diff --git a/pkg/caldavtests/client_compat_test.go b/pkg/caldavtests/client_compat_test.go
index f7a103e87..a9fe93b04 100644
--- a/pkg/caldavtests/client_compat_test.go
+++ b/pkg/caldavtests/client_compat_test.go
@@ -57,7 +57,7 @@ func TestClientDAVx5Flow(t *testing.T) {
 		rec = caldavREPORT(t, e, "/dav/projects/36", ReportCalendarQuery)
 		assertResponseStatus(t, rec, 207)
 		ms = parseMultistatus(t, rec)
-		assert.Greater(t, len(ms.Responses), 0,
+		assert.NotEmpty(t, ms.Responses,
 			"Step 5: calendar-query should return tasks")
 
 		// Collect hrefs for multiget
diff --git a/pkg/caldavtests/integrations.go b/pkg/caldavtests/integrations.go
index dbf5bd445..956f25a64 100644
--- a/pkg/caldavtests/integrations.go
+++ b/pkg/caldavtests/integrations.go
@@ -39,14 +39,14 @@ import (
 
 // These are the test users, the same way they are in the test database
 var (
-	testuser1 = user.User{
+	testuser1 = user.User{ //nolint:gosec // test fixture credentials
 		ID:       1,
 		Username: "user1",
 		Password: "$2a$14$dcadBoMBL9jQoOcZK8Fju.cy0Ptx2oZECkKLnaa8ekRoTFe1w7To.",
 		Email:    "user1@example.com",
 		Issuer:   "local",
 	}
-	testuser15 = user.User{
+	testuser15 = user.User{ //nolint:gosec // test fixture credentials
 		ID:       15,
 		Username: "user15",
 		Password: "$2a$14$dcadBoMBL9jQoOcZK8Fju.cy0Ptx2oZECkKLnaa8ekRoTFe1w7To.",
@@ -144,11 +144,3 @@ func caldavOPTIONS(t *testing.T, e *echo.Echo, path string) *httptest.ResponseRe
 	t.Helper()
 	return caldavRequest(t, e, http.MethodOptions, path, "", nil)
 }
-
-// caldavRequestAsUser sends a request authenticated as a specific user.
-func caldavRequestAsUser(t *testing.T, e *echo.Echo, method, path, body string, u *user.User, password string) *httptest.ResponseRecorder {
-	t.Helper()
-	return caldavRequest(t, e, method, path, body, map[string]string{
-		"Authorization": basicAuthHeader(u.Username, password),
-	})
-}
diff --git a/pkg/caldavtests/propfind_test.go b/pkg/caldavtests/propfind_test.go
index c2b4483d5..376a886cb 100644
--- a/pkg/caldavtests/propfind_test.go
+++ b/pkg/caldavtests/propfind_test.go
@@ -120,7 +120,7 @@ func TestPropfindCollection(t *testing.T) {
 				assert.NotEmpty(t, uid, "Each VTODO should have a UID")
 			}
 		}
-		assert.Greater(t, taskCount, 0, "Should have at least one task with calendar-data")
+		assert.Positive(t, taskCount, "Should have at least one task with calendar-data")
 	})
 }
 
diff --git a/pkg/caldavtests/vtodo_builder.go b/pkg/caldavtests/vtodo_builder.go
index ffd57b389..7afc4b25d 100644
--- a/pkg/caldavtests/vtodo_builder.go
+++ b/pkg/caldavtests/vtodo_builder.go
@@ -68,7 +68,7 @@ func NewVTodo(uid, summary string) *VTodoBuilder {
 	}
 }
 
-func (b *VTodoBuilder) Description(d string) *VTodoBuilder    { b.description = d; return b }
+func (b *VTodoBuilder) Description(d string) *VTodoBuilder     { b.description = d; return b }
 func (b *VTodoBuilder) Priority(p int) *VTodoBuilder           { b.priority = p; return b }
 func (b *VTodoBuilder) Due(t time.Time) *VTodoBuilder          { b.due = t; return b }
 func (b *VTodoBuilder) DtStart(t time.Time) *VTodoBuilder      { b.dtstart = t; return b }
@@ -83,7 +83,10 @@ func (b *VTodoBuilder) DtStamp(t time.Time) *VTodoBuilder      { b.dtstamp = t;
 func (b *VTodoBuilder) Created(t time.Time) *VTodoBuilder      { b.created = t; return b }
 func (b *VTodoBuilder) LastModified(t time.Time) *VTodoBuilder { b.lastMod = t; return b }
 func (b *VTodoBuilder) PercentComplete(p int) *VTodoBuilder    { b.percentComplete = p; return b }
-func (b *VTodoBuilder) ExtraProp(line string) *VTodoBuilder    { b.extraProps = append(b.extraProps, line); return b }
+func (b *VTodoBuilder) ExtraProp(line string) *VTodoBuilder {
+	b.extraProps = append(b.extraProps, line)
+	return b
+}
 
