diff --git a/.clang-tidy b/.clang-tidy
index bc84c3f0..e6f5f359 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -21,13 +21,9 @@ Checks: >
     -bugprone-suspicious-string-compare,
     -bugprone-switch-missing-default-case,
   clang-analyzer-*,
-    -clang-analyzer-core.CallAndMessage,
-    -clang-analyzer-deadcode.DeadStores,
     -clang-analyzer-optin.performance.Padding,
-    -clang-analyzer-security.PointerSub,
     -clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling,
     -clang-analyzer-security.insecureAPI.strcpy,
-    -clang-analyzer-unix.Stream,
   clang-diagnostic-*,
   performance-*,
     -performance-avoid-endl,
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 257fc52b..4aecc71a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ env:
   UPX_DEBUG_TEST_LIBC_QSORT: 1
   ZSTD_CLEVEL: 9
   # 2025-01-20
-  ZIG_DIST_VERSION: 0.14.0-dev.2847+db8ed730e
+  ZIG_DIST_VERSION: 0.14.0-dev.2851+b074fb7dd
 
 jobs:
   job-rebuild-and-verify-stubs:
@@ -503,7 +503,7 @@ jobs:
           - { zig_target: x86_64-windows-gnu }
     name: ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }}
     runs-on: ubuntu-latest
-    container: ${{ contains(matrix.qemu, 'qemu-armeb') && 'alpine:3.19' || 'alpine:3.20' }} # qemu-armeb bug
+    container: 'alpine:3.21'
     env:
       UPX_CONFIG_HAVE_WORKING_BUILD_RPATH: ''
       # for zig-cc wrapper scripts (see below):
diff --git a/src/p_lx_elf.cpp b/src/p_lx_elf.cpp
index d8b02b81..25f0cbab 100644
--- a/src/p_lx_elf.cpp
+++ b/src/p_lx_elf.cpp
@@ -43,6 +43,9 @@
 #include "p_lx_elf.h"
 #include "ui.h"
 
+// NOLINTBEGIN(clang-analyzer-core.CallAndMessage)
+// NOLINTBEGIN(clang-analyzer-deadcode.DeadStores)
+
 #if defined(__CHERI__) && defined(__CHERI_PURE_CAPABILITY__)
 #  pragma clang diagnostic ignored "-Wcheri-capability-misuse" // TODO later
 #  pragma clang diagnostic ignored "-Wcheri-provenance" // TODO later
@@ -9122,4 +9125,7 @@ void PackLinuxElf::unpack(OutputFile * /*fo*/)
     throwCantUnpack("internal error");
 }
 
+// NOLINTEND(clang-analyzer-deadcode.DeadStores)
+// NOLINTEND(clang-analyzer-core.CallAndMessage)
+
 /* vim:set ts=4 sw=4 et: */