diff --git a/internal/cli/root_test.go b/internal/cli/root_test.go
index 1c8c4ef..589b4e8 100644
--- a/internal/cli/root_test.go
+++ b/internal/cli/root_test.go
@@ -246,14 +246,14 @@ func TestRepoCloneCommandAcceptsExplicitLocalURL(t *testing.T) {
 	if err := executeForTest(cmd, &out, "repo", "clone", "file://"+origin, target); err != nil {
 		t.Fatalf("repo clone failed: %v", err)
 	}
-	if _, err := exec.Command("git", "-C", target, "status").Output(); err != nil {
+	if _, err := exec.Command("git", "-C", target, "status").Output(); err != nil { // #nosec G204 -- fixed git binary with test-owned temp path.
 		t.Fatalf("cloned repo status error = %v", err)
 	}
 }
 
 func runGitForCLITest(t *testing.T, cwd string, args ...string) {
 	t.Helper()
-	cmd := exec.Command("git", args...)
+	cmd := exec.Command("git", args...) // #nosec G204 -- fixed git binary with test-controlled arguments.
 	cmd.Dir = cwd
 	if out, err := cmd.CombinedOutput(); err != nil {
 		t.Fatalf("git %v failed: %s: %v", args, out, err)
diff --git a/internal/git/remote_test.go b/internal/git/remote_test.go
index 1c94806..0f7568c 100644
--- a/internal/git/remote_test.go
+++ b/internal/git/remote_test.go
@@ -119,7 +119,7 @@ func TestCloneUsesLocalRepository(t *testing.T) {
 	if err := Clone(context.Background(), origin, target); err != nil {
 		t.Fatalf("Clone error = %v", err)
 	}
-	if _, err := exec.Command("git", "-C", target, "status").Output(); err != nil {
+	if _, err := exec.Command("git", "-C", target, "status").Output(); err != nil { // #nosec G204 -- fixed git binary with test-owned temp path.
 		t.Fatalf("cloned repo status error = %v", err)
 	}
 }
@@ -172,7 +172,7 @@ func (r *fakeRunner) Run(_ context.Context, _ string, args ...string) ([]byte, e
 
 func runGit(t *testing.T, cwd string, args ...string) {
 	t.Helper()
-	cmd := exec.Command("git", args...)
+	cmd := exec.Command("git", args...) // #nosec G204 -- fixed git binary with test-controlled arguments.
 	cmd.Dir = cwd
 	if out, err := cmd.CombinedOutput(); err != nil {
 		t.Fatalf("git %v failed: %s: %v", args, out, err)
diff --git a/internal/repo/context_test.go b/internal/repo/context_test.go
index c1950b0..fd73223 100644
--- a/internal/repo/context_test.go
+++ b/internal/repo/context_test.go
@@ -130,7 +130,7 @@ func TestResolveUsesLocalGitRemote(t *testing.T) {
 
 func runGit(t *testing.T, cwd string, args ...string) {
 	t.Helper()
-	cmd := exec.Command("git", args...)
+	cmd := exec.Command("git", args...) // #nosec G204 -- fixed git binary with test-controlled arguments.
 	cmd.Dir = cwd
 	if out, err := cmd.CombinedOutput(); err != nil {
 		t.Fatalf("git %v failed: %s: %v", args, out, err)
diff --git a/internal/tangled/service_test.go b/internal/tangled/service_test.go
index 114a868..369eadb 100644
--- a/internal/tangled/service_test.go
+++ b/internal/tangled/service_test.go
@@ -621,7 +621,9 @@ func newFakePDSServer(t *testing.T, records map[string]fakeRecord, opts ...fakeP
 				http.Error(w, "not found", http.StatusNotFound)
 				return
 			}
-			w.Write(recordJSON(t, record))
+			if _, err := w.Write(recordJSON(t, record)); err != nil {
+				t.Fatalf("Write response error = %v", err)
+			}
 		case "/xrpc/com.atproto.repo.createRecord":
 			var input struct {
 				Collection string          `json:"collection"`