diff --git a/internal/plugin/installer/oci_installer.go b/internal/plugin/installer/oci_installer.go
index 383ddb914..f03e43c4d 100644
--- a/internal/plugin/installer/oci_installer.go
+++ b/internal/plugin/installer/oci_installer.go
@@ -242,9 +242,13 @@ func extractTar(r io.Reader, targetDir string) error {
 			if err != nil {
 				return err
 			}
-			defer outFile.Close()
-			if _, err := io.Copy(outFile, tarReader); err != nil {
-				return err
+			_, copyErr := io.Copy(outFile, tarReader)
+			closeErr := outFile.Close()
+			if copyErr != nil {
+				return copyErr
+			}
+			if closeErr != nil {
+				return closeErr
 			}
 		case tar.TypeXGlobalHeader, tar.TypeXHeader:
 			// Skip these
diff --git a/internal/plugin/sign.go b/internal/plugin/sign.go
index 6ddf113a2..dbe365d67 100644
--- a/internal/plugin/sign.go
+++ b/internal/plugin/sign.go
@@ -104,16 +104,13 @@ func parsePluginMessageBlock(data []byte) (*Metadata, *provenance.SumCollection,
 // CreatePluginTarball creates a gzipped tarball from a plugin directory
 func CreatePluginTarball(sourceDir, pluginName string, w io.Writer) error {
 	gzw := gzip.NewWriter(w)
-	defer gzw.Close()
-
 	tw := tar.NewWriter(gzw)
-	defer tw.Close()
 
 	// Use the plugin name as the base directory in the tarball
 	baseDir := pluginName
 
 	// Walk the directory tree
-	return filepath.Walk(sourceDir, func(path string, info os.FileInfo, err error) error {
+	err := filepath.Walk(sourceDir, func(path string, info os.FileInfo, err error) error {
 		if err != nil {
 			return err
 		}
@@ -153,4 +150,15 @@ func CreatePluginTarball(sourceDir, pluginName string, w io.Writer) error {
 
 		return nil
 	})
+	if err != nil {
+		return err
+	}
+
+	if err := tw.Close(); err != nil {
+		return fmt.Errorf("closing tar writer: %w", err)
+	}
+	if err := gzw.Close(); err != nil {
+		return fmt.Errorf("closing gzip writer: %w", err)
+	}
+	return nil
 }
diff --git a/pkg/action/install.go b/pkg/action/install.go
index 605c423bc..b56f7df8d 100644
--- a/pkg/action/install.go
+++ b/pkg/action/install.go
@@ -691,7 +691,10 @@ func (i *Install) recordRelease(r *release.Release) error {
 // This allows us to reuse names by superseding an existing release with a new one
 func (i *Install) replaceRelease(rel *release.Release) error {
 	hist, err := i.cfg.Releases.History(rel.Name)
-	if err != nil || len(hist) == 0 {
+	if err != nil {
+		return err
+	}
+	if len(hist) == 0 {
 		// No releases exist for this name, so we can return early
 		return nil
 	}