diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index 5c1fb9d..26c182e 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -12,7 +12,11 @@ import (
 )
 
 func TestLoadDefaults(t *testing.T) {
-	// Load config without a config file present
+	// Point HOME at an empty temp dir so no real config file is found.
+	t.Setenv("HOME", t.TempDir())
+	homedir.DisableCache = true
+	t.Cleanup(func() { homedir.DisableCache = false })
+
 	cfg, err := Load()
 	require.NoError(t, err)
 	require.NotNil(t, cfg)
diff --git a/internal/git/root_test.go b/internal/git/root_test.go
index de86fea..9b64a15 100644
--- a/internal/git/root_test.go
+++ b/internal/git/root_test.go
@@ -32,7 +32,8 @@ func initGitRepo(t *testing.T, dir string) {
 }
 
 func TestFindRoot_ReturnsRepoRoot(t *testing.T) {
-	dir := t.TempDir()
+	dir, err := filepath.EvalSymlinks(t.TempDir())
+	require.NoError(t, err)
 	initGitRepo(t, dir)
 
 	got := FindRoot(dir)
@@ -40,11 +41,12 @@ func TestFindRoot_ReturnsRepoRoot(t *testing.T) {
 }
 
 func TestFindRoot_Subdir_ReturnsRepoRoot(t *testing.T) {
-	dir := t.TempDir()
+	dir, err := filepath.EvalSymlinks(t.TempDir())
+	require.NoError(t, err)
 	initGitRepo(t, dir)
 
 	subdir := filepath.Join(dir, "some", "nested", "subdir")
-	err := os.MkdirAll(subdir, 0o755)
+	err = os.MkdirAll(subdir, 0o755)
 	require.NoError(t, err)
 
 	got := FindRoot(subdir)
diff --git a/internal/vm/oauth_relay_darwin.go b/internal/vm/oauth_relay_darwin.go
index a7d5715..f693565 100644
--- a/internal/vm/oauth_relay_darwin.go
+++ b/internal/vm/oauth_relay_darwin.go
@@ -101,6 +101,6 @@ func startOAuthRelay(done <-chan struct{}, bootstrapDir string, port string) err
 		_ = srv.Shutdown(ctx)
 	}()
 
-	go srv.Serve(ln)
+	go func() { _ = srv.Serve(ln) }()
 	return nil
 }
diff --git a/internal/vm/oauth_relay_stub.go b/internal/vm/oauth_relay_stub.go
deleted file mode 100644
index 6a777d6..0000000
--- a/internal/vm/oauth_relay_stub.go
+++ /dev/null
@@ -1,6 +0,0 @@
-//go:build !darwin
-
-package vm
-
-func parseOAuthRedirect(rawURL string) (string, bool) { return "", false }
-func startOAuthRelay(done <-chan struct{}, bootstrapDir string, port string) error { return nil }
diff --git a/internal/vm/oauth_relay_test.go b/internal/vm/oauth_relay_test.go
index 96c1475..50fb5dc 100644
--- a/internal/vm/oauth_relay_test.go
+++ b/internal/vm/oauth_relay_test.go
@@ -118,7 +118,7 @@ func TestStartOAuthRelay(t *testing.T) {
 		t.Fatal(err)
 	}
 	port := ln.Addr().(*net.TCPAddr).Port
-	ln.Close()
+	_ = ln.Close()
 
 	tmpDir := t.TempDir()
 	done := make(chan struct{})
@@ -134,7 +134,7 @@ func TestStartOAuthRelay(t *testing.T) {
 	if err != nil {
 		t.Fatalf("GET: %v", err)
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	if resp.StatusCode != http.StatusOK {
 		t.Errorf("status = %d, want 200", resp.StatusCode)
@@ -158,7 +158,7 @@ func TestStartOAuthRelayPortConflict(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer ln.Close()
+	defer func() { _ = ln.Close() }()
 
 	port := ln.Addr().(*net.TCPAddr).Port
 	portStr := fmt.Sprintf("%d", port)
diff --git a/internal/vm/open_url_stub.go b/internal/vm/open_url_stub.go
deleted file mode 100644
index e9aa4c3..0000000
--- a/internal/vm/open_url_stub.go
+++ /dev/null
@@ -1,6 +0,0 @@
-//go:build !darwin
-
-package vm
-
-// watchOpenURL is a no-op on non-darwin platforms.
-func watchOpenURL(done <-chan struct{}, bootstrapDir string) {}