diff --git a/internal/auth/proxy_test.go b/internal/auth/proxy_test.go
index 17082486..b68bcbca 100644
--- a/internal/auth/proxy_test.go
+++ b/internal/auth/proxy_test.go
@@ -30,7 +30,7 @@ func TestForwardProxyAuthRejectsInvalidFilter(t *testing.T) {
 
 func TestUserFromContextInvalidFilterReturnsNil(t *testing.T) {
 	tokenAuth := jwtauth.New("HS256", []byte("secret"), nil)
-	_, tokenString, err := tokenAuth.Encode(map[string]interface{}{
+	_, tokenString, err := tokenAuth.Encode(map[string]any{
 		"username": "alice",
 		"email":    "alice@example.com",
 		"name":     "Alice",
diff --git a/internal/deploy/manager_test.go b/internal/deploy/manager_test.go
index 60600e68..8ec9a098 100644
--- a/internal/deploy/manager_test.go
+++ b/internal/deploy/manager_test.go
@@ -321,7 +321,7 @@ func TestManager_Deploy_SerializesSameProject(t *testing.T) {
 	var wg sync.WaitGroup
 	wg.Add(2)
 	errs := make(chan error, 2)
-	for i := 0; i < 2; i++ {
+	for range 2 {
 		go func() {
 			defer wg.Done()
 			errs <- mgr.Deploy(context.Background(), "shared", []byte(testCompose), nil)
@@ -373,7 +373,7 @@ func TestManager_Deploy_ParallelizesDifferentProjects(t *testing.T) {
 	}()
 
 	// Both must reach the docker call before either is released.
-	for i := 0; i < 2; i++ {
+	for range 2 {
 		select {
 		case <-reached:
 		case <-time.After(2 * time.Second):