diff --git a/.golangci.yml b/.golangci.yml
index f68fd17..93a4d15 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -26,9 +26,6 @@ linters:
           - errcheck
 
       # TODO: fix issues and remove these paths one by one
-      - path: cmd/credential-helper
-        linters:
-          - errcheck
 
 formatters:
   enable:
diff --git a/pkg/appview/handlers/device.go b/pkg/appview/handlers/device.go
index 03d957b..ec28f27 100644
--- a/pkg/appview/handlers/device.go
+++ b/pkg/appview/handlers/device.go
@@ -362,7 +362,10 @@ func (h *DeviceApprovalPageHandler) renderApprovalPage(w http.ResponseWriter, ha
 	}
 
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	tmpl.Execute(w, data)
+	if err := tmpl.Execute(w, data); err != nil {
+		http.Error(w, "failed to render template", http.StatusInternalServerError)
+		return
+	}
 }
 
 func (h *DeviceApprovalPageHandler) renderSuccess(w http.ResponseWriter, deviceName string) {
@@ -374,7 +377,10 @@ func (h *DeviceApprovalPageHandler) renderSuccess(w http.ResponseWriter, deviceN
 	}
 
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	tmpl.Execute(w, data)
+	if err := tmpl.Execute(w, data); err != nil {
+		http.Error(w, "failed to render template", http.StatusInternalServerError)
+		return
+	}
 }
 
 func (h *DeviceApprovalPageHandler) renderError(w http.ResponseWriter, message string) {
@@ -387,7 +393,10 @@ func (h *DeviceApprovalPageHandler) renderError(w http.ResponseWriter, message s
 
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	w.WriteHeader(http.StatusBadRequest)
-	tmpl.Execute(w, data)
+	if err := tmpl.Execute(w, data); err != nil {
+		http.Error(w, "failed to render template", http.StatusInternalServerError)
+		return
+	}
 }
 
 func getClientIP(r *http.Request) string {
diff --git a/pkg/appview/jetstream/worker.go b/pkg/appview/jetstream/worker.go
index 0d7067d..b338591 100644
--- a/pkg/appview/jetstream/worker.go
+++ b/pkg/appview/jetstream/worker.go
@@ -132,7 +132,9 @@ func (w *Worker) Start(ctx context.Context) error {
 	})
 
 	// Set initial read deadline
-	conn.SetReadDeadline(time.Now().Add(90 * time.Second))
+	if err := conn.SetReadDeadline(time.Now().Add(90 * time.Second)); err != nil {
+		return fmt.Errorf("failed to set read deadline: %w", err)
+	}
 
 	// Create zstd decoder for decompressing messages
 	decoder, err := zstd.NewReader(nil)
@@ -178,7 +180,11 @@ func (w *Worker) Start(ctx context.Context) error {
 				}
 
 				// Send ping with write deadline
-				conn.SetWriteDeadline(time.Now().Add(10 * time.Second))
+				if err := conn.SetWriteDeadline(time.Now().Add(10 * time.Second)); err != nil {
+					slog.Warn("Jetstream failed to set write deadline", "error", err)
+					conn.Close()
+					return
+				}
 				if err := conn.WriteMessage(websocket.PingMessage, nil); err != nil {
 					slog.Warn("Jetstream failed to send ping", "error", err)
 					conn.Close()
diff --git a/pkg/appview/middleware/registry.go b/pkg/appview/middleware/registry.go
index a4d3ba1..f74e2c4 100644
--- a/pkg/appview/middleware/registry.go
+++ b/pkg/appview/middleware/registry.go
@@ -204,7 +204,9 @@ func GetGlobalAuthorizer() auth.HoldAuthorizer {
 
 func init() {
 	// Register the name resolution middleware
-	registrymw.Register("atproto-resolver", initATProtoResolver)
+	if err := registrymw.Register("atproto-resolver", initATProtoResolver); err != nil {
+		panic("failed to register atproto-resolver middleware: " + err.Error())
+	}
 }
 
 // NamespaceResolver wraps a namespace and resolves names
diff --git a/pkg/appview/storage/proxy_blob_store.go b/pkg/appview/storage/proxy_blob_store.go
index e85441a..0df0916 100644
--- a/pkg/appview/storage/proxy_blob_store.go
+++ b/pkg/appview/storage/proxy_blob_store.go
@@ -8,6 +8,7 @@ import (
 	"io"
 	"log/slog"
 	"net/http"
+	"strconv"
 	"sync"
 	"time"
 
@@ -170,7 +171,9 @@ func (p *ProxyBlobStore) Stat(ctx context.Context, dgst digest.Digest) (distribu
 	// Return a minimal descriptor with size from Content-Length if available
 	size := int64(0)
 	if contentLength := resp.Header.Get("Content-Length"); contentLength != "" {
-		fmt.Sscanf(contentLength, "%d", &size)
+		if parsed, err := strconv.ParseInt(contentLength, 10, 64); err == nil {
+			size = parsed
+		}
 	}
 
 	return distribution.Descriptor{