diff --git a/.github/workflows/cppcheck.yml b/.github/workflows/cppcheck.yml
index c728a6b67..b90910570 100644
--- a/.github/workflows/cppcheck.yml
+++ b/.github/workflows/cppcheck.yml
@@ -24,6 +24,8 @@ jobs:
       - name: Run CppCheck
         id: cpp_check_run
         if: always()
+        # bash gets -o pipefail, so tee keeps cppcheck's exit code
+        shell: bash
         run: >
           cppcheck
           -UWSCPFILEHDR -UXSNPRINTF
@@ -41,7 +43,7 @@ jobs:
           3>&1 1>&2 2>&3 | tee cppcheck.txt
 
       - name: Upload cppcheck results as artifact
-        if: always()
+        if: failure() && steps.cpp_check_run.outcome == 'failure'
         uses: actions/upload-artifact@v7
         with:
           name: wolfssh-${{ github.sha }}-cppcheck_results.txt
diff --git a/apps/wolfsshd/wolfsshd.c b/apps/wolfsshd/wolfsshd.c
index 58ce36c0d..003851260 100644
--- a/apps/wolfsshd/wolfsshd.c
+++ b/apps/wolfsshd/wolfsshd.c
@@ -4631,8 +4631,9 @@ static int StartSSHD(int argc, char** argv)
                 "wolfSSH_HostKeyStore. Use one or the other.");
             ret = WS_BAD_ARGUMENT;
         }
+        else
     #endif
-        if (ret == WS_SUCCESS) {
+        {
             wolfSSHD_ConfigSetHostKeyFile(conf, hostKeyFile);
         }
     }
diff --git a/src/internal.c b/src/internal.c
index 3b305d0d3..f142c0db9 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -25464,28 +25464,19 @@ static int CompositeEccSign(void* key, WC_RNG* rng, void* heap,
         word32 rSz = MAX_ECC_BYTES + ECC_MAX_PAD_SZ,
                sSz = MAX_ECC_BYTES + ECC_MAX_PAD_SZ;
 #ifdef WOLFSSH_SMALL_STACK
-        byte* rBuf = NULL;
-        byte* sBuf = NULL;
-
-        rBuf = (byte*)WMALLOC(MAX_ECC_BYTES + ECC_MAX_PAD_SZ, heap,
+        byte* rBuf = (byte*)WMALLOC(MAX_ECC_BYTES + ECC_MAX_PAD_SZ, heap,
+                DYNTYPE_TEMP);
+        byte* sBuf = (byte*)WMALLOC(MAX_ECC_BYTES + ECC_MAX_PAD_SZ, heap,
                 DYNTYPE_TEMP);
-        if (rBuf == NULL)
+
+        if (rBuf == NULL || sBuf == NULL)
             ret = WS_MEMORY_E;
-        if (ret == 0) {
-            sBuf = (byte*)WMALLOC(MAX_ECC_BYTES + ECC_MAX_PAD_SZ, heap,
-                    DYNTYPE_TEMP);
-            if (sBuf == NULL)
-                ret = WS_MEMORY_E;
-        }
+        else
 #else
-        byte rStore[MAX_ECC_BYTES + ECC_MAX_PAD_SZ];
-        byte sStore[MAX_ECC_BYTES + ECC_MAX_PAD_SZ];
-        byte* rBuf = rStore;
-        byte* sBuf = sStore;
+        byte rBuf[MAX_ECC_BYTES + ECC_MAX_PAD_SZ];
+        byte sBuf[MAX_ECC_BYTES + ECC_MAX_PAD_SZ];
 #endif
-
-        /* NULL only when a small-stack allocation above failed */
-        if (rBuf != NULL && sBuf != NULL) {
+        {
             ret = wc_ecc_sig_to_rs(asnSig, asnSigSz, rBuf, &rSz, sBuf, &sSz);
         }
         if (ret == 0) {
diff --git a/src/wolfsftp.c b/src/wolfsftp.c
index a5659c457..3f9b3a17d 100644
--- a/src/wolfsftp.c
+++ b/src/wolfsftp.c
@@ -4418,6 +4418,7 @@ int wolfSSH_SFTP_RecvWrite(WOLFSSH* ssh, int reqId, byte* data, word32 maxSz)
                     /* FXF_APPEND: the offset is ignored and the O_APPEND
                      * fd puts the write at EOF. pwrite() would honor the
                      * offset on every POSIX system but Linux. */
+                    /* cppcheck-suppress constStatement */
                     ret = WWRITE(ssh->fs, fd, (byte*)str + written,
                             strSz - written);
                 }