diff --git a/env/checks.mk b/env/checks.mk
index bd6d2f358..58ec97edc 100644
--- a/env/checks.mk
+++ b/env/checks.mk
@@ -15,6 +15,8 @@ checks += bugprone-*
 checks/bugprone-argument-comment.StrictMode := true
 checks += -bugprone-branch-clone
 checks += -bugprone-easily-swappable-parameters
+# XXX: I should enable this check and do a comprehensive audit
+checks += -bugprone-empty-catch
 # XXX: this is higher priority but I'm not ready for this yet
 checks += -bugprone-exception-escape
 checks/bugprone-exception-escape.IgnoredExceptions := "broken_promise"
@@ -34,9 +36,12 @@ checks += -cert-env33-c
 checks += -cert-err58-cpp
 
 checks += clang-analyzer-*
+# XXX: this flags something in boost multiprecision (of course)
+checks += -clang-analyzer-core.BitwiseShift
 
 checks += cppcoreguidelines-*
 checks += -cppcoreguidelines-avoid-c-arrays
+checks += -cppcoreguidelines-avoid-capturing-lambda-coroutines
 # this check is the exact opposite of a good guideline :/
 checks += -cppcoreguidelines-avoid-const-or-ref-data-members
 checks += -cppcoreguidelines-avoid-do-while
@@ -49,6 +54,10 @@ checks += -cppcoreguidelines-avoid-reference-coroutine-parameters
 checks += -cppcoreguidelines-init-variables
 # XXX: I didn't pay any attention to whether this check was interesting or not
 checks += -cppcoreguidelines-macro-usage
+# this was accidentally helpful, actually, but isn't an acceptable decision :/
+checks += -cppcoreguidelines-misleading-capture-default-by-value
+# this check doesn't handle unused parameters; am I doing this wrong?!
+checks += -cppcoreguidelines-missing-std-forward
 checks += -cppcoreguidelines-non-private-member-variables-in-classes
 # XXX: the code which most hates this apparently does allow for memory leaks :(
 checks += -cppcoreguidelines-prefer-member-initializer
@@ -57,8 +66,13 @@ checks += -cppcoreguidelines-pro-bounds-array-to-pointer-decay
 checks += -cppcoreguidelines-pro-bounds-pointer-arithmetic
 checks += -cppcoreguidelines-pro-type-reinterpret-cast
 checks += -cppcoreguidelines-pro-type-union-access
+# XXX: this check is interesting, but I'm unsure about move/forward confusion
+checks += -cppcoreguidelines-rvalue-reference-param-not-moved
+checks/cppcoreguidelines-rvalue-reference-param-not-moved.IgnoreUnnamedParams := true
 # this check makes utility classes super frustrating :/
 checks += -cppcoreguidelines-special-member-functions
+# this check makes separates definitions of related variables
+checks += -cppcoreguidelines-use-default-member-init
 
 # XXX: I'm using a lot of statically constructed objects
 #checks += fuchsia-statically-constructed-objects
@@ -67,6 +81,9 @@ checks += fuchsia-virtual-inheritance
 checks += google-build-*
 
 checks += misc-*
+# I love the idea of this check, but boost does this a lot
+checks += -misc-header-include-cycle
+checks += -misc-include-cleaner
 checks += -misc-misplaced-const
 checks += -misc-no-recursion
 # this check doesn't allow for any protected members :/
@@ -76,6 +93,8 @@ checks += -misc-unused-parameters
 
 checks += modernize-*
 checks += -modernize-avoid-c-arrays
+# XXX: I don't want this, but it also crashes on boost::multiprecision::abs
+checks += -modernize-use-constraints
 checks += -modernize-use-default-member-init
 checks += -modernize-use-nodiscard
 checks += -modernize-use-trailing-return-type
@@ -84,6 +103,8 @@ checks += -modernize-use-using
 
 checks += performance-*
 checks/performance-move-const-arg.CheckTriviallyCopyableMove := 0
+# XXX: I am pretty sure I just disagree with this optimization
+checks += -performance-avoid-endl
 
 checks += readability-const-return-type
 checks += readability-container-size-empty
@@ -98,11 +119,6 @@ checks += readability-redundant-string-init
 checks += readability-static-definition-in-anonymous-namespace
 checks += readability-uniqueptr-delete-release
 
