diff --git a/.github/workflows/centos-and-fedora.yml b/.github/workflows/centos-and-fedora.yml
index b2a395ac2b..cfb6e2caa0 100644
--- a/.github/workflows/centos-and-fedora.yml
+++ b/.github/workflows/centos-and-fedora.yml
@@ -133,9 +133,7 @@ jobs:
 
       - name: Build botan head
         if:   matrix.image.botan_ver == 'head'
-        # Botan's head renamed curve25519 module to x25519, however this didn't get to 3.5.0 release yet
         run: |
-          sed -i 's/curve25519/x25519/g' /opt/tools/botan3-modules /opt/tools/botan3-pqc-modules 
           /opt/tools/tools.sh build_and_install_botan head
 
       - name: Configure
diff --git a/ci/tests/ci-tests.sh b/ci/tests/ci-tests.sh
index 3a7b269ab7..6113d108c6 100755
--- a/ci/tests/ci-tests.sh
+++ b/ci/tests/ci-tests.sh
@@ -41,7 +41,7 @@ SHUNIT_PARENT="$0"
 
 test_symbol_visibility() {
     case "$OSTYPE" in
-      msys)
+      msys|cygwin)
         mkdir tmp
         wget -O tmp/Dependencies_x64_Release.zip https://github.com/lucasg/Dependencies/releases/download/v1.10/Dependencies_x64_Release.zip
         7z x tmp/Dependencies_x64_Release.zip -otmp
diff --git a/src/lib/crypto/dsa.h b/src/lib/crypto/dsa.h
index 6bdcb2a674..a0cce712d9 100644
--- a/src/lib/crypto/dsa.h
+++ b/src/lib/crypto/dsa.h
@@ -40,8 +40,8 @@ namespace dsa {
 
 class Signature {
   public:
-    mpi r;
-    mpi s;
+    mpi r{};
+    mpi s{};
 };
 
 class Key {
diff --git a/src/lib/crypto/ec.h b/src/lib/crypto/ec.h
index 71cd8e92db..788c1df4bb 100644
--- a/src/lib/crypto/ec.h
+++ b/src/lib/crypto/ec.h
@@ -106,8 +106,8 @@ class Curve {
 
 class Signature {
   public:
-    mpi r;
-    mpi s;
+    mpi r{};
+    mpi s{};
 };
 
 class Key {
diff --git a/src/lib/crypto/elgamal.h b/src/lib/crypto/elgamal.h
index a4f372985c..858676a5f1 100644
--- a/src/lib/crypto/elgamal.h
+++ b/src/lib/crypto/elgamal.h
@@ -39,8 +39,8 @@ class Signature {
   public:
     /* This is kept only for packet reading. Implementation MUST
      * not create elgamal signatures */
-    mpi r;
-    mpi s;
+    mpi r{};
+    mpi s{};
 };
 
 class Encrypted {
@@ -51,11 +51,11 @@ class Encrypted {
 
 class Key {
   public:
-    mpi p;
-    mpi g;
-    mpi y;
+    mpi p{};
+    mpi g{};
+    mpi y{};
     /* secret mpi */
-    mpi x;
+    mpi x{};
 
     void
     clear_secret()
diff --git a/src/lib/crypto/rsa.h b/src/lib/crypto/rsa.h
index 644925ba09..933388ab21 100644
--- a/src/lib/crypto/rsa.h
+++ b/src/lib/crypto/rsa.h
@@ -38,7 +38,7 @@ namespace rsa {
 
 class Signature {
   public:
-    mpi s;
+    mpi s{};
 };
 
 class Encrypted {
diff --git a/src/lib/rnp.cpp b/src/lib/rnp.cpp
index c64e13d290..f27f24e768 100644
--- a/src/lib/rnp.cpp
+++ b/src/lib/rnp.cpp
@@ -4514,7 +4514,7 @@ parse_keygen_common_fields(json_object *                jso,
     std::string              str;
     std::vector<std::string> strs;
     if (json_get_str(jso, "usage", str)) {
-        strs.push_back(str);
+        strs.push_back(std::move(str));
     } else {
         json_get_str_arr(jso, "usage", strs);
     }
diff --git a/src/librepgp/stream-ctx.cpp b/src/librepgp/stream-ctx.cpp
index dc7f3a43fc..aabc1d3d08 100644
--- a/src/librepgp/stream-ctx.cpp
+++ b/src/librepgp/stream-ctx.cpp
@@ -64,7 +64,7 @@ rnp_ctx_t::add_encryption_password(const std::string &password,
     if (!pgp_s2k_derive_key(&info.s2k, password.c_str(), info.key.data(), info.key.size())) {
         return RNP_ERROR_GENERIC;
     }
-    passwords.push_back(info);
+    passwords.push_back(std::move(info));
     return RNP_SUCCESS;
 }
 
