diff --git a/internal/upstreamldap/upstreamldap.go b/internal/upstreamldap/upstreamldap.go
index b49333608..c567c277a 100644
--- a/internal/upstreamldap/upstreamldap.go
+++ b/internal/upstreamldap/upstreamldap.go
@@ -326,7 +326,7 @@ func (p *Provider) dialTLS(ctx context.Context, addr endpointaddr.HostPort) (Con
 	}
 
 	conn := ldap.NewConn(c, true)
-	conn.Start()
+	conn.Start() //nolint:staticcheck // will need a different approach soon
 	return conn, nil
 }
 
@@ -348,7 +348,7 @@ func (p *Provider) dialStartTLS(ctx context.Context, addr endpointaddr.HostPort)
 	}
 
 	conn := ldap.NewConn(c, false)
-	conn.Start()
+	conn.Start() //nolint:staticcheck // will need a different approach soon
 	err = conn.StartTLS(tlsConfig)
 	if err != nil {
 		return nil, err
diff --git a/test/testlib/activedirectory.go b/test/testlib/activedirectory.go
index 25580059b..c9327d9d7 100644
--- a/test/testlib/activedirectory.go
+++ b/test/testlib/activedirectory.go
@@ -1,4 +1,4 @@
-// Copyright 2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2022-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 package testlib
 
@@ -199,7 +199,7 @@ func dialTLS(t *testing.T, env *TestEnv) *ldap.Conn {
 	c, err := dialer.DialContext(context.Background(), "tcp", env.SupervisorUpstreamActiveDirectory.Host)
 	require.NoError(t, err)
 	conn := ldap.NewConn(c, true)
-	conn.Start()
+	conn.Start() //nolint:staticcheck // will need a different approach soon
 	return conn
 }