diff --git a/Cargo.toml b/Cargo.toml
index 9b4bf5ef1b..cb736664d9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -153,6 +153,13 @@ non_ascii_idents = "forbid"
 # Deny old style Rust
 rust_2018_idioms = { level = "deny", priority = -1 }
 single_use_lifetimes = "warn"
+# The `class!` macro in `objc` uses an unknown feature. We rely on this in 'installer-downloader'.
+# The unexpected cfg warning stems from https://github.com/SSheldon/rust-objc/issues/125
+# We need to ignore this until cacao migrates to another objc implementation,
+# or we use another `msg_send!` macro ourselves.
+unexpected_cfgs = { level = "warn", check-cfg = [
+  'cfg(feature, values("cargo-clippy"))'
+] }
 unused_lifetimes = "warn"
 unused_macro_rules = "warn"
 
diff --git a/installer-downloader/src/cacao_impl/ui.rs b/installer-downloader/src/cacao_impl/ui.rs
index 522bc3aba3..4bbab14332 100644
--- a/installer-downloader/src/cacao_impl/ui.rs
+++ b/installer-downloader/src/cacao_impl/ui.rs
@@ -41,11 +41,6 @@ static BANNER_COLOR: LazyLock<Color> = LazyLock::new(|| {
     //       calibrated uses the current color profile.
     //       Maybe using calibrated colors is more correct? Rendering different colors *definitely*
     //       is not.
-    // ---
-    // The unexpected cfg warning stems from https://github.com/SSheldon/rust-objc/issues/125
-    // We need to ignore this until cacao migrates to another objc implementation,
-    // or we use another `msg_send!` macro ourselves.
-    #[expect(unexpected_cfgs)]
     let id =
         // SAFETY: This function returns a pointer to a refcounted NSColor instance, and panics if
         //         a null pointer is passed.
diff --git a/mullvad-daemon/src/management_interface.rs b/mullvad-daemon/src/management_interface.rs
index 80c899f9ee..71380a493d 100644
--- a/mullvad-daemon/src/management_interface.rs
+++ b/mullvad-daemon/src/management_interface.rs
@@ -1250,6 +1250,7 @@ impl ManagementService for ManagementServiceImpl {
     ) -> ServiceResult<Self::AppUpgradeEventsListenStream> {
         log::debug!("app_upgrade_events_listen");
         let rx = self.app_upgrade_broadcast.subscribe();
+        #[expect(clippy::result_large_err)]
         let upgrade_event_stream =
             tokio_stream::wrappers::BroadcastStream::new(rx).map(|result| match result {
                 Ok(event) => Ok(event.into()),
diff --git a/talpid-core/src/split_tunnel/windows/path_monitor.rs b/talpid-core/src/split_tunnel/windows/path_monitor.rs
index ddecb19e03..5800af72a7 100644
--- a/talpid-core/src/split_tunnel/windows/path_monitor.rs
+++ b/talpid-core/src/split_tunnel/windows/path_monitor.rs
@@ -127,7 +127,7 @@ macro_rules! get_reparse_path {
         } else {
             let path_buffer = reparse_data.path_buffer.as_ptr();
             let parsed_path = std::slice::from_raw_parts(
-                path_buffer.add((reparse_data.sub_name_offset as usize / mem::size_of::<u16>())),
+                path_buffer.add(reparse_data.sub_name_offset as usize / mem::size_of::<u16>()),
                 reparse_data.sub_name_length as usize / mem::size_of::<u16>(),
             );
             Ok::<PathBuf, io::Error>(PathBuf::from(OsString::from_wide(parsed_path)))
diff --git a/talpid-core/src/window.rs b/talpid-core/src/window.rs
index 6bf13395d8..6d303a724b 100644
--- a/talpid-core/src/window.rs
+++ b/talpid-core/src/window.rs
@@ -70,7 +70,7 @@ pub fn create_hidden_window<F: (Fn(HWND, u32, WPARAM, LPARAM) -> LRESULT) + Send
                 GWLP_WNDPROC,
                 // Clippy does not like casting function pointers to anything but usize.
                 // But this is correct, since the Windows API expects a signed int for pointer.
-                window_procedure::<F> as usize as isize,
+                window_procedure::<F> as *const () as usize as isize,
             );
         }
 
diff --git a/talpid-wireguard/src/wireguard_kernel/wg_message.rs b/talpid-wireguard/src/wireguard_kernel/wg_message.rs
index 68cf39cfc4..f949c4cb2d 100644
--- a/talpid-wireguard/src/wireguard_kernel/wg_message.rs
+++ b/talpid-wireguard/src/wireguard_kernel/wg_message.rs
@@ -605,10 +605,12 @@ mod test {
 
     #[test]
     fn deserialize_netlink_message() {
-        assert!(
-            cfg!(target_endian = "little"),
-            "this test assumes little-endian"
-        );
+        const {
+            assert!(
+                cfg!(target_endian = "little"),
+                "this test assumes little-endian"
+            );
+        }
 
         #[rustfmt::skip]
         let payload = vec![
@@ -845,10 +847,12 @@ mod test {
 
     #[test]
     fn serialize_netlink_message() {
-        assert!(
-            cfg!(target_endian = "little"),
-            "this test assumes little-endian"
-        );
+        const {
+            assert!(
+                cfg!(target_endian = "little"),
+                "this test assumes little-endian"
+            );
+        }
 
         let expected_payload: &[u8] = &[
             0x01, 0x01, 0x00, 0x00, 0x0c, 0x00, 0x02, 0x00, 0x77, 0x67, 0x2d, 0x74, 0x65, 0x73,