-ifeq ($(target),and)
-# XXX: boost multiprecision on android
-#checks += -clang-analyzer-core.UndefinedBinaryOperatorResult
-endif
-
 ifeq ($(target),win)
 # XXX: boost::asio::detail::do_throw_error should be [[noreturn]]
 # (though, marking it [[noreturn]] didn't actually make it work)
diff --git a/env/setup-ndk.sh b/env/setup-ndk.sh
index 0fd0f4eb7..08eb5ae57 100755
--- a/env/setup-ndk.sh
+++ b/env/setup-ndk.sh
@@ -1,4 +1,4 @@
 #!/bin/bash
 set -e
 set -o pipefail
-echo y | "${ANDROID_HOME}"/cmdline-tools/latest/bin/sdkmanager "build-tools;29.0.2" "ndk;26.3.11579264" "platforms;android-34" >/dev/null
+echo y | "${ANDROID_HOME}"/cmdline-tools/latest/bin/sdkmanager "build-tools;29.0.2" "ndk;27.0.12077973" "platforms;android-34" >/dev/null
diff --git a/lib-protocol/source/drain.hpp b/lib-protocol/source/drain.hpp
index 1a4effd12..72e593a6d 100644
--- a/lib-protocol/source/drain.hpp
+++ b/lib-protocol/source/drain.hpp
@@ -90,7 +90,7 @@ class Sunk {
     }
 };
 
-template <typename Super_, typename Drain_, typename Inner_ = typename std::remove_reference<decltype(std::declval<Outer<Super_>>().Inner())>::type>
+template <typename Super_, typename Drain_, typename Inner_ = typename std::remove_reference_t<decltype(std::declval<Outer<Super_>>().Inner())>>
 class Sink :
     public Super_,
     public Sunk<Drain_, Inner_>
diff --git a/lib-protocol/source/jsonrpc.hpp b/lib-protocol/source/jsonrpc.hpp
index e2b5a1ef8..62f5a696d 100644
--- a/lib-protocol/source/jsonrpc.hpp
+++ b/lib-protocol/source/jsonrpc.hpp
@@ -79,7 +79,7 @@ struct Numeric<true, Size_, Type_> {
 };
 
 template <typename Type_>
-struct Coded<Type_, typename std::enable_if<std::is_unsigned<Type_>::value>::type> :
+struct Coded<Type_, typename std::enable_if_t<std::is_unsigned_v<Type_>>> :
     public Numeric<false, sizeof(Type_), Type_>
 {
     static void Name(std::ostringstream &signature) {
@@ -88,7 +88,7 @@ struct Coded<Type_, typename std::enable_if<std::is_unsigned<Type_>::value>::typ
 };
 
 template <typename Type_>
-struct Coded<Type_, typename std::enable_if<std::is_signed<Type_>::value>::type> :
+struct Coded<Type_, typename std::enable_if_t<std::is_signed_v<Type_>>> :
     public Numeric<true, sizeof(Type_), Type_>
 {
     static void Name(std::ostringstream &signature) {
@@ -97,7 +97,7 @@ struct Coded<Type_, typename std::enable_if<std::is_signed<Type_>::value>::type>
 };
 
 template <size_t Bits_, boost::multiprecision::cpp_int_check_type Check_>
-struct Coded<boost::multiprecision::number<boost::multiprecision::backends::cpp_int_backend<Bits_, Bits_, boost::multiprecision::unsigned_magnitude, Check_, void>>, typename std::enable_if<Bits_ % 8 == 0>::type> :
+struct Coded<boost::multiprecision::number<boost::multiprecision::backends::cpp_int_backend<Bits_, Bits_, boost::multiprecision::unsigned_magnitude, Check_, void>>, typename std::enable_if_t<Bits_ % 8 == 0>> :
     public Numeric<false, (Bits_ >> 3), boost::multiprecision::number<boost::multiprecision::backends::cpp_int_backend<Bits_, Bits_, boost::multiprecision::unsigned_magnitude, Check_, void>>>
 {
     static void Name(std::ostringstream &signature) {
@@ -106,7 +106,7 @@ struct Coded<boost::multiprecision::number<boost::multiprecision::backends::cpp_
 };
 
 template <size_t Bits_, boost::multiprecision::cpp_int_check_type Check_>
-struct Coded<boost::multiprecision::number<boost::multiprecision::backends::cpp_int_backend<Bits_, Bits_, boost::multiprecision::signed_magnitude, Check_, void>>, typename std::enable_if<Bits_ % 8 == 0>::type> :
+struct Coded<boost::multiprecision::number<boost::multiprecision::backends::cpp_int_backend<Bits_, Bits_, boost::multiprecision::signed_magnitude, Check_, void>>, typename std::enable_if_t<Bits_ % 8 == 0>> :
     public Numeric<true, (Bits_ >> 3), boost::multiprecision::number<boost::multiprecision::backends::cpp_int_backend<Bits_, Bits_, boost::multiprecision::signed_magnitude, Check_, void>>>
 {
     static void Name(std::ostringstream &signature) {
@@ -161,7 +161,7 @@ struct Coded<bool, void> {
 };
 
 template <size_t Size_>
-struct Coded<Brick<Size_>, typename std::enable_if<Size_ == 32>::type> {
+struct Coded<Brick<Size_>, typename std::enable_if_t<Size_ == 32>> {
     static const bool dynamic_ = false;
 
     static void Name(std::ostringstream &signature) {
diff --git a/lib-protocol/source/lwip.hpp b/lib-protocol/source/lwip.hpp
index 317dad024..1c210b032 100644
--- a/lib-protocol/source/lwip.hpp
+++ b/lib-protocol/source/lwip.hpp
@@ -56,6 +56,7 @@ typedef int SOCKET;
 using namespace rtc;
 
