diff --git a/include/pam_authenticate.hpp b/include/pam_authenticate.hpp
index 358c9d8..06202a3 100644
--- a/include/pam_authenticate.hpp
+++ b/include/pam_authenticate.hpp
@@ -7,12 +7,8 @@
 #include <security/_pam_types.h>
 #include <security/pam_appl.h>
 
-// misc-include-cleaner complains if this isn't included,
-// modernize-deprecated-headers complains if it is included.
-// NOLINTNEXTLINE(modernize-deprecated-headers)
-#include <string.h>
-
 #include <algorithm>
+#include <cstddef>
 #include <cstring>
 #include <memory>
 #include <optional>
@@ -59,6 +55,7 @@
                 {
                     return PAM_CONV_ERR;
                 }
+                // NOLINTNEXTLINE(misc-include-cleaner)
                 response.resp = strdup(iter->value.c_str());
                 return PAM_SUCCESS;
             }
diff --git a/include/sessions.hpp b/include/sessions.hpp
index 33d9c5b..6e00778 100644
--- a/include/sessions.hpp
+++ b/include/sessions.hpp
@@ -8,11 +8,6 @@
 #include "ossl_random.hpp"
 #include "utils/ip_utils.hpp"
 
-// misc-include-cleaner complains if this isn't included,
-// modernize-deprecated-headers complains if it is included.
-// NOLINTNEXTLINE(modernize-deprecated-headers)
-#include <signal.h>
-
 #include <boost/asio/ip/address.hpp>
 #include <nlohmann/json.hpp>
 
@@ -422,6 +417,7 @@
         if (isTLSchanged)
         {
             // recreate socket connections with new settings
+            // NOLINTNEXTLINE(misc-include-cleaner)
             std::raise(SIGHUP);
         }
     }
diff --git a/include/vm_websocket.hpp b/include/vm_websocket.hpp
index addef79..0c1e0c3 100644
--- a/include/vm_websocket.hpp
+++ b/include/vm_websocket.hpp
@@ -10,9 +10,6 @@
 #include "logging.hpp"
 #include "websocket.hpp"
 
-// NOLINTNEXTLINE(modernize-deprecated-headers)
-#include <signal.h>
-
 #include <boost/asio/buffer.hpp>
 #include <boost/asio/error.hpp>
 #include <boost/asio/io_context.hpp>
@@ -75,6 +72,7 @@
     {
         // boost::process::child::terminate uses SIGKILL, need to send SIGTERM
         // to allow the proxy to stop nbd-client and the USB device gadget.
+        // NOLINTNEXTLINE(misc-include-cleaner)
         int rc = kill(proxy.id(), SIGTERM);
         if (rc != 0)
         {