diff --git a/tvix/clippy.toml b/tvix/clippy.toml
new file mode 100644
index 000000000..be7709684
--- /dev/null
+++ b/tvix/clippy.toml
@@ -0,0 +1,6 @@
+# prevents a false-positive lint on our types containing bytes::Bytes
+# https://rust-lang.github.io/rust-clippy/master/index.html#/mutable_key_type
+ignore-interior-mutability = [
+  "bytes::Bytes",
+  "tvix_castore::digests::B3Digest"
+]
diff --git a/tvix/eval/src/lib.rs b/tvix/eval/src/lib.rs
index 4227014c2..60b1102d5 100644
--- a/tvix/eval/src/lib.rs
+++ b/tvix/eval/src/lib.rs
@@ -288,6 +288,7 @@ impl<'code, 'co, 'ro> Evaluation<'code, 'co, 'ro> {
 
 /// Internal helper function for common parsing & compilation logic
 /// between the public functions.
+#[allow(clippy::too_many_arguments)] // internal API, no point making an indirection type
 fn parse_compile_internal(
     result: &mut EvaluationResult,
     code: &str,
diff --git a/tvix/eval/src/value/mod.rs b/tvix/eval/src/value/mod.rs
index 3a9dcf2c8..e4f8bf0fd 100644
--- a/tvix/eval/src/value/mod.rs
+++ b/tvix/eval/src/value/mod.rs
@@ -469,6 +469,7 @@ impl Value {
 
                 // Special-case for derivation comparisons: If both attribute sets
                 // have `type = derivation`, compare them by `outPath`.
+                #[allow(clippy::single_match)] // might need more match arms later
                 match (a1.select("type"), a2.select("type")) {
                     (Some(v1), Some(v2)) => {
                         let s1 = generators::request_force(&co, v1.clone()).await.to_str();
diff --git a/tvix/store/src/fs/mod.rs b/tvix/store/src/fs/mod.rs
index 806db0bb2..72afec5fc 100644
--- a/tvix/store/src/fs/mod.rs
+++ b/tvix/store/src/fs/mod.rs
@@ -93,6 +93,7 @@ pub struct TvixStoreFs {
     inode_tracker: RwLock<InodeTracker>,
 
     /// This holds all open file handles
+    #[allow(clippy::type_complexity)]
     file_handles: RwLock<HashMap<u64, Arc<tokio::sync::Mutex<Box<dyn BlobReader>>>>>,
 
     next_file_handle: AtomicU64,