diff --git a/management/internals/server/boot.go b/management/internals/server/boot.go
index e5be2a0f1..bc47cd0ca 100644
--- a/management/internals/server/boot.go
+++ b/management/internals/server/boot.go
@@ -187,7 +187,7 @@ func (s *BaseServer) GRPCServer() *grpc.Server {
 		// With the native transport enabled, TLS is terminated at the listeners
 		// (cmux-split shared listener and legacy port), so transport credentials
 		// must not be set or the server would attempt a second handshake.
-		if nativeGRPCEnabled() {
+		if nativeGRPCEnabled() { //nolint:gocritic
 			log.Info("native gRPC transport enabled, TLS is terminated at the listeners")
 		} else if s.Config.HttpConfig.LetsEncryptDomain != "" {
 			certManager, err := encryption.CreateCertManager(s.Config.Datadir, s.Config.HttpConfig.LetsEncryptDomain)
diff --git a/management/internals/server/server.go b/management/internals/server/server.go
index b4183afc9..247ba69a7 100644
--- a/management/internals/server/server.go
+++ b/management/internals/server/server.go
@@ -462,7 +462,7 @@ func preferHTTP1ForDualProtoClients(base *tls.Config) *tls.Config {
 		if slices.Contains(hello.SupportedProtos, "http/1.1") && slices.Contains(hello.SupportedProtos, "h2") {
 			return h1Config, nil
 		}
-		return nil, nil
+		return base, nil
 	}
 	return steered
 }
diff --git a/management/internals/shared/grpc/server.go b/management/internals/shared/grpc/server.go
index cefefac0f..2c466f42b 100644
--- a/management/internals/shared/grpc/server.go
+++ b/management/internals/shared/grpc/server.go
@@ -369,7 +369,7 @@ func (s *Server) receiveJobResponses(ctx context.Context, peerKey wgtypes.Key, s
 		if err != nil {
 			if errors.Is(err, io.EOF) || errors.Is(err, context.Canceled) || ctx.Err() != nil {
 				log.WithContext(ctx).Debugf("job stream of peer %s has been closed", peerKey.String())
-				return nil
+				return nil //nolint:nilerr
 			}
 			log.WithContext(ctx).Warnf("recv job response error: %v", err)
 			return err