 func (b *VTodoBuilder) RelatedToParent(uid string) *VTodoBuilder {
 	b.relatedTo = append(b.relatedTo, relatedToEntry{reltype: "PARENT", uid: uid})
@@ -134,60 +137,60 @@ func (b *VTodoBuilder) Build() string {
 	sb.WriteString("VERSION:2.0\r\n")
 	sb.WriteString("PRODID:-//Test//Test//EN\r\n")
 	sb.WriteString("BEGIN:VTODO\r\n")
-	sb.WriteString(fmt.Sprintf("UID:%s\r\n", b.uid))
-	sb.WriteString(fmt.Sprintf("DTSTAMP:%s\r\n", formatTime(b.dtstamp)))
-	sb.WriteString(fmt.Sprintf("SUMMARY:%s\r\n", b.summary))
-	sb.WriteString(fmt.Sprintf("CREATED:%s\r\n", formatTime(b.created)))
-	sb.WriteString(fmt.Sprintf("LAST-MODIFIED:%s\r\n", formatTime(b.lastMod)))
+	fmt.Fprintf(&sb, "UID:%s\r\n", b.uid)
+	fmt.Fprintf(&sb, "DTSTAMP:%s\r\n", formatTime(b.dtstamp))
+	fmt.Fprintf(&sb, "SUMMARY:%s\r\n", b.summary)
+	fmt.Fprintf(&sb, "CREATED:%s\r\n", formatTime(b.created))
+	fmt.Fprintf(&sb, "LAST-MODIFIED:%s\r\n", formatTime(b.lastMod))
 
 	if b.description != "" {
-		sb.WriteString(fmt.Sprintf("DESCRIPTION:%s\r\n", b.description))
+		fmt.Fprintf(&sb, "DESCRIPTION:%s\r\n", b.description)
 	}
 	if b.priority > 0 {
-		sb.WriteString(fmt.Sprintf("PRIORITY:%d\r\n", b.priority))
+		fmt.Fprintf(&sb, "PRIORITY:%d\r\n", b.priority)
 	}
 	if !b.due.IsZero() {
-		sb.WriteString(fmt.Sprintf("DUE:%s\r\n", formatTime(b.due)))
+		fmt.Fprintf(&sb, "DUE:%s\r\n", formatTime(b.due))
 	}
 	if !b.dtstart.IsZero() {
-		sb.WriteString(fmt.Sprintf("DTSTART:%s\r\n", formatTime(b.dtstart)))
+		fmt.Fprintf(&sb, "DTSTART:%s\r\n", formatTime(b.dtstart))
 	}
 	if !b.completed.IsZero() {
-		sb.WriteString(fmt.Sprintf("COMPLETED:%s\r\n", formatTime(b.completed)))
+		fmt.Fprintf(&sb, "COMPLETED:%s\r\n", formatTime(b.completed))
 	}
 	if b.status != "" {
-		sb.WriteString(fmt.Sprintf("STATUS:%s\r\n", b.status))
+		fmt.Fprintf(&sb, "STATUS:%s\r\n", b.status)
 	}
 	if len(b.categories) > 0 {
-		sb.WriteString(fmt.Sprintf("CATEGORIES:%s\r\n", strings.Join(b.categories, ",")))
+		fmt.Fprintf(&sb, "CATEGORIES:%s\r\n", strings.Join(b.categories, ","))
 	}
 	if b.rrule != "" {
-		sb.WriteString(fmt.Sprintf("RRULE:%s\r\n", b.rrule))
+		fmt.Fprintf(&sb, "RRULE:%s\r\n", b.rrule)
 	}
 	if b.color != "" {
-		sb.WriteString(fmt.Sprintf("X-APPLE-CALENDAR-COLOR:%s\r\n", b.color))
+		fmt.Fprintf(&sb, "X-APPLE-CALENDAR-COLOR:%s\r\n", b.color)
 	}
 	if b.percentComplete > 0 {
-		sb.WriteString(fmt.Sprintf("PERCENT-COMPLETE:%d\r\n", b.percentComplete))
+		fmt.Fprintf(&sb, "PERCENT-COMPLETE:%d\r\n", b.percentComplete)
 	}
 	if b.sequence > 0 {
-		sb.WriteString(fmt.Sprintf("SEQUENCE:%d\r\n", b.sequence))
+		fmt.Fprintf(&sb, "SEQUENCE:%d\r\n", b.sequence)
 	}
 	if b.duration != "" {
-		sb.WriteString(fmt.Sprintf("DURATION:%s\r\n", b.duration))
+		fmt.Fprintf(&sb, "DURATION:%s\r\n", b.duration)
 	}
 	for _, rel := range b.relatedTo {
 		if rel.reltype != "" {
-			sb.WriteString(fmt.Sprintf("RELATED-TO;RELTYPE=%s:%s\r\n", rel.reltype, rel.uid))
+			fmt.Fprintf(&sb, "RELATED-TO;RELTYPE=%s:%s\r\n", rel.reltype, rel.uid)
 		} else {
-			sb.WriteString(fmt.Sprintf("RELATED-TO:%s\r\n", rel.uid))
+			fmt.Fprintf(&sb, "RELATED-TO:%s\r\n", rel.uid)
 		}
 	}
 	for _, alarm := range b.alarms {
 		sb.WriteString("BEGIN:VALARM\r\n")
 		sb.WriteString(alarm.trigger + "\r\n")
-		sb.WriteString(fmt.Sprintf("ACTION:%s\r\n", alarm.action))
-		sb.WriteString(fmt.Sprintf("DESCRIPTION:%s\r\n", alarm.description))
+		fmt.Fprintf(&sb, "ACTION:%s\r\n", alarm.action)
+		fmt.Fprintf(&sb, "DESCRIPTION:%s\r\n", alarm.description)
 		sb.WriteString("END:VALARM\r\n")
 	}
 	for _, prop := range b.extraProps {
diff --git a/pkg/caldavtests/vtodo_roundtrip_test.go b/pkg/caldavtests/vtodo_roundtrip_test.go
index 8f48f2f88..586291220 100644
--- a/pkg/caldavtests/vtodo_roundtrip_test.go
+++ b/pkg/caldavtests/vtodo_roundtrip_test.go
@@ -28,7 +28,7 @@ import (
 