 // Event constants for the Dispatcher class.
+// NOLINTNEXTLINE(performance-enum-size)
 enum DispatcherEvent {
   DE_READ = 0x0001,
   DE_WRITE = 0x0002,
diff --git a/lib-protocol/source/memory.cpp b/lib-protocol/source/memory.cpp
index 36c329799..a71a42eac 100644
--- a/lib-protocol/source/memory.cpp
+++ b/lib-protocol/source/memory.cpp
@@ -34,8 +34,9 @@
 // NOLINTBEGIN(cppcoreguidelines-avoid-non-const-global-variables)
 
 namespace orc {
+namespace {
 
-static int file_(-1);
+int file_(-1);
 
 // XXX: there are a number of arrays in this file; are they correct?
 
@@ -74,7 +75,7 @@ class Out {
         if (value == 0)
             *--end = '0';
         else do {
-            unsigned digit(value % 10);
+            const unsigned digit(value % 10);
             value /= 10;
             *--end = static_cast<char>('0' + digit);
         } while (value != 0);
@@ -100,7 +101,7 @@ class Out {
         if (value == 0)
             *--end = '0';
         else do {
-            unsigned digit(value & 0xf);
+            const unsigned digit(value & 0xf);
             value >>= 4;
             *--end = static_cast<char>((digit < 10 ? '0' : 'a' - 10) + digit);
         } while (value != 0);
@@ -110,9 +111,9 @@ class Out {
     }
 };
 
-static size_t total_(0);
+size_t total_(0);
 
-static void Audit(size_t add, size_t sub) {
+void Audit(size_t add, size_t sub) {
     total_ += add;
     total_ -= sub;
     if (add < sub)
@@ -122,8 +123,8 @@ static void Audit(size_t add, size_t sub) {
     Out() << total_ << " (" << (add - sub) << ")";
 }
 
-static decltype(std::declval<_malloc_zone_t *>()->malloc) apl_malloc;
-static void *orc_malloc(struct _malloc_zone_t *zone, size_t size) {
+decltype(std::declval<_malloc_zone_t *>()->malloc) apl_malloc;
+void *orc_malloc(struct _malloc_zone_t *zone, size_t size) {
     auto value(apl_malloc(zone, size));
     if (value == nullptr)
         return nullptr;
@@ -134,8 +135,8 @@ static void *orc_malloc(struct _malloc_zone_t *zone, size_t size) {
     return value;
 }
 
-static decltype(std::declval<_malloc_zone_t *>()->calloc) apl_calloc;
-static void *orc_calloc(struct _malloc_zone_t *zone, size_t count, size_t size) {
+decltype(std::declval<_malloc_zone_t *>()->calloc) apl_calloc;
+void *orc_calloc(struct _malloc_zone_t *zone, size_t count, size_t size) {
     auto value(apl_calloc(zone, count, size));
     if (value == nullptr)
         return nullptr;
@@ -146,8 +147,8 @@ static void *orc_calloc(struct _malloc_zone_t *zone, size_t count, size_t size)
     return value;
 }
 
-static decltype(std::declval<_malloc_zone_t *>()->valloc) apl_valloc;
-static void *orc_valloc(struct _malloc_zone_t *zone, size_t size) {
+decltype(std::declval<_malloc_zone_t *>()->valloc) apl_valloc;
+void *orc_valloc(struct _malloc_zone_t *zone, size_t size) {
     auto value(apl_valloc(zone, size));
     if (value == nullptr)
         return nullptr;
@@ -158,8 +159,8 @@ static void *orc_valloc(struct _malloc_zone_t *zone, size_t size) {
     return value;
 }
 
-static decltype(std::declval<_malloc_zone_t *>()->realloc) apl_realloc;
-static void *orc_realloc(struct _malloc_zone_t *zone, void *old, size_t size) {
+decltype(std::declval<_malloc_zone_t *>()->realloc) apl_realloc;
+void *orc_realloc(struct _malloc_zone_t *zone, void *old, size_t size) {
     auto before(zone->size(zone, old));
     auto value(apl_realloc(zone, old, size));
     auto after(zone->size(zone, value));
@@ -169,8 +170,8 @@ static void *orc_realloc(struct _malloc_zone_t *zone, void *old, size_t size) {
     return value;
 }
 
-static decltype(std::declval<_malloc_zone_t *>()->free) apl_free;
-static void orc_free(struct _malloc_zone_t *zone, void *value) {
+decltype(std::declval<_malloc_zone_t *>()->free) apl_free;
+void orc_free(struct _malloc_zone_t *zone, void *value) {
     auto full(zone->size(zone, value));
     if (file_ != -1)
         Out() << "free(" << value << ")";
@@ -178,33 +179,33 @@ static void orc_free(struct _malloc_zone_t *zone, void *value) {
     return apl_free(zone, value);
 }
 
