diff --git a/cloud/agent/e2e/main_test.go b/cloud/agent/e2e/main_test.go
index 02600fb..3a27803 100644
--- a/cloud/agent/e2e/main_test.go
+++ b/cloud/agent/e2e/main_test.go
@@ -122,6 +122,9 @@
 		BasicConstraintsValid: true,
 	}
 	serverCert, err := x509.CreateCertificate(rand.Reader, &serverCertTmpl, caCert, serverPubKey, caPrivKey)
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	s := grpc.NewServer(grpc.Creds(credentials.NewServerTLSFromCert(&tls.Certificate{
 		Certificate: [][]byte{serverCert},
@@ -147,10 +150,14 @@
 	if err != nil {
 		t.Fatal(err)
 	}
+
 	blobListenAddr := blobLis.Addr().(*net.TCPAddr)
 	go http.Serve(blobLis, m)
 
 	_, privateKey, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	init := apb.AgentInit{
 		TakeoverInit: &apb.TakeoverInit{
diff --git a/cloud/agent/takeover/takeover.go b/cloud/agent/takeover/takeover.go
index a62dc8c..094c688 100644
--- a/cloud/agent/takeover/takeover.go
+++ b/cloud/agent/takeover/takeover.go
@@ -165,6 +165,9 @@
 		agentParams = append(agentParams, bootparam.Param{Param: "console", Value: "ttyS0,115200"})
 	}
 	agentCmdline, err := bootparam.Marshal(agentParams, "")
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal agent params: %w", err)
+	}
 	// Stage agent payload into kernel memory
 	if err := kexec.FileLoad(kernelFile, initramfsFile, agentCmdline); err != nil {
 		return nil, fmt.Errorf("failed to load kexec payload: %w", err)