diff --git a/internal/tools/mockmirror-build-fake/main.go b/internal/tools/mockmirror-build-fake/main.go
index fbc6a77..9a12e43 100644
--- a/internal/tools/mockmirror-build-fake/main.go
+++ b/internal/tools/mockmirror-build-fake/main.go
@@ -7,6 +7,7 @@ import (
 	"bytes"
 	"errors"
 	"flag"
+	"fmt"
 	"log"
 	"os"
 	"os/exec"
@@ -19,22 +20,28 @@ import (
 )
 
 func main() {
+	if err := runMain(); err != nil {
+		log.Fatal(err)
+	}
+}
+
+func runMain() error {
 	file := ""
 	flag.StringVar(&file, "file", file, "File to write to.")
 	flag.Parse()
 
 	dir := path.Join(os.TempDir(), "fake")
 	if err := os.MkdirAll(dir, 0755); err != nil {
-		log.Fatal(err)
+		return err
 	}
 	defer func() {
 		_ = os.RemoveAll(dir)
 	}()
-	if err := os.WriteFile(path.Join(dir, "go.mod"), []byte(gomod), 0644); err != nil {
-		log.Fatal(err)
+	if err := os.WriteFile(path.Join(dir, "go.mod"), []byte(gomod), 0644); err != nil { //nolint:gosec //This is not sensitive.
+		return err
 	}
-	if err := os.WriteFile(path.Join(dir, "main.go"), []byte(code), 0644); err != nil {
-		log.Fatal()
+	if err := os.WriteFile(path.Join(dir, "main.go"), []byte(code), 0644); err != nil { //nolint:gosec //This is not sensitive.
+		return err
 	}
 
 	cmd := exec.Command("go", "build", "-ldflags", "-s -w", "-o", "fake")
@@ -44,20 +51,19 @@ func main() {
 	if err := cmd.Run(); err != nil {
 		var exitErr *exec.ExitError
 		if errors.As(err, &exitErr) {
-			log.Println("Build failed.")
-			os.Exit(exitErr.ExitCode())
+			return fmt.Errorf("build failed (exit code %d)", exitErr.ExitCode())
 		}
-		log.Fatal(err)
+		return err
 	}
 
 	contents, err := os.ReadFile(path.Join(dir, "fake"))
 	if err != nil {
-		log.Fatal(err)
+		return err
 	}
 
 	tpl := template.New("")
 	if tpl, err = tpl.Parse(templateText); err != nil {
-		log.Fatal(err)
+		return err
 	}
 
 	parts := make([]string, len(contents))
@@ -82,15 +88,16 @@ func main() {
 		contentsCode,
 		file,
 	}); err != nil {
-		log.Fatal(err)
+		return err
 	}
 
-	if err := os.WriteFile(file+"~", buf.Bytes(), 0644); err != nil {
-		log.Fatal(err)
+	if err := os.WriteFile(file+"~", buf.Bytes(), 0644); err != nil { //nolint:gosec //This is not sensitive.
+		return err
 	}
 	if err := os.Rename(file+"~", file); err != nil {
-		log.Fatal(err)
+		return err
 	}
+	return nil
 }
 
 var templateText = `// Copyright (c) {{ .Authors }}
diff --git a/mirror_create_version.go b/mirror_create_version.go
index db64e2a..07d0952 100644
--- a/mirror_create_version.go
+++ b/mirror_create_version.go
@@ -10,7 +10,7 @@ import (
 	"fmt"
 )
 
-func (m *mirror) CreateVersion(ctx context.Context, version Version) error {
+func (m *mirror) CreateVersion(_ context.Context, version Version) error {
 	if m.pullThroughDownloader != nil {
 		return fmt.Errorf("cannot use CreateVersionAsset when a pull-through mirror is configured")
 	}
@@ -43,7 +43,7 @@ func (m *mirror) CreateVersion(ctx context.Context, version Version) error {
 			ID:    version,
 			Files: []string{},
 		},
-	})
+	}, responseData.Versions...)
 