-static decltype(std::declval<_malloc_zone_t *>()->batch_malloc) apl_batch_malloc;
-static unsigned orc_batch_malloc(struct _malloc_zone_t *zone, size_t size, void **values, unsigned count) {
+decltype(std::declval<_malloc_zone_t *>()->batch_malloc) apl_batch_malloc;
+unsigned orc_batch_malloc(struct _malloc_zone_t *zone, size_t size, void **values, unsigned count) {
     count = apl_batch_malloc(zone, size, values, count);
     size_t full(0);
     for (size_t i(0); i != count; ++i) {
         full += zone->size(zone, values[i]);
         if (file_ != -1)
-            Out() << "batch_malloc(" << size << ", " << values << "[" << i << "]) = " << values[i];
+            Out() << "batch_malloc(" << size << ", " << reinterpret_cast<void *>(values) << "[" << i << "]) = " << values[i];
     }
     Audit(full, 0);
     return count;
 }
 
-static decltype(std::declval<_malloc_zone_t *>()->batch_free) apl_batch_free;
-static void orc_batch_free(struct _malloc_zone_t *zone, void **values, unsigned count) {
+decltype(std::declval<_malloc_zone_t *>()->batch_free) apl_batch_free;
+void orc_batch_free(struct _malloc_zone_t *zone, void **values, unsigned count) {
     size_t full(0);
     for (size_t i(0); i != count; ++i) {
         full += zone->size(zone, values[i]);
         if (file_ != -1)
-            Out() << "batch_free(" << values << "[" << i << "] = " << values[i] << ")";
+            Out() << "batch_free(" << reinterpret_cast<void *>(values) << "[" << i << "] = " << values[i] << ")";
     }
     Audit(0, full);
     return apl_batch_free(zone, values, count);
 }
 
-static decltype(std::declval<_malloc_zone_t *>()->memalign) apl_memalign;
-static void *orc_memalign(struct _malloc_zone_t *zone, size_t alignment, size_t size) {
+decltype(std::declval<_malloc_zone_t *>()->memalign) apl_memalign;
+void *orc_memalign(struct _malloc_zone_t *zone, size_t alignment, size_t size) {
     auto value(apl_memalign(zone, alignment, size));
     auto full(zone->size(zone, value));
     if (file_ != -1)
@@ -213,8 +214,8 @@ static void *orc_memalign(struct _malloc_zone_t *zone, size_t alignment, size_t
     return value;
 }
 
-static decltype(std::declval<_malloc_zone_t *>()->free_definite_size) apl_free_definite_size;
-static void orc_free_definite_size(struct _malloc_zone_t *zone, void *value, size_t size) {
+decltype(std::declval<_malloc_zone_t *>()->free_definite_size) apl_free_definite_size;
+void orc_free_definite_size(struct _malloc_zone_t *zone, void *value, size_t size) {
     auto full(zone->size(zone, value));
     if (file_ != -1)
         Out() << "free_definite_size(" << value << ", " << size << ")";
@@ -229,6 +230,9 @@ static void orc_free_definite_size(struct _malloc_zone_t *zone, void *value, siz
     zone->name = &orc_ ## name; \
 } while (false)
 
+} }
+
+namespace orc {
 void Hook() {
     return;
 
@@ -257,9 +261,7 @@ void Hook() {
     orc_swizzle(batch_free);
     orc_swizzle(memalign);
     orc_swizzle(free_definite_size);
-}
-
-}
+} }
 
 #else
 namespace orc {
diff --git a/lib-protocol/source/nest.hpp b/lib-protocol/source/nest.hpp
index c5de2d43b..49cd9907e 100644
--- a/lib-protocol/source/nest.hpp
+++ b/lib-protocol/source/nest.hpp
@@ -94,7 +94,7 @@ class Nest final :
     }
 
     template <typename Code_>
-    auto Hatch(Code_ code, const char *name) noexcept -> typename std::enable_if<noexcept(code()), bool>::type {
+    auto Hatch(Code_ code, const char *name) noexcept -> typename std::enable_if_t<noexcept(code()), bool> {
         Count count(this);
         if (count > limit_)
             return false;
diff --git a/lib-protocol/source/spawn.hpp b/lib-protocol/source/spawn.hpp
index a434218cc..a19721cc3 100644
--- a/lib-protocol/source/spawn.hpp
+++ b/lib-protocol/source/spawn.hpp
@@ -110,7 +110,7 @@ class Detached {
 };
 
 template <typename Code_>
-auto Spawn(Code_ code, const char *name) noexcept -> typename std::enable_if<noexcept(code())>::type {
+auto Spawn(Code_ code, const char *name) noexcept -> typename std::enable_if_t<noexcept(code())> {
     [](Code_ code, const char *name) mutable noexcept -> Detached {
         co_await Schedule();
 #ifdef ORC_FIBER
diff --git a/lib-protocol/source/transport.cpp b/lib-protocol/source/transport.cpp
index 743a2c6e5..b02b4b33f 100644
--- a/lib-protocol/source/transport.cpp
+++ b/lib-protocol/source/transport.cpp
@@ -332,7 +332,7 @@ class Middle :
         }
 
         openvpn::TunClient::Ptr new_tun_client_obj(openvpn_io::io_context &context, openvpn::TunClientParent &parent, openvpn::TransportClient *transport) noexcept override {
-            return new Tunnel(middle_, config_, context, parent);
+            return {new Tunnel(middle_, config_, context, parent)};
         }
     };
 
