diff --git a/dns/router.go b/dns/router.go
index ae8aed987..b30f5a0c8 100644
--- a/dns/router.go
+++ b/dns/router.go
@@ -896,7 +896,7 @@ func (r *Router) ResetNetwork() {
 }
 
 func defaultRuleNeedsLegacyDNSModeFromAddressFilter(rule option.DefaultDNSRule) bool {
-	if rule.IPAcceptAny || rule.RuleSetIPCIDRAcceptEmpty {
+	if rule.IPAcceptAny || rule.RuleSetIPCIDRAcceptEmpty { //nolint:staticcheck
 		return true
 	}
 	return !rule.MatchResponse && (len(rule.IPCIDR) > 0 || rule.IPIsPrivate)
@@ -1070,10 +1070,10 @@ func validateLegacyDNSModeDisabledDefaultRule(rule option.DefaultDNSRule) (bool,
 	// When match_response is false, those destination-IP branches fail closed during
 	// pre-response evaluation instead of consuming DNS response state, while sibling
 	// non-response branches remain matchable.
-	if rule.IPAcceptAny {
+	if rule.IPAcceptAny { //nolint:staticcheck
 		return false, E.New("ip_accept_any is removed when legacyDNSMode is disabled, use ip_cidr with match_response")
 	}
-	if rule.RuleSetIPCIDRAcceptEmpty {
+	if rule.RuleSetIPCIDRAcceptEmpty { //nolint:staticcheck
 		return false, E.New("rule_set_ip_cidr_accept_empty is removed when legacyDNSMode is disabled")
 	}
 	return rule.MatchResponse, nil
diff --git a/route/rule/rule_dns.go b/route/rule/rule_dns.go
index ebc556c0e..f95fa6699 100644
--- a/route/rule/rule_dns.go
+++ b/route/rule/rule_dns.go
@@ -127,7 +127,7 @@ func NewDefaultDNSRule(ctx context.Context, logger log.ContextLogger, options op
 		rule.destinationAddressItems = append(rule.destinationAddressItems, item)
 		rule.allItems = append(rule.allItems, item)
 	}
-	if len(options.Geosite) > 0 {
+	if len(options.Geosite) > 0 { //nolint:staticcheck
 		return nil, E.New("geosite database is deprecated in sing-box 1.8.0 and removed in sing-box 1.12.0")
 	}
 	if len(options.SourceGeoIP) > 0 {
@@ -162,7 +162,7 @@ func NewDefaultDNSRule(ctx context.Context, logger log.ContextLogger, options op
 		rule.destinationIPCIDRItems = append(rule.destinationIPCIDRItems, item)
 		rule.allItems = append(rule.allItems, item)
 	}
-	if options.IPAcceptAny {
+	if options.IPAcceptAny { //nolint:staticcheck
 		if legacyDNSMode {
 			deprecated.Report(ctx, deprecated.OptionIPAcceptAny)
 		} else {
@@ -320,14 +320,14 @@ func NewDefaultDNSRule(ctx context.Context, logger log.ContextLogger, options op
 		if options.RuleSetIPCIDRMatchSource {
 			matchSource = true
 		}
-		if options.RuleSetIPCIDRAcceptEmpty {
+		if options.RuleSetIPCIDRAcceptEmpty { //nolint:staticcheck
 			if legacyDNSMode {
 				deprecated.Report(ctx, deprecated.OptionRuleSetIPCIDRAcceptEmpty)
 			} else {
 				return nil, E.New("rule_set_ip_cidr_accept_empty is removed when legacyDNSMode is disabled")
 			}
 		}
-		item := NewRuleSetItem(router, options.RuleSet, matchSource, options.RuleSetIPCIDRAcceptEmpty)
+		item := NewRuleSetItem(router, options.RuleSet, matchSource, options.RuleSetIPCIDRAcceptEmpty) //nolint:staticcheck
 		rule.ruleSetItem = item
 		rule.allItems = append(rule.allItems, item)
 	}