diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4decfe9..2d27397 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,6 +36,28 @@ jobs:
           components: rustfmt
       - run: cargo fmt --check
 
+  clippy:
+    name: Clippy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libdbus-1-dev
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - name: Cache Cargo registry + build
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-clippy-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
+      - run: cargo clippy --all-targets --all-features -- -D warnings
+
   build:
     name: Build (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
diff --git a/src/config/mod.rs b/src/config/mod.rs
index 60925ea..e8e6b6f 100644
--- a/src/config/mod.rs
+++ b/src/config/mod.rs
@@ -1293,12 +1293,14 @@ peers:
 
     #[test]
     fn test_validate_peer_via_nostr_requires_nostr_enabled() {
-        let mut config = Config::default();
-        config.peers = vec![PeerConfig {
-            npub: "npub1peer".to_string(),
-            via_nostr: true,
+        let mut config = Config {
+            peers: vec![PeerConfig {
+                npub: "npub1peer".to_string(),
+                via_nostr: true,
+                ..Default::default()
+            }],
             ..Default::default()
-        }];
+        };
         config.node.discovery.nostr.enabled = false;
 
         let err = config.validate().expect_err("validation should fail");
@@ -1308,11 +1310,13 @@ peers:
     #[test]
     fn test_validate_peer_addresses_required_unless_via_nostr() {
         // Empty addresses + via_nostr=false → error.
-        let mut config = Config::default();
-        config.peers = vec![PeerConfig {
-            npub: "npub1peer".to_string(),
+        let mut config = Config {
+            peers: vec![PeerConfig {
+                npub: "npub1peer".to_string(),
+                ..Default::default()
+            }],
             ..Default::default()
-        }];
+        };
         let err = config.validate().expect_err("validation should fail");
         assert!(err.to_string().contains("at least one address"));
 
diff --git a/src/discovery/nostr/stun.rs b/src/discovery/nostr/stun.rs
index b4fcd89..83f1045 100644
--- a/src/discovery/nostr/stun.rs
+++ b/src/discovery/nostr/stun.rs
@@ -344,6 +344,14 @@ fn push_ip(addresses: &mut Vec<String>, ip: IpAddr) {
     }
 }
 
+fn random_txn_id() -> [u8; 12] {
+    let mut txn_id = [0u8; 12];
+    for byte in &mut txn_id {
+        *byte = rand::random::<u8>();
+    }
+    txn_id
+}
+
 #[cfg(test)]
 mod tests {
     use super::is_private_overlay_candidate_ip;
@@ -381,11 +389,3 @@ mod tests {
         )));
     }
 }
-
-fn random_txn_id() -> [u8; 12] {
-    let mut txn_id = [0u8; 12];
-    for byte in &mut txn_id {
-        *byte = rand::random::<u8>();
-    }
-    txn_id
-}
diff --git a/testing/ci-local.sh b/testing/ci-local.sh
index c1c9927..47d3b37 100755
--- a/testing/ci-local.sh
+++ b/testing/ci-local.sh
@@ -193,8 +193,8 @@ run_build() {
         return 1
     fi
 
-    info "cargo clippy --all -- -D warnings"
-    if cargo clippy --all -- -D warnings 2>&1; then
+    info "cargo clippy --all-targets --all-features -- -D warnings"
+    if cargo clippy --all-targets --all-features -- -D warnings 2>&1; then
         record "clippy" 0
     else
         record "clippy" 1