@@ -365,10 +365,12 @@ class Middle :
     }
 
     openvpn::TransportClientFactory *new_transport_factory(const openvpn::ExternalTransport::Config &config) noexcept override {
+        // NOLINTNEXTLINE(cppcoreguidelines-owning-memory)
         return new orc::Factory(base_, config);
     }
 
     openvpn::TunClientFactory *new_tun_factory(const openvpn::ExternalTun::Config &config, const openvpn::OptionList &options) noexcept override {
+        // NOLINTNEXTLINE(cppcoreguidelines-owning-memory)
         return new Factory(*this, config);
     }
 
diff --git a/lib-shared/source/address.hpp b/lib-shared/source/address.hpp
index 77eb92f72..c7f927909 100644
--- a/lib-shared/source/address.hpp
+++ b/lib-shared/source/address.hpp
@@ -36,6 +36,8 @@ class Address :
     private uint160_t
 {
   public:
+    // XXX: this check is false positive here
+    // NOLINTNEXTLINE(modernize-type-traits)
     using uint160_t::uint160_t;
 
     Address(const uint160_t &value) :
diff --git a/lib-shared/source/buffer.hpp b/lib-shared/source/buffer.hpp
index 1f5ca4f4a..e16b9c640 100644
--- a/lib-shared/source/buffer.hpp
+++ b/lib-shared/source/buffer.hpp
@@ -153,7 +153,7 @@ template <typename Type_, typename Enable_ = void>
 struct Cast;
 
 template <typename Type_>
-struct Cast<Type_, typename std::enable_if<std::is_arithmetic<Type_>::value>::type> {
+struct Cast<Type_, typename std::enable_if_t<std::is_arithmetic_v<Type_>>> {
     static auto Load(const uint8_t *data, size_t size) {
         orc_assert(size == sizeof(Type_));
         return boost::endian::big_to_native(*reinterpret_cast<const Type_ *>(data));
@@ -161,7 +161,7 @@ struct Cast<Type_, typename std::enable_if<std::is_arithmetic<Type_>::value>::ty
 };
 
 template <size_t Bits_, boost::multiprecision::cpp_int_check_type Check_>
-struct Cast<boost::multiprecision::number<boost::multiprecision::backends::cpp_int_backend<Bits_, Bits_, boost::multiprecision::unsigned_magnitude, Check_, void>>, typename std::enable_if<Bits_ % 8 == 0>::type> {
+struct Cast<boost::multiprecision::number<boost::multiprecision::backends::cpp_int_backend<Bits_, Bits_, boost::multiprecision::unsigned_magnitude, Check_, void>>, typename std::enable_if_t<Bits_ % 8 == 0>> {
     static auto Load(const uint8_t *data, size_t size) {
         orc_assert(size == Bits_ / 8);
         boost::multiprecision::number<boost::multiprecision::backends::cpp_int_backend<Bits_, Bits_, boost::multiprecision::unsigned_magnitude, Check_, void>> value;
@@ -171,7 +171,7 @@ struct Cast<boost::multiprecision::number<boost::multiprecision::backends::cpp_i
 };
 
 template <size_t Bits_>
-struct Cast<intx::uint<Bits_>, typename std::enable_if<Bits_ % 8 == 0>::type> {
+struct Cast<intx::uint<Bits_>, typename std::enable_if_t<Bits_ % 8 == 0>> {
     static auto Load(const uint8_t *data, size_t size) {
         orc_assert(size == Bits_ / 8);
         return intx::be::load<intx::uint<Bits_>>(*reinterpret_cast<const uint8_t (*)[Bits_ / 8]>(data));
@@ -735,7 +735,7 @@ inline Brick<Size_> operator ^(const Data<Size_> &lhs, const Data<Size_> &rhs) {
     return value;
 }
 
