diff --git a/.clang-tidy b/.clang-tidy
index 9b49bceb..4d432db3 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -12,7 +12,9 @@
 # reserved-identifier: the codebase uses _prefixed names and vendored
 # uthash.h/generated config.h trip them ~600 times) or produce false
 # positives with the event callback style (casting-through-void,
-# multi-level-implicit-pointer-conversion).
+# multi-level-implicit-pointer-conversion). dynamic-static-initializers
+# fires on every extern variable declaration in the C headers once they are
+# included from C++; none of them is defined or initialised in a header.
 Checks: >
   clang-analyzer-*,
   bugprone-*,
@@ -20,6 +22,7 @@ Checks: >
   -bugprone-assignment-in-if-condition,
   -bugprone-branch-clone,
   -bugprone-casting-through-void,
+  -bugprone-dynamic-static-initializers,
   -bugprone-easily-swappable-parameters,
   -bugprone-inc-dec-in-conditions,
   -bugprone-implicit-widening-of-multiplication-result,
diff --git a/src/ssurl.cpp b/src/ssurl.cpp
index a26831cf..1b03944e 100644
--- a/src/ssurl.cpp
+++ b/src/ssurl.cpp
@@ -244,12 +244,14 @@ ss_url_parse(const char *uri, ss_url_t *url)
         return -1;
 
     /* The fragment is a human-readable tag and is not part of the config. */
+    // NOLINTNEXTLINE(bugprone-not-null-terminated-result): memchr searches a bounded span, no string is produced
     const char *hash = (const char *)memchr(body, '#', body_len);
     if (hash != NULL) {
         url->tag = percent_decode(hash + 1, body_len - (size_t)(hash - body) - 1);
         body_len = (size_t)(hash - body);
     }
 
+    // NOLINTNEXTLINE(bugprone-not-null-terminated-result): memchr searches a bounded span, no string is produced
     const char *query = (const char *)memchr(body, '?', body_len);
     size_t head_len   = query ? (size_t)(query - body) : body_len;