diff --git a/Cargo.toml b/Cargo.toml
index 2482693..7a470ee 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -7,6 +7,14 @@ package.version = "1.0.0-alpha.0"
 [workspace.metadata.crane]
 name = "wire"
 
+[workspace.lints.clippy]
+pedantic = { level = "deny", priority = -1 }
+missing_const_for_fn = "deny"
+
+# annoying to deal with
+missing_errors_doc = "allow"
+missing_panics_doc = "allow"
+
 [workspace.dependencies]
 futures-util = { version = "0.3.31", features = ["sink", "std"] }
 clap = { version = "4.5.50", features = ["derive", "string", "cargo"] }
diff --git a/wire/cli/Cargo.toml b/wire/cli/Cargo.toml
index d6bf108..242b631 100644
--- a/wire/cli/Cargo.toml
+++ b/wire/cli/Cargo.toml
@@ -3,6 +3,9 @@ name = "wire"
 version.workspace = true
 edition.workspace = true
 
+[lints]
+workspace = true
+
 [features]
 dhat-heap = []
 
diff --git a/wire/cli/src/main.rs b/wire/cli/src/main.rs
index 0206fc7..7b51590 100644
--- a/wire/cli/src/main.rs
+++ b/wire/cli/src/main.rs
@@ -1,8 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 // Copyright 2024-2025 wire Contributors
 
-#![deny(clippy::pedantic)]
-#![allow(clippy::missing_panics_doc)]
 use std::process::Command;
 
 use crate::cli::Cli;
diff --git a/wire/cli/src/tracing_setup.rs b/wire/cli/src/tracing_setup.rs
index c8e32fd..f52c7b9 100644
--- a/wire/cli/src/tracing_setup.rs
+++ b/wire/cli/src/tracing_setup.rs
@@ -119,7 +119,7 @@ impl tracing::field::Visit for WireFieldVisitor<'_> {
     }
 }
 
-fn get_style(level: Level) -> Style {
+const fn get_style(level: Level) -> Style {
     let mut style = Style::new();
 
     style = match level {
@@ -133,7 +133,7 @@ fn get_style(level: Level) -> Style {
     style
 }
 
-fn fmt_level(level: Level) -> &'static str {
+const fn fmt_level(level: Level) -> &'static str {
     match level {
         Level::TRACE => "TRACE",
         Level::DEBUG => "DEBUG",
diff --git a/wire/lib/Cargo.toml b/wire/lib/Cargo.toml
index cde1265..924be21 100644
--- a/wire/lib/Cargo.toml
+++ b/wire/lib/Cargo.toml
@@ -3,6 +3,9 @@ name = "lib"
 version.workspace = true
 edition.workspace = true
 
+[lints]
+workspace = true
+
 [features]
 no_web_tests = []
 
diff --git a/wire/lib/build.rs b/wire/lib/build.rs
index 3d0896f..ef0ebcd 100644
--- a/wire/lib/build.rs
+++ b/wire/lib/build.rs
@@ -2,6 +2,7 @@
 // Copyright 2024-2025 wire Contributors
 
