diff --git a/Cargo.lock b/Cargo.lock
index a672a73..111aed9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3663,8 +3663,8 @@ dependencies = [
  "tracing",
  "tracing-opentelemetry",
  "tracing-subscriber",
+ "ulid",
  "url",
- "uuid",
  "zip",
 ]
 
@@ -4394,6 +4394,16 @@ version = "1.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de"
 
+[[package]]
+name = "ulid"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "470dbf6591da1b39d43c14523b2b469c86879a53e8b758c8e090a470fe7b1fbe"
+dependencies = [
+ "rand 0.9.4",
+ "web-time",
+]
+
 [[package]]
 name = "unarray"
 version = "0.1.4"
diff --git a/crates/py/src/types.rs b/crates/py/src/types.rs
index 774473a..4d60899 100644
--- a/crates/py/src/types.rs
+++ b/crates/py/src/types.rs
@@ -4,7 +4,7 @@
 //! contract used by the HTTP server.
 
 use pyo3::prelude::*;
-use pyo3::types::{PyDict, PyString, PyStringMethods as _};
+use pyo3::types::{PyDict, PyString};
 use serde::de::DeserializeOwned;
 
 pub fn from_py<T: DeserializeOwned + Default>(opts: Option<&Bound<'_, PyDict>>) -> PyResult<T> {
diff --git a/crates/server/src/console_store.rs b/crates/server/src/console_store.rs
index 0ab2ef0..b9528cf 100644
--- a/crates/server/src/console_store.rs
+++ b/crates/server/src/console_store.rs
@@ -574,7 +574,7 @@ pub fn spawn_console_sampler(state: crate::state::AppState, started_at: Instant)
                 .unwrap_or(0.0);
 
             // ── Concurrency ────────────────────────────────────────────────
-            let concurrency_max = state.config.concurrency as u32;
+            let _concurrency_max = state.config.concurrency as u32;
             let concurrency_active = state.console.active_requests.load(Ordering::SeqCst);
 
             // ── Push sample + broadcast ────────────────────────────────────
diff --git a/crates/server/src/error.rs b/crates/server/src/error.rs
index 2c63581..5bf046d 100644
--- a/crates/server/src/error.rs
+++ b/crates/server/src/error.rs
@@ -16,7 +16,6 @@ use axum::response::{IntoResponse, Response};
 use engine::EngineError;
 use serde::Serialize;
 use serde_json::{Value, json};
-use std::time::Duration;
 
 /// Convenient `Result` alias for handlers and helpers.
 pub type ApiResult<T> = Result<T, ApiError>;
diff --git a/crates/server/src/multipart.rs b/crates/server/src/multipart.rs
index 2719ba0..6002692 100644
--- a/crates/server/src/multipart.rs
+++ b/crates/server/src/multipart.rs
@@ -94,7 +94,7 @@ impl FormFields {
     /// Files are streamed out to disk to keep memory usage bounded; the
     /// scratch directory is auto-deleted when [`FormFields`] (and hence
     /// [`Self::tmp`]) is dropped.
-    pub async fn from_multipart(mut mp: Multipart) -> Result<Self, ApiError> {
+    pub async fn from_multipart(mp: Multipart) -> Result<Self, ApiError> {
         Self::from_multipart_with_config(mp, MultipartSecurityConfig::default()).await
     }
 
diff --git a/crates/server/src/routes/console.rs b/crates/server/src/routes/console.rs
index a913c55..62b1aba 100644
--- a/crates/server/src/routes/console.rs
+++ b/crates/server/src/routes/console.rs
@@ -15,7 +15,7 @@ pub async fn console_stream(
     State(state): State<AppState>,
 ) -> Sse<impl Stream<Item = Result<Event, Infallible>>> {
     let started_at = state.started_at;
-    let mut rx = state.console.broadcast.subscribe();
+    let rx = state.console.broadcast.subscribe();
 
     // Send initial snapshot immediately on connect (no waiting for next 5s tick).
     // For the initial snapshot we read the health gauges as a best-effort proxy;
diff --git a/crates/server/src/routes/debug.rs b/crates/server/src/routes/debug.rs
index 39324a8..6328c89 100644
--- a/crates/server/src/routes/debug.rs
+++ b/crates/server/src/routes/debug.rs
@@ -11,7 +11,7 @@ use axum::response::IntoResponse;
 use axum::Json;
 use regex::Regex;
 use serde::Serialize;
-use tracing::{info, warn};
+use tracing::info;
 
 use crate::error::{ApiError, ApiResult};
 use crate::multipart::FormFields;
diff --git a/crates/server/src/routes/estimate.rs b/crates/server/src/routes/estimate.rs
index d911622..9b6a092 100644
--- a/crates/server/src/routes/estimate.rs
+++ b/crates/server/src/routes/estimate.rs
@@ -138,7 +138,7 @@ pub async fn estimate(
     let analysis = analyze_html(&html).await;
 
     // Build size breakdown
-    let mut breakdown = SizeBreakdown {
+    let breakdown = SizeBreakdown {
         markup_mb: analysis.markup_size_mb,
         fonts_mb: analysis.font_size_mb,
         images_mb: analysis.image_size_mb,
diff --git a/crates/server/src/routes/pdfengines.rs b/crates/server/src/routes/pdfengines.rs
index fa363e7..48b1fc4 100644
--- a/crates/server/src/routes/pdfengines.rs
+++ b/crates/server/src/routes/pdfengines.rs
@@ -881,7 +881,7 @@ pub async fn pdfengines_convert(
 /// Reads bookmarks from a PDF and returns them as JSON.
 pub async fn pdfengines_bookmarks_read(
     State(state): State<AppState>,
-    headers: HeaderMap,
+    _headers: HeaderMap,
     mp: Multipart,
 ) -> ApiResult<Response> {
     let _permit = acquire_permit(&state).await?;
diff --git a/crates/server/src/security/url_validator.rs b/crates/server/src/security/url_validator.rs
index 6973240..913eb83 100644
--- a/crates/server/src/security/url_validator.rs
+++ b/crates/server/src/security/url_validator.rs
@@ -3,7 +3,7 @@
 //! Blocks access to internal networks, localhost, and other potentially
 //! dangerous destinations to prevent attacks via the `url_to_pdf` endpoint.
 
-use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
+use std::net::IpAddr;
 
 use crate::error::ApiError;