7 @@ func extractTilePayload(frame []byte, tileModule, tileRS int) ([]byte, error) {
 
 	result, err := c.Decode(frame)
 	if err != nil {
-		return nil, nil //nolint:nilerr
+		return nil, nil
 	}
 
 	return result.Payload, nil
diff --git a/internal/transport/vp8channel/kcp.go b/internal/transport/vp8channel/kcp.go
index d4486e4..d6c2208 100644
--- a/internal/transport/vp8channel/kcp.go
+++ b/internal/transport/vp8channel/kcp.go
@@ -134,7 +134,6 @@ func (r *kcpRuntime) send(msg []byte) error {
 		return ErrKCPMessageTooLarge
 	}
 	var hdr [kcpLenPrefix]byte
-	//nolint:gosec
 	binary.BigEndian.PutUint32(hdr[:], uint32(len(msg)))
 
 	r.writeMu.Lock()
diff --git a/internal/transport/vp8channel/kcpconn_test.go b/internal/transport/vp8channel/kcpconn_test.go
index d7b6761..00aed97 100644
--- a/internal/transport/vp8channel/kcpconn_test.go
+++ b/internal/transport/vp8channel/kcpconn_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package vp8channel
 
 import (
diff --git a/internal/transport/vp8channel/transport.go b/internal/transport/vp8channel/transport.go
index 0a49a5c..0772f85 100644
--- a/internal/transport/vp8channel/transport.go
+++ b/internal/transport/vp8channel/transport.go
@@ -62,7 +62,6 @@ var (
 	ErrTransportClosed = errors.New("vp8channel transport closed")
 )
 
-//nolint:gochecknoglobals
 var vp8Keepalive = []byte{
 	0x30, 0x01, 0x00, 0x9d, 0x01, 0x2a, 0x10, 0x00,
 	0x10, 0x00, 0x00, 0x47, 0x08, 0x85, 0x85, 0x88,
@@ -213,7 +212,6 @@ func randomEpoch() uint32 {
 	if _, err := rand.Read(b[:]); err != nil {
 		// rand.Read on Linux essentially never fails; fall back to a
 		// time-derived value rather than panic.
-		//nolint:gosec // intentional uint32 truncation of a nanosecond timestamp
 		return uint32(time.Now().UnixNano())
 	}
 	e := binary.BigEndian.Uint32(b[:])
diff --git a/internal/transport/vp8channel/transport_test.go b/internal/transport/vp8channel/transport_test.go
index 2ba62ad..a6e2982 100644
--- a/internal/transport/vp8channel/transport_test.go
+++ b/internal/transport/vp8channel/transport_test.go
@@ -122,8 +122,8 @@ func testEpochHdr(epoch uint32) [epochHdrLen]byte {
 func TestHandleIncomingFrameIgnoresLoopedBackLocalEpoch(t *testing.T) {
 	tr := &streamTransport{
 		bindingToken: bindingToken("test"),
-		localEpoch: 12345,
-		onData:     func([]byte) {},
+		localEpoch:   12345,
+		onData:       func([]byte) {},
 	}
 
 	var called atomic.Int32
diff --git a/internal/transport/vp8channel/transport_unit_test.go b/internal/transport/vp8channel/transport_unit_test.go
index 06831e7..f8a9083 100644
--- a/internal/transport/vp8channel/transport_unit_test.go
+++ b/internal/transport/vp8channel/transport_unit_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package vp8channel
 
 import (
diff --git a/mobile/mobile.go b/mobile/mobile.go
index 5b014c4..9a361e0 100644
--- a/mobile/mobile.go
+++ b/mobile/mobile.go
@@ -64,7 +64,6 @@ const (
 	httpPingSampleDelay   = 80 * time.Millisecond
 )
 
-//nolint:gochecknoglobals // Mobile bindings expose a singleton runtime controlled by the embedding app.
 var (
 	mu                 sync.Mutex
 	defaults           mobileConfig
@@ -617,8 +616,6 @@ func startWithConfig(
 }
 
 // WaitReady blocks until the selected transport is connected and the local SOCKS5 listener is ready.
-//
-//nolint:cyclop // The control flow is intentionally linear so mobile callers can observe each startup state clearly.
 func WaitReady(timeoutMillis int) error {
 	mu.Lock()
 	r := ready
diff --git a/mobile/mobile_test.go b/mobile/mobile_test.go
index 990ae81..b507a3c 100644
--- a/mobile/mobile_test.go
+++ b/mobile/mobile_test.go
@@ -1,4 +1,3 @@
-//nolint:all // Test file keeps scenario setup inline.
 package mobile
 
 import (