diff --git a/internal/db/gorm/observation_update_test.go b/internal/db/gorm/observation_update_test.go
index e46167e..c86999e 100644
--- a/internal/db/gorm/observation_update_test.go
+++ b/internal/db/gorm/observation_update_test.go
@@ -1,3 +1,5 @@
+//go:build fts5
+
 package gorm
 
 import (
diff --git a/internal/vector/sqlitevec/client.go b/internal/vector/sqlitevec/client.go
index 5d63e59..e609f53 100644
--- a/internal/vector/sqlitevec/client.go
+++ b/internal/vector/sqlitevec/client.go
@@ -526,6 +526,7 @@ func (c *Client) nearest(ctx context.Context, queryBlob []byte, docType, project
 
 // knn runs one vec0 nearest-neighbour query. where holds the MATCH and filters vec0 can answer on their own.
 func (c *Client) knn(ctx context.Context, where string, args []any, limit int) ([]QueryResult, error) {
+	// #nosec G202 -- where is built from constant clauses with "?" placeholders only (see nearest); every value goes via args
 	rows, err := c.db.QueryContext(ctx,
 		"SELECT doc_id, distance, sqlite_id, doc_type, field_type, project, scope FROM vectors"+where+" ORDER BY distance LIMIT ?",
 		append(append([]any{}, args...), limit)...)