diff --git a/internal/auth/admin_test.go b/internal/auth/admin_test.go
index 393738b8..70ef99a2 100644
--- a/internal/auth/admin_test.go
+++ b/internal/auth/admin_test.go
@@ -19,7 +19,7 @@ func injectUser(r *http.Request, u dbq.User) *http.Request {
 
 func TestRequireAdmin_AdminPasses(t *testing.T) {
 	called := false
-	stub := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	stub := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		called = true
 		w.WriteHeader(http.StatusOK)
 	})
@@ -42,7 +42,7 @@ func TestRequireAdmin_AdminPasses(t *testing.T) {
 }
 
 func TestRequireAdmin_NonAdminReturns403(t *testing.T) {
-	stub := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	stub := http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
 		t.Fatal("stub handler must not be called for non-admin user")
 	})
 
@@ -69,7 +69,7 @@ func TestRequireAdmin_NonAdminReturns403(t *testing.T) {
 }
 
 func TestRequireAdmin_NoUserContextReturns500(t *testing.T) {
-	stub := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	stub := http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
 		t.Fatal("stub handler must not be called when no user is in context")
 	})