diff --git a/internal/nginx/manager.go b/internal/nginx/manager.go
index f440386ef5d..ce7c68f7274 100644
--- a/internal/nginx/manager.go
+++ b/internal/nginx/manager.go
@@ -342,7 +342,7 @@ func (lm *LocalManager) Quit() {
 // Version returns NGINX version
 func (lm *LocalManager) Version() Version {
 	binaryFilename := getBinaryFileName(lm.debug)
-	out, err := exec.Command(binaryFilename, "-v").CombinedOutput()
+	out, err := exec.Command(binaryFilename, "-v").CombinedOutput() //nolint:gosec // G204: Subprocess launched with variable - false positive, variable resolves to a const
 	if err != nil {
 		glog.Fatalf("Failed to get nginx version: %v", err)
 	}
@@ -456,13 +456,16 @@ func verifyConfigVersion(httpClient *http.Client, configVersion int, timeout tim
 	if err != nil {
 		return fmt.Errorf("error doing request: %w", err)
 	}
-	defer resp.Body.Close()
+	err = nil
+	defer func() {
+		err = resp.Body.Close()
+	}()
 
 	if resp.StatusCode != http.StatusOK {
 		return fmt.Errorf("API returned non-success status: %v", resp.StatusCode)
 	}
 
-	return nil
+	return err
 }
 
 // SetOpenTracing sets the value of OpenTracing for the Manager
@@ -481,7 +484,7 @@ func (lm *LocalManager) AppProtectPluginStart(appDone chan error, logLevel strin
 
 	glog.V(3).Info("Starting AppProtect Plugin")
 	startupParams := strings.Fields(appPluginParams)
-	cmd := exec.Command(appProtectPluginStartCmd, startupParams...)
+	cmd := exec.Command(appProtectPluginStartCmd, startupParams...) //nolint:gosec // G204: Subprocess launched with variable - false positive, variable resolves to a const
 
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stdout
diff --git a/internal/nginx/utils.go b/internal/nginx/utils.go
index 682db8ca151..3254d14c5f4 100644
--- a/internal/nginx/utils.go
+++ b/internal/nginx/utils.go
@@ -39,14 +39,18 @@ func createFileAndWrite(name string, b []byte) error {
 		return fmt.Errorf("failed to open %v: %w", name, err)
 	}
 
-	defer w.Close()
+	defer func() {
+		if tempErr := w.Close(); tempErr != nil {
+			err = tempErr
+		}
+	}()
 
 	_, err = w.Write(b)
 	if err != nil {
 		return fmt.Errorf("failed to write to %v: %w", name, err)
 	}
 
-	return nil
+	return err
 }
 
 func createFileAndWriteAtomically(filename string, tempPath string, mode os.FileMode, content []byte) {
diff --git a/internal/nginx/verify.go b/internal/nginx/verify.go
index ffb2d608383..68c94386a2b 100644
--- a/internal/nginx/verify.go
+++ b/internal/nginx/verify.go
@@ -49,7 +49,12 @@ func (c *verifyClient) GetConfigVersion() (int, error) {
 	if err != nil {
 		return 0, fmt.Errorf("error getting client: %w", err)
 	}
-	defer resp.Body.Close()
+	err = nil
+	defer func() {
+		if tempErr := resp.Body.Close(); tempErr != nil {
+			err = tempErr
+		}
+	}()
 
 	if resp.StatusCode != http.StatusOK {
 		return 0, fmt.Errorf("non-200 response: %v", resp.StatusCode)
@@ -63,7 +68,7 @@ func (c *verifyClient) GetConfigVersion() (int, error) {
 	if err != nil {
 		return 0, fmt.Errorf("error converting string to int: %w", err)
 	}
-	return v, nil
+	return v, err
 }
 
 // WaitForCorrectVersion calls the config version endpoint until it gets the expectedVersion,
diff --git a/pkg/apis/configuration/validation/virtualserver_test.go b/pkg/apis/configuration/validation/virtualserver_test.go
index 783cd00fee3..8992d3cf5f8 100644
--- a/pkg/apis/configuration/validation/virtualserver_test.go
+++ b/pkg/apis/configuration/validation/virtualserver_test.go
@@ -119,10 +119,6 @@ func makeVirtualServer() v1.VirtualServer {
 	}
 }
 
-func createPointerFromString(s string) *string {
-	return &s
-}
-
 func TestValidateFailsOnMissingBackupPort(t *testing.T) {
 	t.Parallel()