-template <typename Type_, bool Arithmetic_ = std::is_arithmetic<Type_>::value>
+template <typename Type_, bool Arithmetic_ = std::is_arithmetic_v<Type_>>
 class Number;
 
 template <typename Type_>
@@ -1041,12 +1041,12 @@ inline bool Each(const char &data, const std::function<bool (const uint8_t *, si
 }
 
 template <typename Type_>
-inline typename std::enable_if<std::is_arithmetic<Type_>::value && !std::is_same_v<Type_, char>, bool>::type Each(const Type_ &value, const std::function<bool (const uint8_t *, size_t)> &code) {
+inline typename std::enable_if_t<std::is_arithmetic_v<Type_> && !std::is_same_v<Type_, char>, bool> Each(const Type_ &value, const std::function<bool (const uint8_t *, size_t)> &code) {
     return Number<Type_>(value).each(code);
 }
 
 template <size_t Bits_, boost::multiprecision::cpp_int_check_type Check_>
-inline typename std::enable_if<Bits_ % 8 == 0, bool>::type Each(const boost::multiprecision::number<boost::multiprecision::backends::cpp_int_backend<Bits_, Bits_, boost::multiprecision::unsigned_magnitude, Check_, void>> &value, const std::function<bool (const uint8_t *, size_t)> &code) {
+inline typename std::enable_if_t<Bits_ % 8 == 0, bool> Each(const boost::multiprecision::number<boost::multiprecision::backends::cpp_int_backend<Bits_, Bits_, boost::multiprecision::unsigned_magnitude, Check_, void>> &value, const std::function<bool (const uint8_t *, size_t)> &code) {
     return Number<boost::multiprecision::number<boost::multiprecision::backends::cpp_int_backend<Bits_, Bits_, boost::multiprecision::unsigned_magnitude, Check_, void>>>(value).each(code);
 }
 
@@ -1355,7 +1355,7 @@ static bool Take(Tuple_ &tuple, Window &window, Buffer_ &&buffer) {
 } };
 
 template <size_t Index_, size_t Bits_, boost::multiprecision::cpp_int_check_type Check_, typename... Taking_>
-struct Taking<Index_, boost::multiprecision::number<boost::multiprecision::backends::cpp_int_backend<Bits_, Bits_, boost::multiprecision::unsigned_magnitude, Check_, void>>, typename std::enable_if<Bits_ % 8 == 0>::type, Taking_...> final {
+struct Taking<Index_, boost::multiprecision::number<boost::multiprecision::backends::cpp_int_backend<Bits_, Bits_, boost::multiprecision::unsigned_magnitude, Check_, void>>, typename std::enable_if_t<Bits_ % 8 == 0>, Taking_...> final {
 template <typename Tuple_, typename Buffer_>
 static bool Take(Tuple_ &tuple, Window &window, Buffer_ &&buffer) {
     Brick<Bits_ / 8> brick;
@@ -1365,7 +1365,7 @@ static bool Take(Tuple_ &tuple, Window &window, Buffer_ &&buffer) {
 } };
 
 template <size_t Index_, typename Next_, typename... Taking_>
-struct Taking<Index_, Next_, typename std::enable_if<std::is_arithmetic<Next_>::value>::type, Taking_...> {
+struct Taking<Index_, Next_, typename std::enable_if_t<std::is_arithmetic_v<Next_>>, Taking_...> {
 template <typename Tuple_, typename Buffer_>
 static bool Take(Tuple_ &tuple, Window &window, Buffer_ &&buffer) {
     Brick<sizeof(Next_)> brick;
@@ -1378,7 +1378,7 @@ template <size_t Index_>
 struct Taking<Index_, Window, void> {
 template <typename Tuple_, typename Buffer_>
 static bool Take(Tuple_ &tuple, Window &window, Buffer_ &&buffer) {
-    static_assert(!std::is_rvalue_reference<Buffer_ &&>::value);
+    static_assert(!std::is_rvalue_reference_v<Buffer_ &&>);
     std::get<Index_>(tuple) = std::move(window);
     return false;
 } };
diff --git a/min-wireshark/target.mk b/min-wireshark/target.mk
index 3323619a0..ffeeaf7c2 100644
--- a/min-wireshark/target.mk
+++ b/min-wireshark/target.mk
@@ -139,6 +139,16 @@ cflags/$(pwd/wireshark)/ += -Wno-pointer-sign
 # XXX: fwrite used without check; submit patch
 cflags/$(pwd/wireshark)/ += -Wno-unused-result
 
+# XXX: packet-5co-legacy.c:923:9: error: 'snprintf' will always be truncated; specified size is 8, but format string expands to at least 9 [-Werror,-Wformat-truncation]
+#     snprintf( result, 8, "Disabled");
+#     ^
+cflags/$(pwd/wireshark)/epan/dissectors/packet-5co-legacy.c += -Wno-format-truncation
+
+# XXX: packet-ipars.c:131:33: error: 'snprintf' will always be truncated; specified size is 16, but format string expands to at least 24 [-Werror,-Wformat-truncation]
+#     default:    snprintf(eom_msg, MAX_EOM_MSG_SIZE, "Unknown EOM type (0x%2.2X)", ia);    break;
+#                 ^
+cflags/$(pwd/wireshark)/epan/dissectors/packet-ipars.c += -Wno-format-truncation
+
 # XXX: this is only used if you have libgnutls and I don't know what I think about that :/
 cflags/$(pwd/wireshark)/epan/dissectors/packet-tls-utils.c += -Wno-unused-but-set-variable
 
diff --git a/srv-daemon/source/egress.cpp b/srv-daemon/source/egress.cpp
index 16d64d07f..2084857b3 100644
--- a/srv-daemon/source/egress.cpp
+++ b/srv-daemon/source/egress.cpp
@@ -154,6 +154,9 @@ task<void> Egress::Translator::Send(const Buffer &data) {
             Forge(icmp, &openvpn::ICMPv4::id, translated.Port());
             co_return co_await egress_->Send(beam);
         } break;
+
+        default: {
+        } break;
     }
 }
 
