diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 1becf7b..daf5ace 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -45,3 +45,9 @@ jobs:
         uname -a
         make test
 
+  codespell:
+    runs-on: ubuntu-24.04
+    steps:
+    - uses: actions/checkout@v4
+    - run: pip install --break-system-packages codespell==v2.3.0
+    - run: codespell
diff --git a/capability/.codespellrc b/capability/.codespellrc
deleted file mode 100644
index e874be5..0000000
--- a/capability/.codespellrc
+++ /dev/null
@@ -1,3 +0,0 @@
-[codespell]
-skip = ./.git
-ignore-words-list = nd
diff --git a/capability/enum.go b/capability/enum.go
index f89f027..f885933 100644
--- a/capability/enum.go
+++ b/capability/enum.go
@@ -316,7 +316,7 @@ func ListKnown() []Cap {
 	return list()
 }
 
-// ListSupported retuns the list of all capabilities known to the package,
+// ListSupported returns the list of all capabilities known to the package,
 // except those that are not supported by the currently running Linux kernel.
 func ListSupported() ([]Cap, error) {
 	last, err := LastCap()
diff --git a/signal/signal.go b/signal/signal.go
index 3fbf1aa..74b74d3 100644
--- a/signal/signal.go
+++ b/signal/signal.go
@@ -12,14 +12,12 @@ import (
 )
 
 // CatchAll catches all signals and relays them to the specified channel.
-// SIGURG is not handled, as it's used by the Go runtime to support
-// preemptable system calls.
+// SIGURG is ignored, as it is used by the Go runtime for internal purposes
+// (see https://github.com/golang/go/issues/24543).
 func CatchAll(sigc chan os.Signal) {
 	var handledSigs []os.Signal
 	for n, s := range SignalMap {
 		if n == "URG" {
-			// Do not handle SIGURG, as in go1.14+, the go runtime issues
-			// SIGURG as an interrupt to support preemptable system calls on Linux.
 			continue
 		}
 		handledSigs = append(handledSigs, s)
diff --git a/symlink/fs.go b/symlink/fs.go
index 6b82661..ba29ac5 100644
--- a/symlink/fs.go
+++ b/symlink/fs.go
@@ -110,15 +110,15 @@ func evalSymlinksInScope(path, root string) (string, error) {
 		// into "/b/../c" which then gets filepath.Cleaned into "/c" and then
 		// root gets prepended and we Clean again (to remove any trailing slash
 		// if the first Clean gave us just "/")
-		cleanP := filepath.Clean(string(filepath.Separator) + b.String() + p)
-		if isDriveOrRoot(cleanP) {
+		pClean := filepath.Clean(string(filepath.Separator) + b.String() + p)
+		if isDriveOrRoot(pClean) {
 			// never Lstat "/" itself, or drive letters on Windows
 			b.Reset()
 			continue
 		}
-		fullP := filepath.Clean(root + cleanP)
+		pFull := filepath.Clean(root + pClean)
 
-		fi, err := os.Lstat(fullP)
+		fi, err := os.Lstat(pFull)
 		if os.IsNotExist(err) {
 			// if p does not exist, accept it
 			b.WriteString(p)
@@ -135,7 +135,7 @@ func evalSymlinksInScope(path, root string) (string, error) {
 		}
 
 		// it's a symlink, put it at the front of path
-		dest, err := os.Readlink(fullP)
+		dest, err := os.Readlink(pFull)
 		if err != nil {
 			return "", err
 		}