 	marshalled, err := json.Marshal(responseData)
 	if err != nil {
diff --git a/mirror_create_version_asset.go b/mirror_create_version_asset.go
index 86e17ef..d3dea92 100644
--- a/mirror_create_version_asset.go
+++ b/mirror_create_version_asset.go
@@ -9,7 +9,7 @@ import (
 	"fmt"
 )
 
-func (m *mirror) CreateVersionAsset(ctx context.Context, version Version, assetName string, assetData []byte) error {
+func (m *mirror) CreateVersionAsset(_ context.Context, version Version, assetName string, assetData []byte) error {
 	if m.pullThroughDownloader != nil {
 		return fmt.Errorf("cannot use CreateVersionAsset when a pull-through mirror is configured")
 	}
diff --git a/mirror_serve_http.go b/mirror_serve_http.go
index 7488176..10f1e98 100644
--- a/mirror_serve_http.go
+++ b/mirror_serve_http.go
@@ -33,7 +33,7 @@ func (m *mirror) serveAPI(ctx context.Context, writer http.ResponseWriter) {
 		m.badGateway(writer)
 		return
 	}
-	writer.WriteHeader(200)
+	writer.WriteHeader(http.StatusOK)
 	writer.Header().Set("Content-Type", "application/json")
 	_, _ = writer.Write(encoded)
 }
@@ -60,6 +60,7 @@ func (m *mirror) serveAsset(ctx context.Context, writer http.ResponseWriter, req
 	}
 	var foundVersion *VersionWithArtifacts
 	for _, ver := range versions {
+		ver := ver
 		if ver.ID == version {
 			foundVersion = &ver
 			break
@@ -75,7 +76,7 @@ func (m *mirror) serveAsset(ctx context.Context, writer http.ResponseWriter, req
 		m.badGateway(writer)
 		return
 	}
-	writer.WriteHeader(200)
+	writer.WriteHeader(http.StatusOK)
 	writer.Header().Set("Content-Type", "application/octet-stream")
 	_, _ = writer.Write(contents)
 }
diff --git a/mockmirror/fake.go b/mockmirror/fake.go
index 2456195..d79bdf9 100644
--- a/mockmirror/fake.go
+++ b/mockmirror/fake.go
@@ -55,7 +55,7 @@ func buildFake(t *testing.T) []byte {
 		t.Fatalf("Failed to read compiled fake (%v)", err)
 	}
 
-	if err := os.WriteFile(binaryPath, contents, 0700); err != nil {
+	if err := os.WriteFile(binaryPath, contents, 0700); err != nil { //nolint:gosec //This needs to be executable.
 		t.Fatalf("Failed to create fake binary at %s (%v)", binaryPath, err)
 	}
 	return contents
diff --git a/mockmirror/mockmirror.go b/mockmirror/mockmirror.go
index 58c3318..3f68a1d 100644
--- a/mockmirror/mockmirror.go
+++ b/mockmirror/mockmirror.go
@@ -9,6 +9,7 @@ import (
 	"net/http"
 	"strconv"
 	"testing"
+	"time"
 
 	"github.com/ProtonMail/gopenpgp/v2/crypto"
 	"github.com/opentofu/tofudl"
@@ -62,10 +63,16 @@ func NewFromBinary(
 	if err != nil {
 		t.Fatalf("Failed to open listen socket for mock mirror (%v)", err)
 	}
+	srv := &http.Server{
+		ReadTimeout:  5 * time.Second,
+		WriteTimeout: 10 * time.Second,
+		Handler:      tofudlMirror,
+	}
 	go func() {
-		_ = http.Serve(ln, tofudlMirror)
+		_ = srv.Serve(ln)
 	}()
 	t.Cleanup(func() {
+		_ = srv.Shutdown(context.Background())
 		_ = ln.Close()
 	})
 	return &mirror{