diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index ac63df4c2d..e2be0b85df 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -564,7 +564,13 @@ clang-format:
     when: on_failure
 
 coccinelle:
-  <<: *precheck_job
+  ######################################################################
+  # Revert to using the "precheck_job" anchor after the "base" image is
+  # upgraded to Debian trixie, which has Coccinelle 1.2.
+  <<: *default_triggering_rules
+  <<: *debian_sid_amd64_image
+  stage: precheck
+  ######################################################################
   needs: []
   script:
     - util/check-cocci
diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
index da1fffa400..48c09e9d48 100644
--- a/bin/dnssec/dnssectool.c
+++ b/bin/dnssec/dnssectool.c
@@ -460,9 +460,7 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	dns_secalg_t alg;
 	isc_stdtime_t now = isc_stdtime_now();
 
-	if (exact != NULL) {
-		*exact = false;
-	}
+	SET_IF_NOT_NULL(exact, false);
 
 	id = dst_key_id(dstkey);
 	rid = dst_key_rid(dstkey);
diff --git a/cocci/unsigned-int.spatch b/cocci/unsigned-int.spatch
index 9b4aaa5474..6ea76527d3 100644
--- a/cocci/unsigned-int.spatch
+++ b/cocci/unsigned-int.spatch
@@ -1,4 +1,4 @@
-@@
+@depends on !(file in "util/models.c") && !(file in "lib/dns/sdlz.c")@
 @@
 
 - unsigned
diff --git a/lib/dns/message.c b/lib/dns/message.c
index 44e0c6ab7c..bb83ff41d7 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -2551,9 +2551,7 @@ dns_message_findname(dns_message_t *msg, dns_section_t section,
 		return result;
 	}
 
-	if (name != NULL) {
-		*name = foundname;
-	}
+	SET_IF_NOT_NULL(name, foundname);
 
 	/*
 	 * And now look for the type.
diff --git a/lib/dns/private.c b/lib/dns/private.c
index b1718fbdb1..b5606f6b85 100644
--- a/lib/dns/private.c
+++ b/lib/dns/private.c
@@ -138,12 +138,8 @@ dns_private_chains(dns_db_t *db, dns_dbversion_t *ver,
 	if (dns_rdataset_isassociated(&nsecset) &&
 	    dns_rdataset_isassociated(&nsec3paramset))
 	{
-		if (build_nsec != NULL) {
-			*build_nsec = true;
-		}
-		if (build_nsec3 != NULL) {
-			*build_nsec3 = true;
-		}
+		SET_IF_NOT_NULL(build_nsec, true);
+		SET_IF_NOT_NULL(build_nsec3, true);
 		goto success;
 	}
 
@@ -160,12 +156,8 @@ dns_private_chains(dns_db_t *db, dns_dbversion_t *ver,
 	 * Look to see if we also need to be creating a NSEC3 chain.
 	 */
 	if (dns_rdataset_isassociated(&nsecset)) {
-		if (build_nsec != NULL) {
-			*build_nsec = true;
-		}
-		if (build_nsec3 != NULL) {
-			*build_nsec3 = false;
-		}
+		SET_IF_NOT_NULL(build_nsec, true);
+		SET_IF_NOT_NULL(build_nsec3, false);
 		if (!dns_rdataset_isassociated(&privateset)) {
 			goto success;
 		}
@@ -194,12 +186,8 @@ dns_private_chains(dns_db_t *db, dns_dbversion_t *ver,
 	}
 
 	if (dns_rdataset_isassociated(&nsec3paramset)) {
-		if (build_nsec3 != NULL) {
-			*build_nsec3 = true;
-		}
-		if (build_nsec != NULL) {
-			*build_nsec = false;
-		}
+		SET_IF_NOT_NULL(build_nsec3, true);
+		SET_IF_NOT_NULL(build_nsec, false);
 		if (!dns_rdataset_isassociated(&privateset)) {
 			goto success;
 		}
@@ -264,12 +252,8 @@ dns_private_chains(dns_db_t *db, dns_dbversion_t *ver,
 		goto success;
 	}
 
-	if (build_nsec != NULL) {
-		*build_nsec = false;
-	}
-	if (build_nsec3 != NULL) {
-		*build_nsec3 = false;
-	}
+	SET_IF_NOT_NULL(build_nsec, false);
+	SET_IF_NOT_NULL(build_nsec3, false);
 	if (!dns_rdataset_isassociated(&privateset)) {
 		goto success;
 	}
diff --git a/lib/dns/view.c b/lib/dns/view.c
index fb354d3ad7..d2f21ee8ba 100644
--- a/lib/dns/view.c
+++ b/lib/dns/view.c
@@ -1599,9 +1599,7 @@ dns_view_issecuredomain(dns_view_t *view, const dns_name_t *name,
 		return result;
 	}
 
-	if (ntap != NULL) {
-		*ntap = false;
-	}
+	SET_IF_NOT_NULL(ntap, false);
 	if (checknta && secure && view->ntatable_priv != NULL &&
 	    dns_ntatable_covered(view->ntatable_priv, now, name, anchor))
 	{
diff --git a/lib/isccfg/aclconf.c b/lib/isccfg/aclconf.c
index 03030aa898..0f382dca7b 100644
--- a/lib/isccfg/aclconf.c
+++ b/lib/isccfg/aclconf.c
@@ -209,9 +209,7 @@ count_acl_elements(const cfg_obj_t *caml, const cfg_obj_t *cctx,
 
 	REQUIRE(count != NULL);
 
-	if (has_negative != NULL) {
-		*has_negative = false;
-	}
+	SET_IF_NOT_NULL(has_negative, false);
 
 	for (elt = cfg_list_first(caml); elt != NULL; elt = cfg_list_next(elt))
 	{
diff --git a/tests/libtest/ns.c b/tests/libtest/ns.c
index 5cca2387d9..93384803f7 100644
--- a/tests/libtest/ns.c
+++ b/tests/libtest/ns.c
@@ -347,15 +347,9 @@ extract_qctx(void *arg, void *data, isc_result_t *resultp) {
 	 * gets unwound.
 	 */
 	qctx = isc_mem_get(mctx, sizeof(*qctx));
-	if (qctx != NULL) {
-		memmove(qctx, (query_ctx_t *)arg, sizeof(*qctx));
-	}
+	memmove(qctx, (query_ctx_t *)arg, sizeof(*qctx));
 
 	qctxp = (query_ctx_t **)data;
-	/*
-	 * If memory allocation failed, the supplied pointer will simply be set
-	 * to NULL.  We rely on the user of this hook to react properly.
-	 */
 	*qctxp = qctx;
 	*resultp = ISC_R_UNSET;