diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index 6eb72eebaf..025f5703ff 100644
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -3085,6 +3085,8 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 	dns_db_detach(&db);
 }
 
+static void
+print_time(FILE *fp) ISC_ATTR_NONNULL(1);
 static void
 print_time(FILE *fp) {
 	time_t currenttime = time(NULL);
@@ -3101,6 +3103,8 @@ print_time(FILE *fp) {
 	fprintf(fp, "; File written on %s\n", timebuf);
 }
 
+static void
+print_version(FILE *fp) ISC_ATTR_NONNULL(1);
 static void
 print_version(FILE *fp) {
 	if (outputformat != dns_masterformat_text) {
@@ -3908,6 +3912,7 @@ main(int argc, char *argv[]) {
 			fatal("failed to open temporary output file: %s",
 			      isc_result_totext(result));
 		}
+		INSIST(outfp != NULL);
 		removefile = true;
 		setfatalcallback(&removetempfile);
 	}
diff --git a/lib/isc/include/isc/attributes.h b/lib/isc/include/isc/attributes.h
index 96d57f9f49..03c84ae497 100644
--- a/lib/isc/include/isc/attributes.h
+++ b/lib/isc/include/isc/attributes.h
@@ -112,3 +112,9 @@
 #else
 #define ISC_ATTR_COUNTED_BY(x)
 #endif
+
+#if __has_attribute(__nonnull__)
+#define ISC_ATTR_NONNULL(...) __attribute__((__nonnull__(__VA_ARGS__)))
+#else
+#define ISC_ATTR_NONNULL(...)
+#endif