 func TestVTodoRoundTrip(t *testing.T) {
 	// Helper: PUT a VTODO, GET it back, parse the VTODO
-	putAndGet := func(t *testing.T, uid, path string, vtodoBody string) *ics.VTodo {
+	putAndGet := func(t *testing.T, _, path string, vtodoBody string) *ics.VTodo {
 		t.Helper()
 		e := setupTestEnv(t)
 
@@ -231,7 +231,7 @@ func TestVTodoRoundTrip(t *testing.T) {
 func TestVTodoRRuleRoundTrip(t *testing.T) {
 	// RFC 5545 §3.8.5.3 (rfc5545.txt line 6794)
 
-	putAndGet := func(t *testing.T, uid, path string, vtodoBody string) *ics.VTodo {
+	putAndGet := func(t *testing.T, _, path string, vtodoBody string) *ics.VTodo {
 		t.Helper()
 		e := setupTestEnv(t)
 		rec := caldavPUT(t, e, path, vtodoBody)
diff --git a/pkg/caldavtests/xml_helpers.go b/pkg/caldavtests/xml_helpers.go
index 9bb405c57..1161094e2 100644
--- a/pkg/caldavtests/xml_helpers.go
+++ b/pkg/caldavtests/xml_helpers.go
@@ -83,18 +83,6 @@ func parseMultistatus(t *testing.T, rec *httptest.ResponseRecorder) Multistatus
 	return ms
 }
 
-// findResponse finds a response in a multistatus by href substring match.
-func findResponse(t *testing.T, ms Multistatus, hrefSubstring string) Response {
-	t.Helper()
-	for _, r := range ms.Responses {
-		if strings.Contains(r.Href, hrefSubstring) {
-			return r
-		}
-	}
-	t.Fatalf("No response found with href containing %q in multistatus with %d responses", hrefSubstring, len(ms.Responses))
-	return Response{} // unreachable
-}
-
 // getSuccessfulProp returns the Prop from the first propstat with a 200 status.
 func getSuccessfulProp(t *testing.T, r Response) Prop {
 	t.Helper()
@@ -145,16 +133,7 @@ func getVTodoProperty(vtodo *ics.VTodo, prop ics.ComponentProperty) string {
 }
 
 // assertResponseStatus asserts the HTTP status code.
-func assertResponseStatus(t *testing.T, rec *httptest.ResponseRecorder, expectedStatus int) {
+func assertResponseStatus(t *testing.T, rec *httptest.ResponseRecorder, expectedStatus int) { //nolint:unparam
 	t.Helper()
 	assert.Equal(t, expectedStatus, rec.Code, "Response body:\n%s", rec.Body.String())
 }
-
-// assertMultistatusHasResponses asserts that a 207 response contains the expected number of responses.
-func assertMultistatusHasResponses(t *testing.T, rec *httptest.ResponseRecorder, expectedCount int) Multistatus {
-	t.Helper()
-	assertResponseStatus(t, rec, 207)
-	ms := parseMultistatus(t, rec)
-	assert.Len(t, ms.Responses, expectedCount, "Expected %d responses in multistatus, got %d.\nBody:\n%s", expectedCount, len(ms.Responses), rec.Body.String())
-	return ms
-}