diff --git a/pkg/dotc1z/c1file_test.go b/pkg/dotc1z/c1file_test.go
index 65f970ff..b832efc9 100644
--- a/pkg/dotc1z/c1file_test.go
+++ b/pkg/dotc1z/c1file_test.go
@@ -192,7 +192,10 @@ func TestC1ZDecoder(t *testing.T) {
 	require.Equal(t, dbFile, b.Bytes())
 	b.Reset()
 
+	require.GreaterOrEqual(t, n, int64(0))
+
 	// Test max size exact
+	//nolint:gosec // No risk of overflow because n is always >= 0.
 	d, err = NewDecoder(c1zf, WithDecoderMaxDecodedSize(uint64(n)))
 	require.NoError(t, err)
 	_, err = io.Copy(b, d)
@@ -203,6 +206,8 @@ func TestC1ZDecoder(t *testing.T) {
 	b.Reset()
 
 	// Test max size - 1
+	require.GreaterOrEqual(t, n, int64(1))
+	//nolint:gosec // No risk of overflow because n is always > 0.
 	d, err = NewDecoder(c1zf, WithDecoderMaxDecodedSize(uint64(n-1)))
 	require.NoError(t, err)
 	_, err = io.Copy(io.Discard, d)
diff --git a/pkg/dotc1z/decoder.go b/pkg/dotc1z/decoder.go
index dcef25d9..e2360c68 100644
--- a/pkg/dotc1z/decoder.go
+++ b/pkg/dotc1z/decoder.go
@@ -167,6 +167,7 @@ func (d *decoder) Read(p []byte) (int, error) {
 
 	// Do underlying read
 	n, err := d.zd.Read(p)
+	//nolint:gosec // No risk of overflow/underflow because n is always >= 0.
 	d.decodedBytes += uint64(n)
 	if err != nil {
 		// NOTE(morgabra) This happens if you set a small DecoderMaxMemory
diff --git a/pkg/dotc1z/sql_helpers.go b/pkg/dotc1z/sql_helpers.go
index 3bd3fb99..968e9277 100644
--- a/pkg/dotc1z/sql_helpers.go
+++ b/pkg/dotc1z/sql_helpers.go
@@ -183,7 +183,7 @@ func (c *C1File) listConnectorObjects(ctx context.Context, tableName string, req
 	}
 
 	// Clamp the page size
-	pageSize := int(listReq.GetPageSize())
+	pageSize := listReq.GetPageSize()
 	if pageSize > maxPageSize || pageSize == 0 {
 		pageSize = maxPageSize
 	}
@@ -206,7 +206,7 @@ func (c *C1File) listConnectorObjects(ctx context.Context, tableName string, req
 	}
 	defer rows.Close()
 
-	count := 0
+	var count uint32 = 0
 	lastRow := 0
 	for rows.Next() {
 		count++
diff --git a/pkg/dotc1z/sync_runs.go b/pkg/dotc1z/sync_runs.go
index ed0792f7..9d1f7a79 100644
--- a/pkg/dotc1z/sync_runs.go
+++ b/pkg/dotc1z/sync_runs.go
@@ -120,7 +120,7 @@ func (c *C1File) getFinishedSync(ctx context.Context, offset uint) (*syncRun, er
 	return ret, nil
 }
 
-func (c *C1File) ListSyncRuns(ctx context.Context, pageToken string, pageSize int) ([]*syncRun, string, error) {
+func (c *C1File) ListSyncRuns(ctx context.Context, pageToken string, pageSize uint) ([]*syncRun, string, error) {
 	err := c.validateDb(ctx)
 	if err != nil {
 		return nil, "", err
@@ -138,7 +138,7 @@ func (c *C1File) ListSyncRuns(ctx context.Context, pageToken string, pageSize in
 	}
 
 	q = q.Order(goqu.C("id").Asc())
-	q = q.Limit(uint(pageSize + 1))
+	q = q.Limit(pageSize + 1)
 
 	var ret []*syncRun
 
@@ -153,7 +153,7 @@ func (c *C1File) ListSyncRuns(ctx context.Context, pageToken string, pageSize in
 	}
 	defer rows.Close()
 
-	count := 0
+	var count uint = 0
 	lastRow := 0
 	for rows.Next() {
 		count++
diff --git a/pkg/types/grant/grant.go b/pkg/types/grant/grant.go
index 25ff9ede..e59536c9 100644
--- a/pkg/types/grant/grant.go
+++ b/pkg/types/grant/grant.go
@@ -17,6 +17,9 @@ type GrantPrincipal interface {
 	GetBatonResource() bool
 }
 
+// Sometimes C1 doesn't have the grant ID, but does have the principal and entitlement.
+const UnknownGrantId string = "🧸_UNKNOWN_GRANT_ID"
+
 func WithGrantMetadata(metadata map[string]interface{}) GrantOption {
 	return func(g *v2.Grant) error {
 		md, err := structpb.NewStruct(metadata)