diff --git a/agent/agentproc/proc_other.go b/agent/agentproc/proc_other.go
index c0c4e2a25c..c57d7425d7 100644
--- a/agent/agentproc/proc_other.go
+++ b/agent/agentproc/proc_other.go
@@ -7,18 +7,18 @@ import (
 	"github.com/spf13/afero"
 )
 
-func (p *Process) Niceness(sc Syscaller) (int, error) {
+func (*Process) Niceness(Syscaller) (int, error) {
 	return 0, errUnimplemented
 }
 
-func (p *Process) SetNiceness(sc Syscaller, score int) error {
+func (*Process) SetNiceness(Syscaller, int) error {
 	return errUnimplemented
 }
 
-func (p *Process) Cmd() string {
+func (*Process) Cmd() string {
 	return ""
 }
 
-func List(fs afero.Fs, syscaller Syscaller) ([]*Process, error) {
+func List(afero.Fs, Syscaller) ([]*Process, error) {
 	return nil, errUnimplemented
 }
diff --git a/agent/agentproc/syscaller.go b/agent/agentproc/syscaller.go
index 1cd6640e36..25dc6cfd54 100644
--- a/agent/agentproc/syscaller.go
+++ b/agent/agentproc/syscaller.go
@@ -10,6 +10,7 @@ type Syscaller interface {
 	Kill(pid int32, sig syscall.Signal) error
 }
 
+// nolint: unused // used on some but no all platforms
 const defaultProcDir = "/proc"
 
 type Process struct {
diff --git a/agent/agentproc/syscaller_other.go b/agent/agentproc/syscaller_other.go
index 114c553e43..2a355147e2 100644
--- a/agent/agentproc/syscaller_other.go
+++ b/agent/agentproc/syscaller_other.go
@@ -17,14 +17,14 @@ var errUnimplemented = xerrors.New("unimplemented")
 
 type nopSyscaller struct{}
 
-func (nopSyscaller) SetPriority(pid int32, priority int) error {
+func (nopSyscaller) SetPriority(int32, int) error {
 	return errUnimplemented
 }
 
-func (nopSyscaller) GetPriority(pid int32) (int, error) {
+func (nopSyscaller) GetPriority(int32) (int, error) {
 	return 0, errUnimplemented
 }
 
-func (nopSyscaller) Kill(pid int32, sig syscall.Signal) error {
+func (nopSyscaller) Kill(int32, syscall.Signal) error {
 	return errUnimplemented
 }
diff --git a/agent/agentssh/jetbrainstrack.go b/agent/agentssh/jetbrainstrack.go
index 25c8f04dd6..4917227039 100644
--- a/agent/agentssh/jetbrainstrack.go
+++ b/agent/agentssh/jetbrainstrack.go
@@ -4,10 +4,11 @@ import (
 	"strings"
 	"sync"
 
-	"cdr.dev/slog"
 	"github.com/gliderlabs/ssh"
 	"go.uber.org/atomic"
 	gossh "golang.org/x/crypto/ssh"
+
+	"cdr.dev/slog"
 )
 
 // localForwardChannelData is copied from the ssh package.
diff --git a/agent/agentssh/portinspection_unsupported.go b/agent/agentssh/portinspection_unsupported.go
index f010d03858..2b79a0032c 100644
--- a/agent/agentssh/portinspection_unsupported.go
+++ b/agent/agentssh/portinspection_unsupported.go
@@ -2,7 +2,7 @@
 
 package agentssh
 
-func getListeningPortProcessCmdline(port uint32) (string, error) {
+func getListeningPortProcessCmdline(uint32) (string, error) {
 	// We are not worrying about other platforms at the moment because Gateway
 	// only supports Linux anyway.
 	return "", nil
diff --git a/agent/api.go b/agent/api.go
index 857c30e31a..cb4639c0e0 100644
--- a/agent/api.go
+++ b/agent/api.go
@@ -44,8 +44,11 @@ type listeningPortsHandler struct {
 	ignorePorts   map[int]string
 	cacheDuration time.Duration
 
-	mut   sync.Mutex
+	//nolint: unused  // used on some but not all platforms
+	mut sync.Mutex
+	//nolint: unused  // used on some but not all platforms
 	ports []codersdk.WorkspaceAgentListeningPort
+	//nolint: unused  // used on some but not all platforms
 	mtime time.Time
 }
 
diff --git a/agent/ports_unsupported.go b/agent/ports_unsupported.go
index 0af99d1dc7..89ca4f1755 100644
--- a/agent/ports_unsupported.go
+++ b/agent/ports_unsupported.go
@@ -4,7 +4,7 @@ package agent
 
 import "github.com/coder/coder/v2/codersdk"
 
-func (lp *listeningPortsHandler) getListeningPorts() ([]codersdk.WorkspaceAgentListeningPort, error) {
+func (*listeningPortsHandler) getListeningPorts() ([]codersdk.WorkspaceAgentListeningPort, error) {
 	// Can't scan for ports on non-linux or non-windows_amd64 systems at the
 	// moment. The UI will not show any "no ports found" message to the user, so
 	// the user won't suspect a thing.
diff --git a/agent/usershell/usershell_darwin.go b/agent/usershell/usershell_darwin.go
index 47c4a4d21f..0f5be08f82 100644
--- a/agent/usershell/usershell_darwin.go
+++ b/agent/usershell/usershell_darwin.go
@@ -13,6 +13,10 @@ import (
 func Get(username string) (string, error) {
 	// This command will output "UserShell: /bin/zsh" if successful, we
 	// can ignore the error since we have fallback behavior.
+	if !filepath.IsLocal(username) {
+		return "", xerrors.Errorf("username is nonlocal path: %s", username)
+	}
+	//nolint: gosec // input checked above
 	out, _ := exec.Command("dscl", ".", "-read", filepath.Join("/Users", username), "UserShell").Output()
 	s, ok := strings.CutPrefix(string(out), "UserShell: ")
 	if ok {