diff --git a/src/admin/socket.rs b/src/admin/socket.rs
index 7689f30..8b310da 100644
--- a/src/admin/socket.rs
+++ b/src/admin/socket.rs
@@ -14,6 +14,7 @@ use crate::shutdown::GracefulShutdown;
 use crate::config::ConfigReloadHandle;
 
 #[derive(Debug, thiserror::Error)]
+#[non_exhaustive]
 pub enum AdminSocketError {
     #[error("admin socket disabled (empty path)")]
     Disabled,
diff --git a/src/config/static_config.rs b/src/config/static_config.rs
index c389a64..18addbc 100644
--- a/src/config/static_config.rs
+++ b/src/config/static_config.rs
@@ -1,6 +1,5 @@
 use serde::Deserialize;
 
-#[allow(dead_code)]
 #[derive(Debug, Clone, Deserialize, PartialEq)]
 pub struct StaticConfig {
     pub listeners: Vec<ListenerConfig>,
@@ -28,7 +27,6 @@ pub fn default_shutdown_timeout_secs() -> u64 {
     30
 }
 
-#[allow(dead_code)]
 #[derive(Debug, Clone, Deserialize, PartialEq)]
 pub struct ListenerConfig {
     pub bind_addr: String,
@@ -41,17 +39,14 @@ pub struct ListenerConfig {
     pub sites: Vec<crate::config::dynamic_config::SiteConfig>,
 }
 
-#[allow(dead_code)]
 fn default_http_port() -> u32 {
     80
 }
 
-#[allow(dead_code)]
 fn default_https_port() -> u16 {
     443
 }
 
-#[allow(dead_code)]
 #[derive(Debug, Clone, Deserialize, PartialEq)]
 pub struct TlsConfig {
     pub mode: String,
@@ -69,12 +64,10 @@ pub struct TlsConfig {
     pub key_path: String,
 }
 
-#[allow(dead_code)]
 fn default_acme_directory() -> String {
     "production".to_string()
 }
 
-#[allow(dead_code)]
 #[derive(Debug, Clone, Deserialize, PartialEq)]
 pub struct LoggingConfig {
     #[serde(default = "default_log_level")]
@@ -85,12 +78,10 @@ pub struct LoggingConfig {
     pub log_file_path: Option<String>,
 }
 
-#[allow(dead_code)]
 fn default_log_level() -> String {
     "info".to_string()
 }
 
-#[allow(dead_code)]
 fn default_log_format() -> String {
     "text".to_string()
 }
diff --git a/src/config/validation.rs b/src/config/validation.rs
index 03edc05..fba4030 100644
--- a/src/config/validation.rs
+++ b/src/config/validation.rs
@@ -7,6 +7,7 @@ use super::dynamic_config::DynamicConfig;
 use super::static_config::StaticConfig;
 
 #[derive(Debug, Error)]
+#[non_exhaustive]
 pub enum ValidationError {
     #[error("at least one listener must be defined")]
     NoListeners,
diff --git a/src/main.rs b/src/main.rs
index 60ff4c7..86c0e5e 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -120,6 +120,7 @@ async fn run_server(loaded_config: cli::LoadedConfig, config_path: &str) -> Resu
                     AdminSocketError::Io(e) => {
                         error!("admin socket IO error: {}", e);
                     }
+                    _ => {}
                 }
             }
         });
@@ -183,6 +184,12 @@ async fn run_server(loaded_config: cli::LoadedConfig, config_path: &str) -> Resu
                     "ACME TLS configured"
                 );
             }
+            _ => {
+                warn!(
+                    addr = %listener_config.bind_addr,
+                    "unsupported TLS mode"
+                );
+            }
         }
     }
 
diff --git a/src/proxy/error.rs b/src/proxy/error.rs
index 9b7e101..59f17a2 100644
--- a/src/proxy/error.rs
+++ b/src/proxy/error.rs
@@ -2,6 +2,7 @@ use axum::http::StatusCode;
 use axum::response::{IntoResponse, Response};
 
 #[derive(Debug, thiserror::Error)]
+#[non_exhaustive]
 pub enum ProxyError {
     #[error("Bad Gateway")]
     BadGateway { host: String, upstream: String },
diff --git a/src/tls/acceptor.rs b/src/tls/acceptor.rs
index 6d90d43..ad1fc3c 100644
--- a/src/tls/acceptor.rs
+++ b/src/tls/acceptor.rs
@@ -12,7 +12,6 @@ use crate::shutdown::GracefulShutdown;
 
 const ACME_TLS_ALPN_01: &[u8] = b"acme-tls/1";
 
-#[allow(dead_code)]
 fn build_acme_server_config(
     resolver: Arc<rustls_acme::ResolvesServerCertAcme>,
 ) -> Result<Arc<ServerConfig>> {
@@ -31,8 +30,8 @@ fn build_acme_server_config(
     Ok(Arc::new(config))
 }
 
-#[allow(dead_code)]
 #[derive(Debug)]
+#[non_exhaustive]
 pub enum TlsMode {
     Manual(Arc<ServerConfig>),
     Acme {
@@ -41,7 +40,6 @@ pub enum TlsMode {
     },
 }
 
-#[allow(dead_code)]
 pub fn setup_tls(tls_config: &TlsConfig, shutdown: Arc<GracefulShutdown>) -> Result<TlsMode> {
     match tls_config.mode.as_str() {
         "manual" => {
diff --git a/src/tls/acme.rs b/src/tls/acme.rs
index a6faa48..278acd1 100644
--- a/src/tls/acme.rs
+++ b/src/tls/acme.rs
@@ -8,13 +8,10 @@ use tracing::{error, info, warn};
 
 use crate::shutdown::GracefulShutdown;
 
-#[allow(dead_code)]
 const LETS_ENCRYPT_PRODUCTION_DIRECTORY: &str = "https://acme-v02.api.letsencrypt.org/directory";
-#[allow(dead_code)]
 const LETS_ENCRYPT_STAGING_DIRECTORY: &str =
     "https://acme-staging-v02.api.letsencrypt.org/directory";
 
-#[allow(dead_code)]
 pub struct AcmeTlsConfig {
     pub domains: Vec<String>,
     pub cache_dir: PathBuf,
@@ -22,7 +19,6 @@ pub struct AcmeTlsConfig {
     pub contact: Vec<String>,
 }
 
-#[allow(dead_code)]
 pub struct AcmeTlsSetup {
     pub resolver: Arc<ResolvesServerCertAcme>,
     pub state: AcmeState<std::io::Error, std::io::Error>,
@@ -54,7 +50,6 @@ impl AcmeTlsConfig {
         Ok(AcmeTlsSetup { resolver, state })
     }
 
-    #[allow(dead_code)]
     pub fn directory_url(&self) -> &str {
         match self.directory.as_str() {
             "production" => LETS_ENCRYPT_PRODUCTION_DIRECTORY,
@@ -64,7 +59,6 @@ impl AcmeTlsConfig {
     }
 }
 
-#[allow(dead_code)]
 pub fn spawn_acme_state(
     state: AcmeState<std::io::Error, std::io::Error>,
     domains: Vec<String>,
diff --git a/src/tls/config.rs b/src/tls/config.rs
index 1b705b7..9e671b4 100644
--- a/src/tls/config.rs
+++ b/src/tls/config.rs
@@ -14,7 +14,6 @@ use rustls::ServerConfig;
 use rustls::SupportedCipherSuite;
 use rustls_pemfile;
 
-#[allow(dead_code)]
 static RESTRICTED_CIPHER_SUITES: &[SupportedCipherSuite] = &[
     cipher_suite::TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
     cipher_suite::TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,