diff --git a/.golangci.yml b/.golangci.yml
index 5fa6c13860..82ad006687 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -154,6 +154,7 @@ linters:
           - gosec
           - staticcheck
           - unparam
+          - nilnil
         path: _test\.go
       - linters:
           - dupl
@@ -188,21 +189,6 @@ linters:
         text: "(ST1005|ST1003|QF1001):"
 
       # TODO: eventually remove this section entirely
-      - path: cmd/admin_auth_ldap_test.go
-        linters:
-          - nilnil
-      - path: cmd/admin_auth_oauth_test.go
-        linters:
-          - nilnil
-      - path: cmd/admin_auth_pam_test.go
-        linters:
-          - nilnil
-      - path: cmd/cmd.go
-        linters:
-          - nilnil
-      - path: cmd/forgejo/actions.go
-        linters:
-          - nilnil
       - path: models/actions/run.go
         linters:
           - nilnil
@@ -227,9 +213,6 @@ linters:
       - path: models/forgejo_migrations_legacy/v32.go
         linters:
           - nilnil
-      - path: models/forgejo_migrations_legacy/v32_test.go
-        linters:
-          - nilnil
       - path: models/db/context.go
         linters:
           - nilnil
diff --git a/cmd/cmd.go b/cmd/cmd.go
index a6e5d8fcfe..d171cf56b7 100644
--- a/cmd/cmd.go
+++ b/cmd/cmd.go
@@ -52,6 +52,10 @@ func noDanglingArgs(ctx context.Context, c *cli.Command) (context.Context, error
 		}
 		return nil, fmt.Errorf("unexpected arguments: %s", strings.Join(c.Args().Slice(), ", "))
 	}
+
+	// The CLI library doesn't require a new context here, so this has to be a
+	// nil, nil
+	//nolint:nilnil
 	return nil, nil
 }
 
diff --git a/cmd/forgejo/actions.go b/cmd/forgejo/actions.go
index 309b9801cb..d4ffbffbc3 100644
--- a/cmd/forgejo/actions.go
+++ b/cmd/forgejo/actions.go
@@ -13,6 +13,7 @@ import (
 	"strings"
 
 	actions_model "forgejo.org/models/actions"
+	"forgejo.org/modules/optional"
 	"forgejo.org/modules/private"
 	"forgejo.org/modules/setting"
 	private_routers "forgejo.org/routers/private"
@@ -144,15 +145,15 @@ func validateSecret(secret string) error {
 	return nil
 }
 
-func getLabels(cli *cli.Command) (*[]string, error) {
+func getLabels(cli *cli.Command) (optional.Option[*[]string], error) {
 	if !cli.Bool("keep-labels") {
 		lblValue := strings.Split(cli.String("labels"), ",")
-		return &lblValue, nil
+		return optional.Some(&lblValue), nil
 	}
 	if cli.String("labels") != "" {
 		return nil, errors.New("--labels and --keep-labels should not be used together")
 	}
-	return nil, nil
+	return optional.None[*[]string](), nil
 }
 
 func RunRegister(ctx context.Context, cli *cli.Command) error {
@@ -205,7 +206,12 @@ func RunRegister(ctx context.Context, cli *cli.Command) error {
 		return err
 	}
 
-	runner, err := actions_model.RegisterRunner(ctx, owner, repo, secret, labels, name, version, ephemeral)
+	var runnerLabels *[]string
+	if labels.Has() {
+		_, runnerLabels = labels.Get()
+	}
+
+	runner, err := actions_model.RegisterRunner(ctx, owner, repo, secret, runnerLabels, name, version, ephemeral)
 	if err != nil {
 		return fmt.Errorf("error while registering runner: %v", err)
 	}
diff --git a/cmd/forgejo/actions_test.go b/cmd/forgejo/actions_test.go
index 11315239f7..021b6c89ea 100644
--- a/cmd/forgejo/actions_test.go
+++ b/cmd/forgejo/actions_test.go
@@ -8,6 +8,8 @@ import (
 	"fmt"
 	"testing"
 
+	"forgejo.org/modules/optional"
+
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/urfave/cli/v3"
@@ -21,7 +23,7 @@ func TestActions_getLabels(t *testing.T) {
 		labels    []string
 	}
 	type resultType struct {
-		labels *[]string
+		labels optional.Option[*[]string]
 		err    error
 	}
 
@@ -71,11 +73,12 @@ func TestActions_getLabels(t *testing.T) {
 
 			// Test the results
 			require.NotNil(t, result)
+			has, labels := result.labels.Get()
 			if c.hasLabels {
-				assert.NotNil(t, result.labels)
-				assert.Equal(t, c.labels, *result.labels)
+				assert.True(t, has)
+				assert.Equal(t, c.labels, *labels)
 			} else {
-				assert.Nil(t, result.labels)
+				assert.False(t, has)
 			}
 			if c.hasError {
 				require.Error(t, result.err)