diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3163f5f..5537876 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -48,7 +48,7 @@ jobs:
           cache: true
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
 
       - name: Get next version number
         id: version
diff --git a/circuit/circuit_test.go b/circuit/circuit_test.go
index dce6c10..192542f 100644
--- a/circuit/circuit_test.go
+++ b/circuit/circuit_test.go
@@ -181,9 +181,6 @@ func TestBackwardDigest(t *testing.T) {
 	}
 
 	d1 := circ.BackwardDigest()
-	if d1 == nil {
-		t.Fatal("BackwardDigest returned nil")
-	}
 	if len(d1) != 20 { // SHA-1 output
 		t.Fatalf("digest length = %d, want 20", len(d1))
 	}
diff --git a/circuit/dispatch_test.go b/circuit/dispatch_test.go
index 8d9abd0..53eb491 100644
--- a/circuit/dispatch_test.go
+++ b/circuit/dispatch_test.go
@@ -131,9 +131,6 @@ func TestRegisterStream(t *testing.T) {
 	if err != nil {
 		t.Fatalf("RegisterStream: %v", err)
 	}
-	if sr == nil {
-		t.Fatal("RegisterStream returned nil")
-	}
 	if cap(sr.Cells) != 64 {
 		t.Fatalf("channel capacity = %d, want 64", cap(sr.Cells))
 	}
diff --git a/cmd/tor-client/bootstrap_test.go b/cmd/tor-client/bootstrap_test.go
index d972343..0c279c7 100644
--- a/cmd/tor-client/bootstrap_test.go
+++ b/cmd/tor-client/bootstrap_test.go
@@ -75,9 +75,6 @@ func TestLoadFromCacheHitNoCircuit(t *testing.T) {
 
 	// Load from cache — no circuit should be needed.
 	data := loadFromCache(cache)
-	if data == nil {
-		t.Fatal("expected non-nil data from cache")
-	}
 	if data.consensusText != consensusText {
 		t.Fatalf("consensus text mismatch: got %d bytes, want %d bytes", len(data.consensusText), len(consensusText))
 	}
@@ -375,6 +372,7 @@ func TestE2EBootstrapSequence(t *testing.T) {
 	}
 	if data == nil {
 		t.Fatal("failed to bootstrap from any authority")
+		return // unreachable; helps staticcheck SA5011
 	}
 	t.Logf("bootstrapped from authority %s", succeededAuth)
 
@@ -415,6 +413,7 @@ func TestE2EBootstrapSequence(t *testing.T) {
 	cachedData := loadFromCache(cache)
 	if cachedData == nil {
 		t.Fatal("loadFromCache returned nil after saving")
+		return // unreachable; helps staticcheck SA5011
 	}
 	if cachedData.consensusText != data.consensusText {
 		t.Fatal("cached consensus text differs from original")
diff --git a/cmd/tor-client/e2e_test.go b/cmd/tor-client/e2e_test.go
index 5a3ea36..de2135a 100644
--- a/cmd/tor-client/e2e_test.go
+++ b/cmd/tor-client/e2e_test.go
@@ -78,6 +78,7 @@ func fetchConsensusAndCerts(t *testing.T) (string, *directory.Consensus, []direc
 	}
 	if data == nil {
 		t.Fatal("failed to bootstrap from any authority")
+		return "", nil, nil // unreachable; helps staticcheck SA5011
 	}
 
 	if err := directory.ValidateSignatures(data.consensusText, data.keyCerts); err != nil {
@@ -232,6 +233,7 @@ func TestE2EConsensusAndSignatures(t *testing.T) {
 	}
 	if data == nil {
 		t.Fatal("failed to bootstrap from any authority")
+		return // unreachable; helps staticcheck SA5011
 	}
 
 	if len(data.keyCerts) < 5 {
diff --git a/descriptor/descriptor_test.go b/descriptor/descriptor_test.go
index e1e3548..602fd11 100644
--- a/descriptor/descriptor_test.go
+++ b/descriptor/descriptor_test.go
@@ -135,6 +135,7 @@ func TestParseDescriptorSigningKeyField(t *testing.T) {
 	// SigningKey must be non-nil and match the key we generated
 	if info.SigningKey == nil {
 		t.Fatal("SigningKey is nil")
+		return // unreachable; helps staticcheck SA5011
 	}
 	if info.SigningKey.N.Cmp(privKey.N) != 0 {
 		t.Fatal("SigningKey.N does not match the generated key")
@@ -166,6 +167,7 @@ func TestParseDescriptorSignatureBytesField(t *testing.T) {
 	// SignatureBytes must be non-nil and non-empty
 	if info.SignatureBytes == nil {
 		t.Fatal("SignatureBytes is nil")
+		return // unreachable; helps staticcheck SA5011
 	}
 	if len(info.SignatureBytes) == 0 {
 		t.Fatal("SignatureBytes is empty")
diff --git a/link/link_test.go b/link/link_test.go
index 70213bc..89b88b5 100644
--- a/link/link_test.go
+++ b/link/link_test.go
@@ -47,9 +47,6 @@ func TestLinkRegisterCircuit(t *testing.T) {
 	if err != nil {
 		t.Fatalf("RegisterCircuit: %v", err)
 	}
-	if cr == nil {
-		t.Fatal("RegisterCircuit returned nil")
-	}
 	if cap(cr.Cells) != 32 {
 		t.Fatalf("channel capacity = %d, want 32", cap(cr.Cells))
 	}