diff --git a/internal/api/stream_token.go b/internal/api/stream_token.go
index d3cf2144..9f1d70f9 100644
--- a/internal/api/stream_token.go
+++ b/internal/api/stream_token.go
@@ -21,7 +21,8 @@ import (
 // loader and the stream handler share.
 func SignStreamToken(secret []byte, trackID string, exp int64) string {
 	mac := hmac.New(sha256.New, secret)
-	fmt.Fprintf(mac, "%s|%d", trackID, exp)
+	// hash.Hash.Write is documented as never returning an error.
+	_, _ = fmt.Fprintf(mac, "%s|%d", trackID, exp)
 	return hex.EncodeToString(mac.Sum(nil))
 }
 
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index 06afe2fa..1969bb67 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -201,7 +201,7 @@ func TestStreamSecret_EnvOverride(t *testing.T) {
 }
 
 func TestStreamSecret_AutoGenPersistsToDataDir(t *testing.T) {
-	os.Unsetenv("MINSTREL_STREAM_SECRET")
+	_ = os.Unsetenv("MINSTREL_STREAM_SECRET")
 	dataDir := t.TempDir()
 	t.Setenv("MINSTREL_STORAGE_DATA_DIR", dataDir)
 
@@ -235,7 +235,7 @@ func TestStreamSecret_AutoGenPersistsToDataDir(t *testing.T) {
 }
 
 func TestStreamSecret_LoadsPersistedOnSecondBoot(t *testing.T) {
-	os.Unsetenv("MINSTREL_STREAM_SECRET")
+	_ = os.Unsetenv("MINSTREL_STREAM_SECRET")
 	dataDir := t.TempDir()
 	t.Setenv("MINSTREL_STORAGE_DATA_DIR", dataDir)