diff --git a/main.go b/main.go
index ae00977a86d3..62ac452cb70c 100644
--- a/main.go
+++ b/main.go
@@ -416,7 +416,9 @@ func run(state overseer.State) {
 	if *githubScanToken != "" {
 		// NOTE: this kludge is here to do an authenticated shallow commit
 		// TODO: refactor to better pass credentials
-		os.Setenv("GITHUB_TOKEN", *githubScanToken)
+		if err := os.Setenv("GITHUB_TOKEN", *githubScanToken); err != nil {
+			logFatal(err, "error setting github token in environment")
+		}
 	}
 
 	// When setting a base commit, chunks must be scanned in order.
@@ -1063,7 +1065,7 @@ func runSingleScan(ctx context.Context, cmd string, cfg engine.Config) (metrics,
 	for _, ref := range refs {
 		if errs := ref.Snapshot().Errors; len(errs) > 0 {
 			errMsgs := make([]string, len(errs))
-			for i := 0; i < len(errs); i++ {
+			for i := range len(errs) {
 				errMsgs[i] = errs[i].Error()
 			}
 			ctx.Logger().Error(nil, "encountered errors during scan",
@@ -1121,7 +1123,7 @@ func logFatalFunc(logger logr.Logger) func(error, string, ...any) {
 func commaSeparatedToSlice(s []string) []string {
 	var result []string
 	for _, items := range s {
-		for _, item := range strings.Split(items, ",") {
+		for item := range strings.SplitSeq(items, ",") {
 			item = strings.TrimSpace(item)
 			if item == "" {
 				continue