diff --git a/.gitignore b/.gitignore
index 3aa2b09..df31611 100644
--- a/.gitignore
+++ b/.gitignore
@@ -115,6 +115,10 @@ stockholm_zip/*.zip
 NEXT.md
 DONE.md
 
+# Code-scanning working notes — snapshot + remediation plan; not committed
+# until the sweep is complete and the notes are stable.
+CODE-SCANNING-NOTES.md
+
 # Plan/tracking note for the Health-tab debug-utility programme.
 # Living document; commit history of the checks themselves is the
 # source of truth for what shipped.
diff --git a/pkg/service/certmanager/certmanager.go b/pkg/service/certmanager/certmanager.go
index 43ea1b3..39c4a7c 100644
--- a/pkg/service/certmanager/certmanager.go
+++ b/pkg/service/certmanager/certmanager.go
@@ -8,6 +8,7 @@ import (
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/pem"
+	"fmt"
 	"math/big"
 	"net"
 	"os"
@@ -180,22 +181,32 @@ func (cm *CertificateManager) GenerateCA() error {
 		return err
 	}
 
-	if encodeErr := pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes}); encodeErr != nil {
-		return encodeErr
+	certEncodeErr := pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
+	certCloseErr := certOut.Close()
+
+	if certEncodeErr != nil {
+		return certEncodeErr
 	}
 
-	certOut.Close()
+	if certCloseErr != nil {
+		return fmt.Errorf("close certificate file: %w", certCloseErr)
+	}
 
 	keyOut, err := os.OpenFile(cm.GetCAKeyPath(), os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
 	if err != nil {
 		return err
 	}
 
-	if err := pem.Encode(keyOut, &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv)}); err != nil {
-		return err
+	keyEncodeErr := pem.Encode(keyOut, &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv)})
+	keyCloseErr := keyOut.Close()
+
+	if keyEncodeErr != nil {
+		return keyEncodeErr
 	}
 
-	keyOut.Close()
+	if keyCloseErr != nil {
+		return fmt.Errorf("close key file: %w", keyCloseErr)
+	}
 
 	return nil
 }
diff --git a/scripts/extract-ws/main.go b/scripts/extract-ws/main.go
index 39797a2..17c6aff 100644
--- a/scripts/extract-ws/main.go
+++ b/scripts/extract-ws/main.go
@@ -97,7 +97,7 @@ func extractSSDP(packet gopacket.Packet, udp *layers.UDP, ssdpFilename string) {
 	if err != nil {
 		return
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 
 	srcIP := packet.NetworkLayer().NetworkFlow().Src().String()
 	dstIP := packet.NetworkLayer().NetworkFlow().Dst().String()