diff --git a/cmd/ninja/internal/bnp/build.go b/cmd/ninja/internal/bnp/build.go
index 2e2094b..ea22197 100644
--- a/cmd/ninja/internal/bnp/build.go
+++ b/cmd/ninja/internal/bnp/build.go
@@ -215,7 +215,7 @@ func checkGoVersion(ctx context.Context) error {
 	minor, _ := strconv.Atoi(m[2])
 	if major < minGoMajor || (major == minGoMajor && minor < minGoMinor) {
 		return fmt.Errorf(
-			"Go %d.%d+ is required to build reactor-mode wasip1 plugins; found %d.%d — upgrade your toolchain",
+			"building reactor-mode wasip1 plugins requires Go %d.%d+; found %d.%d — upgrade your toolchain",
 			minGoMajor, minGoMinor, major, minor)
 	}
 	return nil
diff --git a/cmd/ninja/internal/bnp/verify.go b/cmd/ninja/internal/bnp/verify.go
index cb47516..8af8d50 100644
--- a/cmd/ninja/internal/bnp/verify.go
+++ b/cmd/ninja/internal/bnp/verify.go
@@ -9,6 +9,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 
 	abiv1 "git.dev.alexdunmow.com/block/core/abi/v1"
@@ -216,10 +217,8 @@ func safeJoin(root, name string) (string, error) {
 	if filepath.IsAbs(name) || strings.HasPrefix(norm, "/") {
 		return "", fmt.Errorf("bnp: absolute entry path %q rejected", name)
 	}
-	for _, seg := range strings.Split(norm, "/") {
-		if seg == ".." {
-			return "", fmt.Errorf("bnp: entry %q contains a traversal segment", name)
-		}
+	if slices.Contains(strings.Split(norm, "/"), "..") {
+		return "", fmt.Errorf("bnp: entry %q contains a traversal segment", name)
 	}
 	target := filepath.Join(root, filepath.Clean(norm))
 	rel, err := filepath.Rel(root, target)
diff --git a/plugin/wasmguest/bnwasm/dbvalue.go b/plugin/wasmguest/bnwasm/dbvalue.go
index 29c627f..18f69cf 100644
--- a/plugin/wasmguest/bnwasm/dbvalue.go
+++ b/plugin/wasmguest/bnwasm/dbvalue.go
@@ -179,7 +179,7 @@ func naturalValue(dv *abiv1.DbValue) (any, bool) {
 
 // uuidSliceType is the reflect.Type of []uuid.UUID, the canonical scan
 // destination sqlc emits for a uuid[] column (and COALESCE(...::uuid[]) arg).
-var uuidSliceType = reflect.TypeOf([]uuid.UUID(nil))
+var uuidSliceType = reflect.TypeFor[[]uuid.UUID]()
 
 // scanValue assigns a DbValue into a destination pointer with pgx-flavored Scan
 // semantics: a nil dest skips the column; a sql.Scanner destination is fed the
diff --git a/plugin/wasmguest/bnwasm/driver_test.go b/plugin/wasmguest/bnwasm/driver_test.go
index d2dd193..633aada 100644
--- a/plugin/wasmguest/bnwasm/driver_test.go
+++ b/plugin/wasmguest/bnwasm/driver_test.go
@@ -280,7 +280,7 @@ func TestDatabaseSQLDriverRegistered(t *testing.T) {
 		&abiv1.DbValue{Kind: &abiv1.DbValue_StringValue{StringValue: "alice"}},
 	)}
 	db := sql.OpenDB(NewConnector(host.call))
-	defer db.Close()
+	defer func() { _ = db.Close() }()
 
 	var id int
 	var name string