diff --git a/internal/kms/vault.go b/internal/kms/vault.go
index 66da402ccbd..efc34fa5b8c 100644
--- a/internal/kms/vault.go
+++ b/internal/kms/vault.go
@@ -305,7 +305,7 @@ func (vc *vaultConnection) Destroy() {
 		tmpFile, ok := vc.vaultConfig[api.EnvVaultCACert]
 		if ok {
 			// ignore error on failure to remove tmpfile (gosec complains)
-			//nolint:forcetypeassert // ignore error on failure to remove tmpfile
+			//nolint:forcetypeassert,errcheck // ignore error on failure to remove tmpfile
 			_ = os.Remove(tmpFile.(string))
 		}
 	}
diff --git a/internal/kms/vault_tokens_test.go b/internal/kms/vault_tokens_test.go
index b14f1c24956..e21c35a20e7 100644
--- a/internal/kms/vault_tokens_test.go
+++ b/internal/kms/vault_tokens_test.go
@@ -119,7 +119,7 @@ func TestInitVaultTokensKMS(t *testing.T) {
 	// add tenant "bob"
 	bob := make(map[string]interface{})
 	bob["vaultAddress"] = "https://vault.bob.example.org"
-	//nolint:forcetypeassert // as its a test we dont need to check assertion here.
+	//nolint:forcetypeassert,errcheck // as its a test we dont need to check assertion here.
 	args.Config["tenants"].(map[string]interface{})["bob"] = bob
 
 	_, err = initVaultTokensKMS(args)