@@ -193,6 +196,9 @@ void Egress::Land(const Buffer &data) {
                 return translation->translator_.Land(beam);
             }
         } break;
+
+        default: {
+        } break;
     }
 }
 
diff --git a/srv-daemon/source/lottery.cpp b/srv-daemon/source/lottery.cpp
index 65def39f5..b83d3a32e 100644
--- a/srv-daemon/source/lottery.cpp
+++ b/srv-daemon/source/lottery.cpp
@@ -31,7 +31,7 @@ std::ostream &operator <<(std::ostream &out, const Pot &pot) {
 }
 
 void Lottery::Open() {
-    Spawn([=]() mutable noexcept -> task<void> {
+    Spawn([this]() mutable noexcept -> task<void> {
         for (auto height(co_await Height());;) try {
             co_await Sleep(10*1000);
             auto next(co_await Height());
diff --git a/srv-daemon/source/lottery0.hpp b/srv-daemon/source/lottery0.hpp
index 97af25649..b76b6c7c3 100644
--- a/srv-daemon/source/lottery0.hpp
+++ b/srv-daemon/source/lottery0.hpp
@@ -84,10 +84,10 @@ class Lottery0 :
             Bytes /*receipt*/, std::vector<Bytes32> /*old*/
         > grab("grab");
 
-        Spawn([=]() mutable noexcept -> task<void> {
+        Spawn([this, executor, args...]() mutable noexcept -> task<void> {
             for (;;) {
                 orc_ignore({
-                    co_await executor->Send(*token_.market_.chain_, {}, contract_, 0, grab(std::forward<Args_>(args)...));
+                    co_await executor->Send(*token_.market_.chain_, {}, contract_, 0, grab(args...));
                     break;
                 });
 
diff --git a/srv-daemon/source/lottery1.hpp b/srv-daemon/source/lottery1.hpp
index 86505eda6..83c916fb0 100644
--- a/srv-daemon/source/lottery1.hpp
+++ b/srv-daemon/source/lottery1.hpp
@@ -74,7 +74,7 @@ class Lottery1 :
             std::vector<Bytes32> /*refunds*/
         > claim("claim");
 
-        Spawn([=]() mutable noexcept -> task<void> {
+        Spawn([this, executor, recipient, payment]() mutable noexcept -> task<void> {
             for (;;) {
                 orc_ignore({
                     co_await executor->Send(*market_.chain_, {}, contract_, 0, claim({}, recipient, {payment}, {}));
diff --git a/srv-daemon/source/server.cpp b/srv-daemon/source/server.cpp
index b2e1f5a88..bfbd51a22 100644
--- a/srv-daemon/source/server.cpp
+++ b/srv-daemon/source/server.cpp
@@ -200,7 +200,7 @@ void Server::Submit0(Pipe<Buffer> *pipe, const Socket &source, const Bytes32 &id
             nonces.erase(oldest);
         }
 
-        const auto reveal([&, &commit = commit]() {
+        const auto reveal([&]() {
             for (const auto &reveal : locked->reveals_)
                 if (HashK(reveal.first) == commit) {
                     const auto &expire(reveal.second);
@@ -217,8 +217,9 @@ void Server::Submit0(Pipe<Buffer> *pipe, const Socket &source, const Bytes32 &id
             Commit(locked);
     std::make_tuple(reveal, winner); });
 
-    // XXX: the C++ prohibition on automatic capture of a binding name because it isn't a "variable" is ridiculous
-    nest_.Hatch([&, &commit = commit, &issued = issued, &nonce = nonce, &v = v, &r = r, &s = s, &amount = amount, &ratio = ratio, &start = start, &range = range, &funder = funder, &recipient = recipient, &reveal = reveal, &winner = winner]() noexcept { return [=]() noexcept -> task<void> { try {
+    // XXX: this is related to the long-standing issue with boost multiprecision and clang-tidy
+    // NOLINTNEXTLINE(clang-analyzer-core.CallAndMessage)
+    nest_.Hatch([&]() noexcept { return [=, this]() noexcept -> task<void> { try {
         const auto usable(co_await lottery->Check(signer, funder, recipient));
         const auto valid(usable >= amount);
 
@@ -306,7 +307,7 @@ void Server::Submit1(Pipe<Buffer> *pipe, const Socket &source, const Bytes32 &id
             nonces.erase(oldest);
         }
 
-        const auto reveal([&, &commit = commit]() {
+        const auto reveal([&]() {
             for (const auto &reveal : locked->reveals_)
                 if (HashK(reveal.first) == commit) {
                     const auto &expire(reveal.second);
@@ -323,8 +324,9 @@ void Server::Submit1(Pipe<Buffer> *pipe, const Socket &source, const Bytes32 &id
             Commit(locked);
     std::make_tuple(reveal, winner); });
 
