diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e81e915a..a400cfd3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -105,7 +105,7 @@ jobs:
           toolchain: 1.89 # pinned to prevent breakages when clippy updates
       - run: sudo apt-get update && sudo apt-get install libudev-dev
       - run: rustup component add clippy
-      - run: cargo clippy --all-features
+      - run: cargo clippy --all-features --all-targets
 
   # Licenses, banned crates and dependency sources. Advisories are covered by the
   # separate security_audit workflow.
diff --git a/FORK.md b/FORK.md
index a10cdd42..3823cf1c 100644
--- a/FORK.md
+++ b/FORK.md
@@ -178,7 +178,8 @@ Signing is unaffected either way.
 
 ## Verification
 
-- `cargo fmt --all -- --check` and `cargo clippy --all-features` — clean.
+- `cargo fmt --all -- --check` — clean.
+- `cargo clippy --all-features --all-targets` — clean.
 - `cargo test --all-features -- --test-threads 1` — 64 unit + 23 integration tests
   pass (10 ignored, all hardware-dependent).
 - The published image is pulled and checked on every release: it reports its own
diff --git a/README.md b/README.md
index 9a3ab922..6fc56f07 100644
--- a/README.md
+++ b/README.md
@@ -208,7 +208,7 @@ cargo fmt
 Lint your code (i.e. check it for common issues) with:
 
 ```
-cargo clippy
+cargo clippy --all-features --all-targets
 ```
 
 ## License
diff --git a/tests/integration.rs b/tests/integration.rs
index 30bf6ca7..2b098f6c 100644
--- a/tests/integration.rs
+++ b/tests/integration.rs
@@ -33,15 +33,15 @@ const SIGNING_SECP256K1_KEY_PATH: &str = "tests/support/signing_secp256k1.key";
 
 enum KmsSocket {
     /// TCP socket type
-    TCP(TcpStream),
+    Tcp(TcpStream),
 
     /// UNIX socket type
-    UNIX(UnixStream),
+    Unix(UnixStream),
 }
 
 enum KmsConnection {
-    /// Secret connection type
-    Tcp(SecretConnection<TcpStream>),
+    /// Secret connection type, boxed: it is far larger than the UNIX variant
+    Tcp(Box<SecretConnection<TcpStream>>),
 
     /// UNIX connection type
     Unix(UnixConnection<UnixStream>),
@@ -97,7 +97,7 @@ impl KmsProcess {
         let (socket, _) = listener.accept().unwrap();
         Self {
             process,
-            socket: KmsSocket::TCP(socket),
+            socket: KmsSocket::Tcp(socket),
             _state_dir: state_dir,
         }
     }
@@ -122,7 +122,7 @@ impl KmsProcess {
         let (socket, _) = listener.accept().unwrap();
         Self {
             process,
-            socket: KmsSocket::UNIX(socket),
+            socket: KmsSocket::Unix(socket),
             _state_dir: state_dir,
         }
     }
@@ -198,17 +198,19 @@ impl KmsProcess {
     /// Get a connection from the socket
     pub fn create_connection(&self) -> KmsConnection {
         match self.socket {
-            KmsSocket::TCP(ref sock) => {
+            KmsSocket::Tcp(ref sock) => {
                 // we use the same key for both sides:
                 let identity_key = IdentitySecret::from(test_ed25519_identity_keypair());
 
                 // Here we reply to the kms with a "remote" ephemeral key, auth signature etc:
                 let socket_cp = sock.try_clone().unwrap();
 
-                KmsConnection::Tcp(SecretConnection::new(socket_cp, &identity_key).unwrap())
+                KmsConnection::Tcp(Box::new(
+                    SecretConnection::new(socket_cp, &identity_key).unwrap(),
+                ))
             }
 
-            KmsSocket::UNIX(ref sock) => {
+            KmsSocket::Unix(ref sock) => {
                 let socket_cp = sock.try_clone().unwrap();
 
                 KmsConnection::Unix(UnixConnection::new(socket_cp))
@@ -271,8 +273,8 @@ impl ReadMsg<proto::privval::Message> for ProtocolTester {
 
 impl WriteMsg<proto::privval::Message> for ProtocolTester {
     fn write_msg(&mut self, msg: &proto::privval::Message) -> p2p::Result<()> {
-        self.tcp_connection.write_msg(&msg)?;
-        self.unix_connection.write_msg(&msg)?;
+        self.tcp_connection.write_msg(msg)?;
+        self.unix_connection.write_msg(msg)?;
         Ok(())
     }
 }