diff --git a/scripts/publish.py b/scripts/publish.py
index 4908715..f54bd95 100644
--- a/scripts/publish.py
+++ b/scripts/publish.py
@@ -6,7 +6,7 @@ Usage:
 """
 
 import os
-import subprocess
+import subprocess  # nosec B404
 import sys
 
 import click
@@ -19,7 +19,7 @@ from gitea_runner_manager.i18n import _
 
 def build_package() -> None:
     """Build the Python package using python -m build."""
-    result = subprocess.run(
+    result = subprocess.run(  # nosec B603
         [sys.executable, "-m", "build"],
         capture_output=True,
         text=True,
@@ -36,7 +36,7 @@ def build_package() -> None:
 
 def publish_to_pypi(token: str) -> None:
     """Publish built packages to PyPI using twine."""
-    result = subprocess.run(
+    result = subprocess.run(  # nosec B603
         [
             sys.executable,
             "-m",
diff --git a/scripts/validate_commit_msg.py b/scripts/validate_commit_msg.py
index de0b362..2fd84b3 100644
--- a/scripts/validate_commit_msg.py
+++ b/scripts/validate_commit_msg.py
@@ -8,7 +8,7 @@ Rules:
 """
 
 import re
-import subprocess
+import subprocess  # nosec B404
 
 import click
 
@@ -24,7 +24,7 @@ def first_line(text: str) -> str:
 
 def get_branch() -> str:
     try:
-        result = subprocess.run(
+        result = subprocess.run(  # nosec
             ["git", "symbolic-ref", "--short", "HEAD"],
             capture_output=True,
             text=True,
diff --git a/src/gitea_runner_manager/executor.py b/src/gitea_runner_manager/executor.py
index 462e605..02a8fc8 100644
--- a/src/gitea_runner_manager/executor.py
+++ b/src/gitea_runner_manager/executor.py
@@ -5,7 +5,7 @@ from __future__ import annotations
 import logging
 import os
 import re
-import subprocess
+import subprocess  # nosec B404
 import sys
 from datetime import datetime
 from pathlib import Path
@@ -62,14 +62,14 @@ class AnsibleExecutor:
         """Execute command, streaming stdout+stderr to log file. Returns exit code."""
         env = os.environ.copy()
         with open(log_file, "a") as f:
-            proc = subprocess.Popen(
+            proc = subprocess.Popen(  # nosec B603
                 cmd,
                 env=env,
                 stdout=subprocess.PIPE,
                 stderr=subprocess.STDOUT,
                 text=True,
             )
-            assert proc.stdout is not None
+            assert proc.stdout is not None  # nosec B101
             try:
                 for line in proc.stdout:
                     f.write(line)
@@ -108,7 +108,7 @@ class AnsibleExecutor:
             cmd.append("--ask-become-pass")
 
         env = os.environ.copy()
-        proc = subprocess.run(
+        proc = subprocess.run(  # nosec B603
             cmd,
             env=env,
             capture_output=True,
@@ -137,6 +137,6 @@ class AnsibleExecutor:
             )
             if match:
                 return match.group(1).replace("\\n", " ").strip()
-        except Exception:
-            pass
+        except OSError:
+            return None
         return None
diff --git a/src/gitea_runner_manager/runner_manager.py b/src/gitea_runner_manager/runner_manager.py
index aea5791..68b030d 100644
--- a/src/gitea_runner_manager/runner_manager.py
+++ b/src/gitea_runner_manager/runner_manager.py
@@ -330,7 +330,7 @@ class RunnerManager:
                             ask_become_pass=True,
                             check=False,
                         )
-                    except Exception:
+                    except AnsibleError:
                         continue
                     status = self._parse_status(stdout)
                     if status != "unknown":
@@ -351,7 +351,7 @@ class RunnerManager:
                             check=False,
                         )
                         service_status = self._parse_status(stdout)
-                    except Exception:
+                    except AnsibleError:
                         service_status = "unknown"
             else:
                 try:
@@ -366,7 +366,7 @@ class RunnerManager:
                         check=False,
                     )
                     service_status = self._parse_status(stdout)
-                except Exception:
+                except AnsibleError:
                     service_status = "unknown"
             # Translate known status values
             translated_status = _(
diff --git a/tests/unit/test_runner_manager.py b/tests/unit/test_runner_manager.py
index ebbc1b7..c647200 100644
--- a/tests/unit/test_runner_manager.py
+++ b/tests/unit/test_runner_manager.py
@@ -518,7 +518,7 @@ class TestRunnerManager:
         }
         manager = RunnerManager(registry=mock_registry)
         mock_executor = MagicMock()
-        mock_executor.run_ad_hoc.side_effect = Exception("ssh fail")
+        mock_executor.run_ad_hoc.side_effect = AnsibleError("ssh fail")
         manager._executor = mock_executor
 
         runners = manager.list_runners()
@@ -579,7 +579,7 @@ class TestRunnerManager:
         }
         manager = RunnerManager(registry=mock_registry)
         mock_executor = MagicMock()
-        mock_executor.run_ad_hoc.side_effect = [Exception("ssh fail"), "running"]
+        mock_executor.run_ad_hoc.side_effect = [AnsibleError("ssh fail"), "running"]
         manager._executor = mock_executor
 
         runners = manager.list_runners()
@@ -593,7 +593,7 @@ class TestRunnerManager:
         }
         manager = RunnerManager(registry=mock_registry)
         mock_executor = MagicMock()
-        mock_executor.run_ad_hoc.side_effect = Exception("ssh fail")
+        mock_executor.run_ad_hoc.side_effect = AnsibleError("ssh fail")
         manager._executor = mock_executor
 
         runners = manager.list_runners()