diff --git a/pkg/providers/anthropic_messages/provider.go b/pkg/providers/anthropic_messages/provider.go
index 679a4e966..55bb41e66 100644
--- a/pkg/providers/anthropic_messages/provider.go
+++ b/pkg/providers/anthropic_messages/provider.go
@@ -103,9 +103,9 @@ func (p *Provider) Chat(
 	// Set headers
 	req.Header.Set("Content-Type", "application/json")
 	req.Header.Set(
-		"X-API-Key",
+		"X-Api-Key",
 		p.apiKey,
-	) //nolint:canonicalheader // Anthropic API requires exact header name
+	)
 	req.Header.Set("Anthropic-Version", defaultAPIVersion)
 
 	// Execute request
diff --git a/web/backend/api/config.go b/web/backend/api/config.go
index db8167311..9fb9e2037 100644
--- a/web/backend/api/config.go
+++ b/web/backend/api/config.go
@@ -68,12 +68,13 @@ func (h *Handler) handleUpdateConfig(w http.ResponseWriter, r *http.Request) {
 	// Intercept explicitly provided security tokens from JSON payload that json.Unmarshal drops.
 	// We need to decode into an anonymous struct with json tags because SecurityConfig
 	// doesn't have json tags for its fields (it uses yaml tags).
-	var incomingSec struct {
+	type securityConfigPayload struct {
 		ModelList map[string]config.ModelSecurityEntry `json:"model_list"`
 		Channels  *config.ChannelsSecurity             `json:"channels,omitempty"`
 		Web       *config.WebToolsSecurity             `json:"web,omitempty"`
 		Skills    *config.SkillsSecurity               `json:"skills,omitempty"`
 	}
+	var incomingSec securityConfigPayload
 	if err := json.Unmarshal(body, &incomingSec); err == nil {
 		secConfig := config.SecurityConfig{
 			ModelList: incomingSec.ModelList,
@@ -177,12 +178,13 @@ func (h *Handler) handlePatchConfig(w http.ResponseWriter, r *http.Request) {
 
 	// Restore security fields from existing config and merge explicitly provided overrides.
 	newCfg.SecurityCopyFrom(cfg)
-	var patchSec struct {
+	type patchSecurityConfigPayload struct {
 		ModelList map[string]config.ModelSecurityEntry `json:"model_list"`
 		Channels  *config.ChannelsSecurity             `json:"channels,omitempty"`
 		Web       *config.WebToolsSecurity             `json:"web,omitempty"`
 		Skills    *config.SkillsSecurity               `json:"skills,omitempty"`
 	}
+	var patchSec patchSecurityConfigPayload
 	if err := json.Unmarshal(patchBody, &patchSec); err == nil {
 		secConfig := config.SecurityConfig{
 			ModelList: patchSec.ModelList,