diff --git a/crates/executor-core/tests/sdk_subscriber_token.rs b/crates/executor-core/tests/sdk_subscriber_token.rs
index 780eab8..49dad49 100644
--- a/crates/executor-core/tests/sdk_subscriber_token.rs
+++ b/crates/executor-core/tests/sdk_subscriber_token.rs
@@ -197,7 +197,7 @@ async fn unit_ttl_uses_default() {
 async fn empty_topics_throws() {
     run_err(
         make_engine(),
-        r#"pubsub::subscriber_token([], 60)"#,
+        r"pubsub::subscriber_token([], 60)",
         request(AppId::new(), true),
     )
     .await;
diff --git a/crates/manager-core/src/dispatcher.rs b/crates/manager-core/src/dispatcher.rs
index 4c9de30..535aa0b 100644
--- a/crates/manager-core/src/dispatcher.rs
+++ b/crates/manager-core/src/dispatcher.rs
@@ -496,7 +496,7 @@ impl Dispatcher {
         // top of this function, so this fan-out is only reached for
         // non-handler executions.
         if let Some(dl_id) = dl_id {
-            self.fan_out_dead_letter(&row, &resolved, dl_id, &source, attempt, &err, now)
+            self.fan_out_dead_letter(row, resolved, dl_id, &source, attempt, &err, now)
                 .await;
         }
 
diff --git a/crates/manager-core/src/pubsub_service.rs b/crates/manager-core/src/pubsub_service.rs
index 1190ea8..2f5658c 100644
--- a/crates/manager-core/src/pubsub_service.rs
+++ b/crates/manager-core/src/pubsub_service.rs
@@ -254,7 +254,7 @@ impl PubsubService for PubsubServiceImpl {
                 .get(cx.app_id, name)
                 .await
                 .map_err(|e| PubsubError::Unavailable(e.to_string()))?;
-            if !registered.map(|t| t.external_subscribable).unwrap_or(false) {
+            if !registered.is_some_and(|t| t.external_subscribable) {
                 return Err(PubsubError::SubscriberToken(format!(
                     "pubsub::subscriber_token: topic {name} is not externally subscribable"
                 )));
diff --git a/crates/manager-core/src/topic_repo.rs b/crates/manager-core/src/topic_repo.rs
index 207bf57..f425ac9 100644
--- a/crates/manager-core/src/topic_repo.rs
+++ b/crates/manager-core/src/topic_repo.rs
@@ -195,7 +195,7 @@ impl TopicRepo for PostgresTopicRepo {
         .bind(app_id.into_inner())
         .bind(name)
         .bind(external_subscribable)
-        .bind(auth_mode.map(|m| m.as_str()))
+        .bind(auth_mode.map(TopicAuthMode::as_str))
         .fetch_optional(&self.pool)
         .await?;
         row.map(TopicRow::into_topic).transpose()
diff --git a/crates/orchestrator-core/src/realtime_api.rs b/crates/orchestrator-core/src/realtime_api.rs
index 5d68839..d179980 100644
--- a/crates/orchestrator-core/src/realtime_api.rs
+++ b/crates/orchestrator-core/src/realtime_api.rs
@@ -80,7 +80,6 @@ pub fn heartbeat_secs_from_env() -> u64 {
 }
 
 /// Router for the realtime SSE surface. Merged at the router root.
-#[must_use]
 pub fn realtime_router(state: RealtimeState) -> Router {
     Router::new()
         .route("/realtime/topics/{topic}", get(sse_topic))
diff --git a/crates/picloud/src/lib.rs b/crates/picloud/src/lib.rs
index e6d38f9..8ed826b 100644
--- a/crates/picloud/src/lib.rs
+++ b/crates/picloud/src/lib.rs
@@ -198,12 +198,14 @@ pub async fn build_app(
     // plaintext column is dropped in v1.1.8.
     match app_secrets_repo.migrate_plaintext_keys().await {
         Ok(0) => {}
-        Ok(n) => tracing::info!(
-            migrated = n,
-            "encrypted plaintext realtime signing keys at rest"
-        ),
+        Ok(n) => {
+            tracing::info!(
+                migrated = n,
+                "encrypted plaintext realtime signing keys at rest"
+            );
+        }
         Err(e) => {
-            tracing::error!(error = %e, "failed to encrypt realtime signing keys (continuing)")
+            tracing::error!(error = %e, "failed to encrypt realtime signing keys (continuing)");
         }
     }
     let realtime_authority: Arc<dyn RealtimeAuthority> = Arc::new(RealtimeAuthorityImpl::new(