diff --git a/cmd/config/plugins.go b/cmd/config/plugins.go
index 96c0537b5..bcc5c7706 100644
--- a/cmd/config/plugins.go
+++ b/cmd/config/plugins.go
@@ -8,7 +8,7 @@ import (
 
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/output"
-	"github.com/larksuite/cli/internal/platform"
+	internalplatform "github.com/larksuite/cli/internal/platform"
 )
 
 // NewCmdConfigPlugins exposes the plugin inventory diagnostic command.
diff --git a/cmd/platform_guards_test.go b/cmd/platform_guards_test.go
index d8babe203..dfa684759 100644
--- a/cmd/platform_guards_test.go
+++ b/cmd/platform_guards_test.go
@@ -15,7 +15,7 @@ import (
 	"github.com/larksuite/cli/extension/platform"
 	"github.com/larksuite/cli/internal/hook"
 	"github.com/larksuite/cli/internal/output"
-	"github.com/larksuite/cli/internal/platform"
+	internalplatform "github.com/larksuite/cli/internal/platform"
 )
 
 // failClosedAbortingPlugin returns a PluginInstallError on Install,
@@ -158,7 +158,6 @@ func TestNamespacedWrap_doesNotMutateSharedAbortError(t *testing.T) {
 	var wg sync.WaitGroup
 	wg.Add(2)
 	for i, m := range matched {
-		i, m := i, m
 		go func() {
 			defer wg.Done()
 			err := m.Fn(func(context.Context, platform.Invocation) error { return nil })(
diff --git a/cmd/plugin_integration_test.go b/cmd/plugin_integration_test.go
index 13480aa65..e439adbfc 100644
--- a/cmd/plugin_integration_test.go
+++ b/cmd/plugin_integration_test.go
@@ -18,7 +18,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/hook"
 	"github.com/larksuite/cli/internal/output"
-	"github.com/larksuite/cli/internal/platform"
+	internalplatform "github.com/larksuite/cli/internal/platform"
 )
 
 // These integration tests exercise the Hook framework's plumbing
@@ -231,9 +231,6 @@ func TestPluginPipeline_denialGuardIntegrated(t *testing.T) {
 	t.Cleanup(platform.ResetForTesting)
 
 	wrapCalled := false
-	type wrapPlugin struct{}
-	// We use an anonymous Plugin via fakeIntegrationPlugin to keep
-	// the test focused.
 	plugin := &fakeIntegrationPlugin{
 		name:            "policy-plugin",
 		caps:            platform.Capabilities{FailurePolicy: platform.FailOpen},
diff --git a/internal/hook/install_default.go b/internal/hook/install_default.go
index 778c7e08e..2c382a76e 100644
--- a/internal/hook/install_default.go
+++ b/internal/hook/install_default.go
@@ -8,4 +8,4 @@ import "os"
 // defaultStderr is the real os.Stderr writer. Kept in a separate file so
 // tests can replace `stderr` (in install.go) with a buffer without
 // shadowing this variable.
-var defaultStderr = os.Stderr
+var defaultStderr = os.Stderr //nolint:forbidigo // framework-level fallback writer; hooks fire before IOStreams plumbing is available
diff --git a/internal/platform/host_test.go b/internal/platform/host_test.go
index c1a9d663a..c3830a570 100644
--- a/internal/platform/host_test.go
+++ b/internal/platform/host_test.go
@@ -11,7 +11,7 @@ import (
 	"testing"
 
 	"github.com/larksuite/cli/extension/platform"
-	"github.com/larksuite/cli/internal/platform"
+	internalplatform "github.com/larksuite/cli/internal/platform"
 )
 
 // happyPlugin is a textbook plugin: declares Capabilities, calls a few
diff --git a/internal/platform/version.go b/internal/platform/version.go
index 6a7c940ea..34afb1b60 100644
--- a/internal/platform/version.go
+++ b/internal/platform/version.go
@@ -69,7 +69,7 @@ func satisfiesRequiredCLIVersion(buildVersion, constraint string) (bool, error)
 	if err != nil {
 		// Build version is unparseable -- treat as DEV so an exotic
 		// build tag doesn't lock plugins out.
-		return true, nil
+		return true, nil //nolint:nilerr // intentional fail-open for unparseable buildVersion
 	}
 	cmp := compareSemver(bv, rv)
 	switch op {