diff --git a/internal/httpapi/routes_api_keys_test.go b/internal/httpapi/routes_api_keys_test.go
index 24a3b50..f4496b3 100644
--- a/internal/httpapi/routes_api_keys_test.go
+++ b/internal/httpapi/routes_api_keys_test.go
@@ -25,7 +25,7 @@ func TestBearerDevWithoutInsecureDev(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 	if resp.StatusCode != http.StatusOK {
 		b, _ := io.ReadAll(resp.Body)
 		t.Fatalf("status=%d body=%s", resp.StatusCode, b)
@@ -53,7 +53,7 @@ func TestAPIKeysCRUDAndAuth(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer respCreate.Body.Close()
+	defer func() { _ = respCreate.Body.Close() }()
 	if respCreate.StatusCode != http.StatusCreated {
 		b, _ := io.ReadAll(respCreate.Body)
 		t.Fatalf("create status=%d body=%s", respCreate.StatusCode, b)
@@ -77,7 +77,7 @@ func TestAPIKeysCRUDAndAuth(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer respMod.Body.Close()
+	defer func() { _ = respMod.Body.Close() }()
 	if respMod.StatusCode != http.StatusOK {
 		b, _ := io.ReadAll(respMod.Body)
 		t.Fatalf("modules status=%d body=%s", respMod.StatusCode, b)
@@ -89,7 +89,7 @@ func TestAPIKeysCRUDAndAuth(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer respDel.Body.Close()
+	defer func() { _ = respDel.Body.Close() }()
 	if respDel.StatusCode != http.StatusNoContent {
 		t.Fatalf("delete status=%d", respDel.StatusCode)
 	}
@@ -100,7 +100,7 @@ func TestAPIKeysCRUDAndAuth(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer respAfter.Body.Close()
+	defer func() { _ = respAfter.Body.Close() }()
 	if respAfter.StatusCode != http.StatusUnauthorized {
 		t.Fatalf("expected 401 after revoke, got %d", respAfter.StatusCode)
 	}
@@ -112,7 +112,7 @@ func TestAPIKeysCRUDAndAuth(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer respNode.Body.Close()
+	defer func() { _ = respNode.Body.Close() }()
 	if respNode.StatusCode != http.StatusForbidden {
 		t.Fatalf("node list api-keys status=%d want 403", respNode.StatusCode)
 	}
diff --git a/internal/store/backend.go b/internal/store/backend.go
index 0d17680..2eabf87 100644
--- a/internal/store/backend.go
+++ b/internal/store/backend.go
@@ -260,10 +260,10 @@ type APIKeyCreate struct {
 
 // APIKeyPatch is a partial update (role change affects auth after resolver reload).
 type APIKeyPatch struct {
-	Name             *string    `json:"name,omitempty"`
-	Role             *string    `json:"role,omitempty"`
-	ExpiresAt        *time.Time `json:"expires_at,omitempty"`
-	ClearExpiresAt   bool       `json:"-"`
+	Name           *string    `json:"name,omitempty"`
+	Role           *string    `json:"role,omitempty"`
+	ExpiresAt      *time.Time `json:"expires_at,omitempty"`
+	ClearExpiresAt bool       `json:"-"`
 }
 
 // APIKeyWithSecret is returned only on create/rotate.