diff --git a/internal/agent/gitea.go b/internal/agent/gitea.go
index 74eb809..b454391 100644
--- a/internal/agent/gitea.go
+++ b/internal/agent/gitea.go
@@ -46,7 +46,7 @@ func (c *GiteaClient) do(method, path string, body any, out any) error {
 	if err != nil {
 		return err
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 	data, _ := io.ReadAll(resp.Body)
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
 		return fmt.Errorf("gitea %s %s: HTTP %d: %s", method, path, resp.StatusCode, strings.TrimSpace(string(data)))
diff --git a/internal/agent/vault.go b/internal/agent/vault.go
index b7f6b95..8fcd73b 100644
--- a/internal/agent/vault.go
+++ b/internal/agent/vault.go
@@ -29,7 +29,7 @@ func approleLogin(vaultAddr, roleID string) (string, error) {
 	if err != nil {
 		return "", fmt.Errorf("vault approle login: %w", err)
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 	data, _ := io.ReadAll(resp.Body)
 	if resp.StatusCode != http.StatusOK {
 		return "", fmt.Errorf("vault approle login: HTTP %d: %s", resp.StatusCode, strings.TrimSpace(string(data)))
@@ -62,7 +62,7 @@ func readGiteaCreds(vaultAddr, clientToken string) (string, error) {
 	if err != nil {
 		return "", fmt.Errorf("vault read %s: %w", GiteaCredsPath, err)
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 	data, _ := io.ReadAll(resp.Body)
 	if resp.StatusCode != http.StatusOK {
 		return "", fmt.Errorf("vault read %s: HTTP %d: %s", GiteaCredsPath, resp.StatusCode, strings.TrimSpace(string(data)))