-    // XXX: the C++ prohibition on automatic capture of a binding name because it isn't a "variable" is ridiculous
-    nest_.Hatch([&, &amount = amount, &funder = funder, &recipient = recipient, &reveal = reveal, &winner = winner]() noexcept { return [=]() noexcept -> task<void> { try {
+    // XXX: this is related to the long-standing issue with boost multiprecision and clang-tidy
+    // NOLINTNEXTLINE(clang-analyzer-core.CallAndMessage)
+    nest_.Hatch([&]() noexcept { return [=, this]() noexcept -> task<void> { try {
         const auto usable(co_await lottery->Check(signer, funder, recipient));
         const auto valid(usable >= amount);
 
@@ -361,7 +363,7 @@ void Server::Land(Pipe<Buffer> *pipe, const Buffer &data) { orc_ignore({
             const auto &[magic, id] = header;
             orc_assert(magic == Magic_);
 
-            Scan(window, [&, &id = id](const Buffer &data) { try {
+            Scan(window, [&](const Buffer &data) { try {
                 const auto [command, window] = Take<uint32_t, Window>(data);
                 if (false);
                 else if (command == Submit0_)
diff --git a/srv-worker/capnproto.mk b/srv-worker/capnproto.mk
index 22e4724c7..6f722c98c 100644
--- a/srv-worker/capnproto.mk
+++ b/srv-worker/capnproto.mk
@@ -40,4 +40,6 @@ $(output)/capnp/%.capnp.h: %.capnp $(capnp)
 cflags += -I$(pwd)/capnproto/c++/src
 cflags += -I$(output)/capnp/capnproto/c++/src
 
+cflags/$(pwd)/capnproto/ += -Wno-deprecated-this-capture
+
 source += $(shell find $(pwd)/capnproto/c++/src/kj -name '*.c++' -not -name '*test.c++')
diff --git a/vpn-apple/source/family.hpp b/vpn-apple/source/family.hpp
index 849239825..ee2151a20 100644
--- a/vpn-apple/source/family.hpp
+++ b/vpn-apple/source/family.hpp
@@ -39,8 +39,8 @@ class Family :
         switch (protocol) {
         case 4: return AF_INET;
         case 6: return AF_INET6;
+        default: return 0;
         }
-        return 0;
     }
 
   protected:
diff --git a/vpn-apple/source/protect.cpp b/vpn-apple/source/protect.cpp
index 25c0efdd0..9d4cc8b59 100644
--- a/vpn-apple/source/protect.cpp
+++ b/vpn-apple/source/protect.cpp
@@ -36,7 +36,7 @@
 namespace orc {
 
 int Protect(int socket, int (*attach)(int, const sockaddr *, socklen_t), const sockaddr *address, socklen_t length) {
-    std::unique_ptr<ifaddrs, decltype(freeifaddrs) *> interfaces([]() {
+    const std::unique_ptr<ifaddrs, decltype(freeifaddrs) *> interfaces([]() {
         ifaddrs *interfaces;
         orc_assert(getifaddrs(&interfaces) != -1);
         return interfaces;
diff --git a/vpn-shared/source/capture.cpp b/vpn-shared/source/capture.cpp
index 1fb56a8dd..8ccc6c455 100644
--- a/vpn-shared/source/capture.cpp
+++ b/vpn-shared/source/capture.cpp
@@ -216,7 +216,7 @@ void Capture::Land(const Buffer &data) {
     orc_ignore({ if (Datagram(data, [&](const Socket &source, const Socket &destination, const Buffer &data) {
         if (destination != Socket(Resolver_, 53))
             return false;
-        up_.Hatch([&]() noexcept { return [=, data = Beam(data)]() mutable -> task<void> {
+        up_.Hatch([&]() noexcept { return [this, source, destination, data = Beam(data)]() mutable -> task<void> {
             const Query query(data.span());
 
             const auto resolver([&]() {
@@ -625,6 +625,9 @@ task<bool> Transform::Send(const Beam &data) {
                 Log() << "ICMP" << subset << std::endl;
             co_return true;
         } break;
+
+        default:
+            break;
     }
 
     co_return false;
diff --git a/vpn-shared/source/client.cpp b/vpn-shared/source/client.cpp
index a46a6c919..58d98dc3a 100644
--- a/vpn-shared/source/client.cpp
+++ b/vpn-shared/source/client.cpp
@@ -111,7 +111,7 @@ void Client::Land(Pipe *pipe, const Buffer &data) {
         const auto &[magic, id] = header;
         orc_assert(magic == Magic_);
 
-        Scan(window, [&, &id = id](const Buffer &data) { try {
+        Scan(window, [&](const Buffer &data) { try {
             Invoice(id, data);
         } orc_catch({}) });
     } orc_catch({}) return true; })) {