diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index b2c77d497a..6c4bf3631e 100644
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -3199,6 +3199,8 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 	dns_db_detach(&db);
 }
 
+static void
+print_time(FILE *fp) ISC_ATTR_NONNULL(1);
 static void
 print_time(FILE *fp) {
 	time_t currenttime = time(NULL);
@@ -3215,6 +3217,8 @@ print_time(FILE *fp) {
 	fprintf(fp, "; File written on %s\n", timebuf);
 }
 
+static void
+print_version(FILE *fp) ISC_ATTR_NONNULL(1);
 static void
 print_version(FILE *fp) {
 	if (outputformat != dns_masterformat_text) {
@@ -4021,6 +4025,7 @@ main(int argc, char *argv[]) {
 			fatal("failed to open temporary output file: %s",
 			      isc_result_totext(result));
 		}
+		INSIST(outfp != NULL);
 		removefile = true;
 		setfatalcallback(&removetempfile);
 	}
diff --git a/lib/isc/include/isc/attributes.h b/lib/isc/include/isc/attributes.h
index f38a558552..ecb3e93a50 100644
--- a/lib/isc/include/isc/attributes.h
+++ b/lib/isc/include/isc/attributes.h
@@ -82,3 +82,9 @@
 #endif /* HAVE_FUNC_ATTRIBUTE_MALLOC */
 
 #define ISC_ATTR_UNUSED __attribute__((__unused__))
+
+#if __has_attribute(__nonnull__)
+#define ISC_ATTR_NONNULL(...) __attribute__((__nonnull__(__VA_ARGS__)))
+#else
+#define ISC_ATTR_NONNULL(...)
+#endif