diff --git a/internal/hostagent/commands_coverage_test.go b/internal/hostagent/commands_coverage_test.go
index f3ef9b9db..484684cbf 100644
--- a/internal/hostagent/commands_coverage_test.go
+++ b/internal/hostagent/commands_coverage_test.go
@@ -20,7 +20,10 @@ func TestCommandClient_LoopsCoverage(t *testing.T) {
 
 	upgrader := websocket.Upgrader{}
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		conn, _ := upgrader.Upgrade(w, r, nil)
+		conn, err := upgrader.Upgrade(w, r, nil)
+		if err != nil {
+			return
+		}
 		defer conn.Close()
 
 		// 1. Receive registration
@@ -82,7 +85,11 @@ func TestCommandClient_PingLoop_Direct(t *testing.T) {
 	// Directly test pingLoop logic for coverage
 	upgrader := websocket.Upgrader{}
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		conn, _ := upgrader.Upgrade(w, r, nil)
+		conn, err := upgrader.Upgrade(w, r, nil)
+		if err != nil {
+			return
+		}
+		defer conn.Close()
 		for {
 			if _, _, err := conn.ReadMessage(); err != nil {
 				return
@@ -92,7 +99,10 @@ func TestCommandClient_PingLoop_Direct(t *testing.T) {
 	defer server.Close()
 
 	dialer := websocket.Dialer{}
-	conn, _, _ := dialer.Dial("ws"+strings.TrimPrefix(server.URL, "http"), nil)
+	conn, _, err := dialer.Dial("ws"+strings.TrimPrefix(server.URL, "http"), nil)
+	if err != nil {
+		t.Fatalf("dial websocket: %v", err)
+	}
 	defer conn.Close()
 
 	client := &CommandClient{
@@ -116,7 +126,10 @@ func TestCommandClient_RegistrationFailure(t *testing.T) {
 
 	upgrader := websocket.Upgrader{}
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		conn, _ := upgrader.Upgrade(w, r, nil)
+		conn, err := upgrader.Upgrade(w, r, nil)
+		if err != nil {
+			return
+		}
 		defer conn.Close()
 
 		// Receive registration
diff --git a/internal/hostagent/smartctl_coverage_test.go b/internal/hostagent/smartctl_coverage_test.go
index 62e2ea058..f80c92081 100644
--- a/internal/hostagent/smartctl_coverage_test.go
+++ b/internal/hostagent/smartctl_coverage_test.go
@@ -1106,7 +1106,8 @@ func TestCollectDeviceSMARTNoDataReturnsNil(t *testing.T) {
 
 func TestListBlockDevicesFreeBSDError(t *testing.T) {
 	origRun := smartRunCommandOutput
-	t.Cleanup(func() { smartRunCommandOutput = origRun })
+	origReadDir := readDir
+	t.Cleanup(func() { smartRunCommandOutput = origRun; readDir = origReadDir })
 
 	smartRunCommandOutput = func(ctx context.Context, name string, args ...string) ([]byte, error) {
 		if name != "sysctl" {
@@ -1114,6 +1115,9 @@ func TestListBlockDevicesFreeBSDError(t *testing.T) {
 		}
 		return nil, errors.New("sysctl failed")
 	}
+	readDir = func(string) ([]os.DirEntry, error) {
+		return nil, errors.New("dev unavailable")
+	}
 
 	if _, err := listBlockDevicesFreeBSD(context.Background(), nil); err == nil {
 		t.Fatalf("expected error")