diff --git a/src/main/java/com/retailsvc/http/OpenApiServer.java b/src/main/java/com/retailsvc/http/OpenApiServer.java
index bd0e069..550ecff 100644
--- a/src/main/java/com/retailsvc/http/OpenApiServer.java
+++ b/src/main/java/com/retailsvc/http/OpenApiServer.java
@@ -307,9 +307,9 @@ private static void validateSecurityWiring(Spec spec, Map<String, SchemeValidato
           throw new IllegalStateException(
               "security requirement references unknown scheme '" + name + "'");
         }
-        if (scheme instanceof SecurityScheme.Unsupported u) {
+        if (scheme instanceof SecurityScheme.Unsupported(String type)) {
           throw new IllegalStateException(
-              "scheme '" + name + "' uses unsupported type '" + u.type() + "'");
+              "scheme '" + name + "' uses unsupported type '" + type + "'");
         }
         if (!validators.containsKey(name)) {
           throw new IllegalStateException(
diff --git a/src/main/java/com/retailsvc/http/internal/CredentialExtractor.java b/src/main/java/com/retailsvc/http/internal/CredentialExtractor.java
index 9dee2a0..48b0b3b 100644
--- a/src/main/java/com/retailsvc/http/internal/CredentialExtractor.java
+++ b/src/main/java/com/retailsvc/http/internal/CredentialExtractor.java
@@ -60,7 +60,7 @@ private static ExtractionResult extractBasic(HttpExchange exchange) {
     byte[] decoded;
     try {
       decoded = Base64.getDecoder().decode(parts[1]);
-    } catch (IllegalArgumentException e) {
+    } catch (IllegalArgumentException _) {
       return ExtractionResult.malformed();
     }
     String creds = new String(decoded, StandardCharsets.UTF_8);
diff --git a/src/test/java/com/retailsvc/http/SecurityBootValidationTest.java b/src/test/java/com/retailsvc/http/SecurityBootValidationTest.java
index 52a8bc9..f7b747b 100644
--- a/src/test/java/com/retailsvc/http/SecurityBootValidationTest.java
+++ b/src/test/java/com/retailsvc/http/SecurityBootValidationTest.java
@@ -51,14 +51,9 @@ void missingValidatorThrows() {
             List.of(),
             List.of(Map.of("bearerAuth", List.of())));
     Spec spec = Spec.from(r);
+    OpenApiServer.Builder builder = handlerBuilder(spec);
 
-    assertThatThrownBy(
-            () ->
-                OpenApiServer.builder()
-                    .spec(spec)
-                    .handlers(Map.of("getX", req -> Response.ok(Map.of())))
-                    .port(0)
-                    .build())
+    assertThatThrownBy(builder::build)
         .isInstanceOf(IllegalStateException.class)
         .hasMessageContaining("bearerAuth");
   }
@@ -71,14 +66,9 @@ void unsupportedSchemeThrowsWhenReferenced() {
             List.of(),
             List.of(Map.of("oauth", List.of())));
     Spec spec = Spec.from(r);
+    OpenApiServer.Builder builder = handlerBuilder(spec);
 
-    assertThatThrownBy(
-            () ->
-                OpenApiServer.builder()
-                    .spec(spec)
-                    .handlers(Map.of("getX", req -> Response.ok(Map.of())))
-                    .port(0)
-                    .build())
+    assertThatThrownBy(builder::build)
         .isInstanceOf(IllegalStateException.class)
         .hasMessageContaining("unsupported");
   }
@@ -91,18 +81,20 @@ void unknownSchemeReferenceThrows() {
             List.of(),
             List.of(Map.of("missingScheme", List.of())));
     Spec spec = Spec.from(r);
+    OpenApiServer.Builder builder = handlerBuilder(spec);
 
-    assertThatThrownBy(
-            () ->
-                OpenApiServer.builder()
-                    .spec(spec)
-                    .handlers(Map.of("getX", req -> Response.ok(Map.of())))
-                    .port(0)
-                    .build())
+    assertThatThrownBy(builder::build)
         .isInstanceOf(IllegalStateException.class)
         .hasMessageContaining("missingScheme");
   }
 
+  private static OpenApiServer.Builder handlerBuilder(Spec spec) {
+    return OpenApiServer.builder()
+        .spec(spec)
+        .handlers(Map.of("getX", req -> Response.ok(Map.of())))
+        .port(0);
+  }
+
   @Test
   void externalAuthSkipsAllChecks() throws Exception {
     Map<String, Object> r =