diff --git a/pkg/oidcclient/login.go b/pkg/oidcclient/login.go
index 5f7fa39d..60c703f8 100644
--- a/pkg/oidcclient/login.go
+++ b/pkg/oidcclient/login.go
@@ -63,7 +63,7 @@ const (
 	// For CLI-based auth, such as with LDAP upstream identity providers, the user may use these environment variables
 	// to avoid getting interactively prompted for username and password.
 	defaultUsernameEnvVarName = "PINNIPED_USERNAME"
-	defaultPasswordEnvVarName = "PINNIPED_PASSWORD"
+	defaultPasswordEnvVarName = "PINNIPED_PASSWORD" //nolint:gosec // this is not a credential
 
 	httpLocationHeaderName = "Location"
 
diff --git a/test/integration/e2e_test.go b/test/integration/e2e_test.go
index 8e6c35e5..2a54a0a2 100644
--- a/test/integration/e2e_test.go
+++ b/test/integration/e2e_test.go
@@ -471,7 +471,7 @@ func TestE2EFullIntegration(t *testing.T) {
 			}
 		})
 		require.NoError(t, os.Setenv(usernameEnvVar, expectedUsername))
-		const passwordEnvVar = "PINNIPED_PASSWORD"
+		const passwordEnvVar = "PINNIPED_PASSWORD" //nolint:gosec // this is not a credential
 		originalPassword, hadOriginalPassword := os.LookupEnv(passwordEnvVar)
 		t.Cleanup(func() {
 			if hadOriginalPassword {