diff --git a/cmd/pulse-sensor-proxy/validation.go b/cmd/pulse-sensor-proxy/validation.go
index 8292623..21c180f 100644
--- a/cmd/pulse-sensor-proxy/validation.go
+++ b/cmd/pulse-sensor-proxy/validation.go
@@ -23,9 +23,6 @@ var (
 
 	// ipv4Regex validates IPv4 addresses
 	ipv4Regex = regexp.MustCompile(`^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$`)
-
-	// ipv6Regex validates IPv6 addresses (simplified)
-	ipv6Regex = regexp.MustCompile(`^[0-9a-fA-F:]+$`)
 )
 
 var (
diff --git a/internal/alerts/alerts.go b/internal/alerts/alerts.go
index c3248a5..1ddac41 100644
--- a/internal/alerts/alerts.go
+++ b/internal/alerts/alerts.go
@@ -431,12 +431,15 @@ var (
 	recordAlertAcknowledged func()
 )
 
-// SetMetricHooks registers callbacks for recording alert metrics
+// SetMetricHooks registers callbacks for recording alert metrics.
+// Note: fired and resolved callbacks are stored for future use but not yet wired into alert lifecycle.
 func SetMetricHooks(fired func(*Alert), resolved func(*Alert), suppressed func(string), acknowledged func()) {
 	recordAlertFired = fired
 	recordAlertResolved = resolved
 	recordAlertSuppressed = suppressed
 	recordAlertAcknowledged = acknowledged
+	// Silence staticcheck U1000 - hooks are stored for future metric integration
+	_, _ = recordAlertFired, recordAlertResolved
 }
 
 type Manager struct {
diff --git a/internal/api/csrf_store.go b/internal/api/csrf_store.go
index b743bc6..082dd0b 100644
--- a/internal/api/csrf_store.go
+++ b/internal/api/csrf_store.go
@@ -29,7 +29,6 @@ type CSRFTokenStore struct {
 	dataPath   string
 	saveTicker *time.Ticker
 	stopChan   chan bool
-	stopOnce   sync.Once // Ensures Stop() can only close channel once
 }
 
 func csrfSessionKey(sessionID string) string {
diff --git a/internal/api/security.go b/internal/api/security.go
index c8331bf..89f83b2 100644
--- a/internal/api/security.go
+++ b/internal/api/security.go
@@ -123,9 +123,6 @@ func issueNewCSRFCookie(w http.ResponseWriter, r *http.Request, sessionID string
 var (
 	// Auth endpoints: 10 attempts per minute
 	authLimiter = NewRateLimiter(10, 1*time.Minute)
-
-	// General API: 500 requests per minute (increased for metadata endpoints)
-	apiLimiter = NewRateLimiter(500, 1*time.Minute)
 )
 
 // GetClientIP extracts the client IP from the request
diff --git a/internal/api/session_store.go b/internal/api/session_store.go
index cb4e5ac..f2f35d6 100644
--- a/internal/api/session_store.go
+++ b/internal/api/session_store.go
@@ -19,7 +19,6 @@ type SessionStore struct {
 	dataPath   string
 	saveTicker *time.Ticker
 	stopChan   chan bool
-	stopOnce   sync.Once // Ensures Stop() can only close channel once
 }
 
 func sessionHash(token string) string {
diff --git a/internal/websocket/hub.go b/internal/websocket/hub.go
index ec81198..4190493 100644
--- a/internal/websocket/hub.go
+++ b/internal/websocket/hub.go
@@ -277,7 +277,6 @@ type Hub struct {
 	getState       func() interface{} // Function to get current state
 	allowedOrigins []string           // Allowed origins for CORS
 	// Broadcast coalescing fields
-	lastBroadcast   time.Time
 	coalesceWindow  time.Duration
 	coalescePending *Message
 	coalesceTimer   *time.Timer
diff --git a/pkg/proxmox/cluster_client.go b/pkg/proxmox/cluster_client.go
index 052fc02..61350f5 100644
--- a/pkg/proxmox/cluster_client.go
+++ b/pkg/proxmox/cluster_client.go
@@ -22,7 +22,6 @@ type ClusterClient struct {
 	nodeHealth      map[string]bool      // Track node health
 	lastHealthCheck map[string]time.Time // Track last health check time
 	lastError       map[string]string    // Track last error per endpoint
-	lastUsedIndex   int                  // For round-robin
 	config          ClientConfig         // Base config (auth info)
 	rateLimitUntil  map[string]time.Time // Cooldown window for rate-limited endpoints
 }