diff --git a/ca/django_ca/tests/views/test_generic_ocsp_view.py b/ca/django_ca/tests/views/test_generic_ocsp_view.py
index b9c2a81f1..f7c9e5ba9 100644
--- a/ca/django_ca/tests/views/test_generic_ocsp_view.py
+++ b/ca/django_ca/tests/views/test_generic_ocsp_view.py
@@ -220,9 +220,7 @@ def test_certificate_never_generated(
 
 
 @pytest.mark.freeze_time(TIMESTAMPS["profile_certs_expired"])
-def test_certificate_expired(
-    caplog: LogCaptureFixture, client: Client, child_cert: Certificate, profile_ocsp: Certificate
-) -> None:
+def test_certificate_expired(caplog: LogCaptureFixture, client: Client, child_cert: Certificate) -> None:
     """Test error log when the key has expired."""
     response = ocsp_get(client, child_cert, hash_algorithm=hashes.SHA512)
     assert caplog.record_tuples == [
diff --git a/devscripts/commands/docker_test.py b/devscripts/commands/docker_test.py
index 82fa0d392..f4dabf308 100644
--- a/devscripts/commands/docker_test.py
+++ b/devscripts/commands/docker_test.py
@@ -15,12 +15,13 @@
 
 import argparse
 import functools
+import io
 import shlex
 import subprocess
 import sys
 from multiprocessing.pool import Pool
 from pathlib import Path
-from typing import TypedDict
+from typing import TypedDict, Union
 
 from devscripts import config
 from devscripts.commands import DevCommand
@@ -35,13 +36,13 @@ class DockerRunDict(TypedDict):
     error: str
 
 
-def build_docker_image(cmd: list[str], log_path: Path, output=False) -> int:
+def build_docker_image(cmd: list[str], log_path: Path, output: bool = False) -> int:
     """Run command to build a Docker image."""
     env = {"DOCKER_BUILDKIT": "1"}
 
     with open(log_path, "bw") as stream:
         if output:
-            stdout = subprocess.PIPE
+            stdout: Union[int, io.BufferedWriter] = subprocess.PIPE
         else:
             stdout = stream
         stream.write(f"+ {shlex.join(cmd)}\n".encode())
@@ -89,17 +90,14 @@ def handle_image(image: str, no_cache: bool, keep_image: bool, output: bool) ->
         if returncode == 0:
             ok(f"{image} passed.")
             return {"image": image, "success": True, "error": ""}
-        else:
-            failed_str = f"{image} failed: return code {returncode}."
 
-            # pylint: disable-next=consider-using-f-string  # just more convenient
-            err(failed_str)
-            return {"image": image, "success": False, "error": f"return code: {returncode}"}
+        failed_str = f"{image} failed: return code {returncode}."
+        err(failed_str)
+        return {"image": image, "success": False, "error": f"return code: {returncode}"}
 
     except Exception as ex:  # pylint: disable=broad-except; to make sure we test all images
         msg = f"{image}: {type(ex).__name__} {ex}"
         return {"image": image, "success": False, "error": msg}
-        err(f"\n{msg}\n")
     finally:
         if not keep_image:
             subprocess.run(
@@ -111,7 +109,7 @@ def handle_image(image: str, no_cache: bool, keep_image: bool, output: bool) ->
 
 
 def handle_parallel(
-    images: list[str], processes: int, no_cache: bool, keep_image: bool
+    images: tuple[str, ...], processes: int, no_cache: bool, keep_image: bool
 ) -> list[DockerRunDict]:
     """Handle images in parallel."""
     with Pool(processes) as pool:
@@ -163,7 +161,7 @@ def handle(self, args: argparse.Namespace) -> None:
         docker_runs: list[DockerRunDict] = []
 
         if args.images:
-            images: tuple[str] = tuple(args.images)
+            images: tuple[str, ...] = tuple(args.images)
         elif args.debian:
             images = config.DEBIAN_IMAGES
         elif args.alpine:
diff --git a/devscripts/config.py b/devscripts/config.py
index 06aa56e67..ca710cf94 100644
--- a/devscripts/config.py
+++ b/devscripts/config.py
@@ -78,7 +78,7 @@ def minor_to_major(version: str) -> str:
 _debian_images = []
 for python_version in reversed(PYTHON_RELEASES):
     for debian_version in reversed(DEBIAN_RELEASES):
-        image_name = f"python:{python_version}-slim-{debian_version}"
+        image_name = f"python:{python_version}-slim-{debian_version}"  # pylint: disable=invalid-name
 
         # Skip images that are just no longer built upstream
         if image_name in _release_config["docker-image-blacklist"]:
diff --git a/requirements/requirements-dev-common.txt b/requirements/requirements-dev-common.txt
index 25b135a1a..f9766ccce 100644
--- a/requirements/requirements-dev-common.txt
+++ b/requirements/requirements-dev-common.txt
@@ -1,6 +1,6 @@
 # modules imported in devscripts/ and/or required by mypy for type checking
 GitPython==3.1.43
-Jinja2==3.1.4
+Jinja2==3.1.5
 PyYAML==6.0.2
 Sphinx==7.3.7
 coverage[toml]==7.6.9
diff --git a/requirements/requirements-lint.txt b/requirements/requirements-lint.txt
index 3e65941d9..02ae22b37 100644
--- a/requirements/requirements-lint.txt
+++ b/requirements/requirements-lint.txt
@@ -3,6 +3,6 @@
 astroid>=3.3.6,!=3.3.7
 pre-commit==4.0.1
 pylint-django==2.6.1
-pylint==3.3.2
+pylint==3.3.3
 ruff==0.8.4
 setuptools>=65
\ No newline at end of file