 use miette::{Context, IntoDiagnostic as _, Result, miette};
+use std::fmt::Write;
 use std::{
     env,
     fmt::{self, Display, Formatter},
@@ -45,7 +46,7 @@ impl Display for DerviedError {
 {help}
 :::"
                 ),
-                None => "".to_string(),
+                None => String::new(),
             },
             message = match &self.message {
                 Some(message) => format!(
@@ -54,7 +55,7 @@ impl Display for DerviedError {
 {message}
 ```"
                 ),
-                None => "".to_string(),
+                None => String::new(),
             }
         )
     }
@@ -70,7 +71,7 @@ impl DerviedError {
             list.tokens
                 .clone()
                 .into_iter()
-                .filter(|tok| matches!(tok, TokenTree::Literal(tok) if tok.to_string().starts_with("\"")))
+                .filter(|tok| matches!(tok, TokenTree::Literal(tok) if tok.to_string().starts_with('"')))
                 .map(|tok| tok.to_string())
                 .join(""),
         );
@@ -91,7 +92,7 @@ impl DerviedError {
                 matches!(ident, TokenTree::Ident(ident) if ident == "code")
                     && matches!(group, TokenTree::Group(..))
             }) {
-            Some(group.stream().to_string().replace(" ", ""))
+            Some(group.stream().to_string().replace(' ', ""))
         } else {
             None
         };
@@ -116,9 +117,9 @@ impl DerviedError {
         Err(miette!("Had no code."))
     }
 
-    fn update_from_list(&mut self, list: MetaList) {
-        let _ = self.get_error(&list);
-        let _ = self.update_diagnostic(&list);
+    fn update_from_list(&mut self, list: &MetaList) {
+        let _ = self.get_error(list);
+        let _ = self.update_diagnostic(list);
     }
 
     fn update_from_namevalue(&mut self, list: MetaNameValue) -> Result<(), miette::Error> {
@@ -129,8 +130,7 @@ impl DerviedError {
         if let Expr::Lit(lit) = list.value
             && let Lit::Str(str) = lit.lit
         {
-            self.doc_string
-                .push_str(&format!("{}\n\n", &str.value()[1..]));
+            let _ = write!(self.doc_string, "{}\n\n", &str.value()[1..]);
         }
 
         Ok(())
@@ -141,9 +141,7 @@ fn main() -> Result<()> {
     println!("cargo:rerun-if-changed=src/errors.rs");
 
     let manifest_dir = env::var("CARGO_MANIFEST_DIR").into_diagnostic()?;
-    let md_out_dir = if let Ok(path) = env::var("DIAGNOSTICS_MD_OUTPUT") {
-        path
-    } else {
+    let Ok(md_out_dir) = env::var("DIAGNOSTICS_MD_OUTPUT") else {
         return Ok(());
     };
 
@@ -170,12 +168,12 @@ fn main() -> Result<()> {
                 for attribute in variant.attrs.clone() {
                     match attribute.meta {
                         Meta::List(list) => {
-                            entry.update_from_list(list);
+                            entry.update_from_list(&list);
                         }
                         Meta::NameValue(nv) => {
                             let _ = entry.update_from_namevalue(nv);
                         }
-                        _ => {}
+                        Meta::Path(_) => {}
                     }
                 }
 
@@ -191,7 +189,7 @@ fn main() -> Result<()> {
         .wrap_err("creating target directory")?;
     fs::write(
         Path::new(&md_out_dir).join("DIAGNOSTICS.md"),
-        entries.iter().map(|x| x.to_string()).join("\n\n"),
+        entries.iter().map(std::string::ToString::to_string).join("\n\n"),
     )
     .into_diagnostic()
     .wrap_err("writing DIAGNOSTICS.md")?;
diff --git a/wire/lib/src/commands/interactive.rs b/wire/lib/src/commands/interactive.rs
index 6f7a4ec..5448676 100644
--- a/wire/lib/src/commands/interactive.rs
+++ b/wire/lib/src/commands/interactive.rs
@@ -288,7 +288,7 @@ fn build_command<S: AsRef<str>>(
 }
 
 impl CompletionStatus {