diff --git a/src/librepgp/stream-parse.cpp b/src/librepgp/stream-parse.cpp
index e88b1d3705..c8c11b0d9d 100644
--- a/src/librepgp/stream-parse.cpp
+++ b/src/librepgp/stream-parse.cpp
@@ -2072,7 +2072,7 @@ encrypted_read_packet_data(pgp_source_encrypted_param_t *param)
                     errors++;
                     continue;
                 }
-                param->symencs.push_back(skey);
+                param->symencs.push_back(std::move(skey));
                 break;
             }
             case PGP_PKT_PK_SESSION_KEY: {
@@ -2087,7 +2087,7 @@ encrypted_read_packet_data(pgp_source_encrypted_param_t *param)
                     errors++;
                     continue;
                 }
-                param->pubencs.push_back(pkey);
+                param->pubencs.push_back(std::move(pkey));
                 break;
             }
             case PGP_PKT_SE_DATA:
diff --git a/src/librepgp/stream-write.cpp b/src/librepgp/stream-write.cpp
index 56e95f1e55..3e69467c2d 100644
--- a/src/librepgp/stream-write.cpp
+++ b/src/librepgp/stream-write.cpp
@@ -677,7 +677,7 @@ encrypted_add_password_v4_single(pgp_dest_encrypted_param_t &param,
     skey.alg = param.ctx.ealg;
     skey.enckeylen = 0;
     key.assign(pass.key.data(), pass.key.data() + keylen);
-    param.skesks.push_back(skey);
+    param.skesks.push_back(std::move(skey));
 }
 
 static bool
@@ -700,7 +700,7 @@ encrypted_add_password_v4(pgp_dest_encrypted_param_t &     param,
     }
     pgp_cipher_cfb_encrypt(&kcrypt, skey.enckey, skey.enckey, skey.enckeylen);
     pgp_cipher_cfb_finish(&kcrypt);
-    param.skesks.push_back(skey);
+    param.skesks.push_back(std::move(skey));
     return true;
 }
 
@@ -749,7 +749,7 @@ encrypted_add_password_v5(pgp_dest_encrypted_param_t &     param,
 
     pgp_cipher_aead_destroy(&kcrypt);
     if (res) {
-        param.skesks.push_back(skey);
+        param.skesks.push_back(std::move(skey));
     }
     return res;
 #endif
diff --git a/src/rnp/fficli.cpp b/src/rnp/fficli.cpp
index 6ba0955b5b..4a0f07b6cb 100644
--- a/src/rnp/fficli.cpp
+++ b/src/rnp/fficli.cpp
@@ -255,7 +255,7 @@ rnp_ask_filename(const std::string &msg, std::string &res, cli_rnp_t &rnp)
         }
         path = path + std::string(fname);
         if (rnp::strip_eol(path)) {
-            res = path;
+            res = std::move(path);
             return true;
         }
         if (path.size() >= 2048) {
@@ -284,7 +284,7 @@ rnp_get_output_filename(const std::string &path, std::string &res, cli_rnp_t &rn
 
     while (true) {
         if (!rnp_file_exists(newpath.c_str())) {
-            res = newpath;
+            res = std::move(newpath);
             return true;
         }
         if (rnp.cfg().get_bool(CFG_OVERWRITE) ||
@@ -293,7 +293,7 @@ rnp_get_output_filename(const std::string &path, std::string &res, cli_rnp_t &rn
               "File '%s' already exists. Would you like to overwrite it?",
               newpath.c_str())) {
             rnp_unlink(newpath.c_str());
-            res = newpath;
+            res = std::move(newpath);
             return true;
         }
 
@@ -1242,7 +1242,7 @@ static const std::string alg_aliases[] = {
   "SHA-512",      "SHA512",      "RIPEMD-160",   "RIPEMD160"};
 
 const std::string
-cli_rnp_alg_to_ffi(const std::string alg)
+cli_rnp_alg_to_ffi(const std::string &alg)
 {
     size_t count = sizeof(alg_aliases) / sizeof(alg_aliases[0]);
     assert((count % 2) == 0);
@@ -2540,7 +2540,7 @@ output_strip_extension(Operation op, const std::string &in)
 }
 
 static std::string
-extract_filename(const std::string path)
+extract_filename(const std::string &path)
 {
     size_t lpos = path.find_last_of("/\\");
     if (lpos == std::string::npos) {
diff --git a/src/rnp/fficli.h b/src/rnp/fficli.h
index 1a16d6180c..42c340d22b 100644
--- a/src/rnp/fficli.h
+++ b/src/rnp/fficli.h
@@ -248,7 +248,7 @@ void        cli_rnp_print_feature(FILE *fp, const char *type, const char *printe
  * @return string with FFI algorithm's name. In case alias is not found the source string will
  * be returned.
  */
-const std::string cli_rnp_alg_to_ffi(const std::string alg);
+const std::string cli_rnp_alg_to_ffi(const std::string &alg);
 
 /**
  * @brief Attempt to set hash algorithm using the value provided.