diff --git a/config/crd/bases/postgres-operator.crunchydata.com_postgresclusters.yaml b/config/crd/bases/postgres-operator.crunchydata.com_postgresclusters.yaml
index 0c6558cc28..eb71aba33b 100644
--- a/config/crd/bases/postgres-operator.crunchydata.com_postgresclusters.yaml
+++ b/config/crd/bases/postgres-operator.crunchydata.com_postgresclusters.yaml
@@ -18250,8 +18250,8 @@ spec:
             type: object
             x-kubernetes-validations:
             - message: The ssl_groups parameter is only available in pg18 and greater
-              rule: '!has(self.?config.parameters.ssl_groups) || self.postgresVersion
-                > 17'
+              rule: '!has(self.config) || !has(self.config.parameters) || !has(self.config.parameters.ssl_groups)
+                || self.postgresVersion > 17'
           status:
             description: PostgresClusterStatus defines the observed state of PostgresCluster
             properties:
diff --git a/internal/controller/pgupgrade/jobs.go b/internal/controller/pgupgrade/jobs.go
index 53420cb8fe..c7b6e4e010 100644
--- a/internal/controller/pgupgrade/jobs.go
+++ b/internal/controller/pgupgrade/jobs.go
@@ -192,6 +192,7 @@ func (r *PGUpgradeReconciler) generateUpgradeJob(
 	settings := upgrade.Spec.PGUpgradeSettings.DeepCopy()
 
 	// When jobs is undefined, use one less than the number of CPUs.
+	//nolint:gosec // The CPU count is clamped to MaxInt32.
 	if settings.Jobs == 0 && feature.Enabled(ctx, feature.PGUpgradeCPUConcurrency) {
 		wholeCPUs := int32(min(math.MaxInt32, largestWholeCPU(upgrade.Spec.Resources)))
 		settings.Jobs = wholeCPUs - 1
diff --git a/internal/controller/postgrescluster/instance.go b/internal/controller/postgrescluster/instance.go
index d2ac4e3bb5..b3bf0b6f75 100644
--- a/internal/controller/postgrescluster/instance.go
+++ b/internal/controller/postgrescluster/instance.go
@@ -335,6 +335,7 @@ func (r *Reconciler) observeInstances(
 		status.DesiredPGDataVolume = make(map[string]string)
 
 		for _, instance := range observed.bySet[name] {
+			//nolint:gosec // This slice is always small.
 			status.Replicas += int32(len(instance.Pods))
 
 			if ready, known := instance.IsReady(); known && ready {
diff --git a/pkg/apis/postgres-operator.crunchydata.com/v1beta1/postgrescluster_types.go b/pkg/apis/postgres-operator.crunchydata.com/v1beta1/postgrescluster_types.go
index 6db6ce7459..46b7d0be43 100644
--- a/pkg/apis/postgres-operator.crunchydata.com/v1beta1/postgrescluster_types.go
+++ b/pkg/apis/postgres-operator.crunchydata.com/v1beta1/postgrescluster_types.go
@@ -17,7 +17,7 @@ import (
 //
 // # Postgres 18
 //
-// +kubebuilder:validation:XValidation:rule=`!has(self.?config.parameters.ssl_groups) || self.postgresVersion > 17`,message=`The ssl_groups parameter is only available in pg18 and greater`
+// +kubebuilder:validation:XValidation:rule=`!has(self.config) || !has(self.config.parameters) || !has(self.config.parameters.ssl_groups) || self.postgresVersion > 17`,message=`The ssl_groups parameter is only available in pg18 and greater`
 type PostgresClusterSpec struct {
 	// +optional
 	Metadata *Metadata `json:"metadata,omitempty"`