-    fn new() -> Self {
+    const fn new() -> Self {
         CompletionStatus {
             completed: Mutex::new(false),
             success: Mutex::new(None),
diff --git a/wire/lib/src/commands/interactive_logbuffer.rs b/wire/lib/src/commands/interactive_logbuffer.rs
index 40089a5..4136e6e 100644
--- a/wire/lib/src/commands/interactive_logbuffer.rs
+++ b/wire/lib/src/commands/interactive_logbuffer.rs
@@ -7,7 +7,7 @@ pub(crate) struct LogBuffer {
 }
 
 impl LogBuffer {
-    pub fn new() -> Self {
+    pub const fn new() -> Self {
         Self { buffer: Vec::new() }
     }
 
diff --git a/wire/lib/src/commands/mod.rs b/wire/lib/src/commands/mod.rs
index 53a4986..b4219a3 100644
--- a/wire/lib/src/commands/mod.rs
+++ b/wire/lib/src/commands/mod.rs
@@ -56,7 +56,7 @@ static AHO_CORASICK: LazyLock<AhoCorasick> = LazyLock::new(|| {
 });
 
 impl<'a, S: AsRef<str>> CommandArguments<'a, S> {
-    pub(crate) fn new(command_string: S, modifiers: SubCommandModifiers) -> Self {
+    pub(crate) const fn new(command_string: S, modifiers: SubCommandModifiers) -> Self {
         Self {
             command_string,
             keep_stdin_open: false,
@@ -68,27 +68,27 @@ impl<'a, S: AsRef<str>> CommandArguments<'a, S> {
         }
     }
 
-    pub(crate) fn on_target(mut self, target: Option<&'a Target>) -> Self {
+    pub(crate) const fn on_target(mut self, target: Option<&'a Target>) -> Self {
         self.target = target;
         self
     }
 
-    pub(crate) fn nix(mut self) -> Self {
+    pub(crate) const fn nix(mut self) -> Self {
         self.output_mode = ChildOutputMode::Nix;
         self
     }
 
-    pub(crate) fn keep_stdin_open(mut self) -> Self {
+    pub(crate) const fn keep_stdin_open(mut self) -> Self {
         self.keep_stdin_open = true;
         self
     }
 
-    pub(crate) fn elevated(mut self) -> Self {
+    pub(crate) const fn elevated(mut self) -> Self {
         self.elevated = true;
         self
     }
 
-    pub(crate) fn log_stdout(mut self) -> Self {
+    pub(crate) const fn log_stdout(mut self) -> Self {
         self.log_stdout = true;
         self
     }
diff --git a/wire/lib/src/hive/node.rs b/wire/lib/src/hive/node.rs
index a6d2a4e..e4a4868 100644
--- a/wire/lib/src/hive/node.rs
+++ b/wire/lib/src/hive/node.rs
@@ -157,7 +157,7 @@ impl Target {
             .ok_or(HiveLibError::NetworkError(NetworkError::HostsExhausted))
     }
 
-    pub fn host_failed(&mut self) {
+    pub const fn host_failed(&mut self) {
         self.current_host += 1;
     }
 
@@ -257,6 +257,7 @@ impl Node {
     }
 }
 
+#[must_use] 
 pub fn should_apply_locally(allow_local_deployment: bool, name: &str) -> bool {
     *name == *gethostname() && allow_local_deployment
 }
@@ -355,6 +356,7 @@ pub struct GoalExecutor<'a> {
 }
 
 impl<'a> GoalExecutor<'a> {
+    #[must_use] 
     pub fn new(context: Context<'a>) -> Self {
         Self {
             steps: vec![
diff --git a/wire/lib/src/hive/steps/activate.rs b/wire/lib/src/hive/steps/activate.rs
index 8b93c38..2af70ff 100644
--- a/wire/lib/src/hive/steps/activate.rs
+++ b/wire/lib/src/hive/steps/activate.rs
@@ -21,7 +21,7 @@ impl Display for SwitchToConfiguration {
     }
 }
 
-pub async fn wait_for_ping(ctx: &Context<'_>) -> Result<(), HiveLibError> {
+async fn wait_for_ping(ctx: &Context<'_>) -> Result<(), HiveLibError> {
     let host = ctx.node.target.get_preferred_host()?;
     let mut result = ctx.node.ping(ctx.modifiers).await;
 
diff --git a/wire/lib/src/lib.rs b/wire/lib/src/lib.rs
index 0f92b71..978b3dd 100644
--- a/wire/lib/src/lib.rs
+++ b/wire/lib/src/lib.rs
@@ -1,12 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 // Copyright 2024-2025 wire Contributors
 
-#![deny(clippy::pedantic)]
-#![allow(
-    clippy::missing_errors_doc,
-    clippy::must_use_candidate,
-    clippy::missing_panics_doc
-)]
 #![feature(assert_matches)]
 #![feature(iter_intersperse)]