diff --git a/src/transport/middle_proxy/config_updater.rs b/src/transport/middle_proxy/config_updater.rs
index 9819e8d..ba90c1a 100644
--- a/src/transport/middle_proxy/config_updater.rs
+++ b/src/transport/middle_proxy/config_updater.rs
@@ -13,8 +13,8 @@ use crate::config::ProxyConfig;
 use crate::error::Result;
 use crate::transport::UpstreamManager;
 
-use super::http_fetch::https_get;
 use super::MePool;
+use super::http_fetch::https_get;
 use super::rotation::{MeReinitTrigger, enqueue_reinit_trigger};
 use super::secret::download_proxy_secret_with_max_len_via_upstream;
 use super::selftest::record_timeskew_sample;
@@ -97,6 +97,7 @@ pub async fn save_proxy_config_cache(path: &str, raw_text: &str) -> Result<()> {
     Ok(())
 }
 
+#[allow(dead_code)]
 pub async fn fetch_proxy_config_with_raw(url: &str) -> Result<(ProxyConfigData, String)> {
     fetch_proxy_config_with_raw_via_upstream(url, None).await
 }
@@ -264,6 +265,7 @@ fn parse_proxy_line(line: &str) -> Option<(i32, IpAddr, u16)> {
     Some((dc, ip, port))
 }
 
+#[allow(dead_code)]
 pub async fn fetch_proxy_config(url: &str) -> Result<ProxyConfigData> {
     fetch_proxy_config_via_upstream(url, None).await
 }
@@ -390,7 +392,11 @@ async fn run_update_cycle(
     }
 
     let mut ready_v6: Option<(ProxyConfigData, u64)> = None;
-    let cfg_v6 = retry_fetch("https://core.telegram.org/getProxyConfigV6", upstream.clone()).await;
+    let cfg_v6 = retry_fetch(
+        "https://core.telegram.org/getProxyConfigV6",
+        upstream.clone(),
+    )
+    .await;
     if let Some(cfg_v6) = cfg_v6
         && snapshot_passes_guards(cfg, &cfg_v6, "getProxyConfigV6")
     {
diff --git a/src/transport/middle_proxy/http_fetch.rs b/src/transport/middle_proxy/http_fetch.rs
index c1bb4f6..2f21934 100644
--- a/src/transport/middle_proxy/http_fetch.rs
+++ b/src/transport/middle_proxy/http_fetch.rs
@@ -34,8 +34,8 @@ fn build_tls_client_config() -> Arc<rustls::ClientConfig> {
 }
 
 fn extract_host_port_path(url: &str) -> Result<(String, u16, String)> {
-    let parsed = url::Url::parse(url)
-        .map_err(|e| ProxyError::Proxy(format!("invalid URL '{url}': {e}")))?;
+    let parsed =
+        url::Url::parse(url).map_err(|e| ProxyError::Proxy(format!("invalid URL '{url}': {e}")))?;
     if parsed.scheme() != "https" {
         return Err(ProxyError::Proxy(format!(
             "unsupported URL scheme '{}': only https is supported",
@@ -92,13 +92,9 @@ async fn connect_https_transport(
         let target = resolve_target_addr(host, port).await?;
         return timeout(HTTP_CONNECT_TIMEOUT, manager.connect(target, None, None))
             .await
-            .map_err(|_| {
-                ProxyError::Proxy(format!("upstream connect timeout for {host}:{port}"))
-            })?
+            .map_err(|_| ProxyError::Proxy(format!("upstream connect timeout for {host}:{port}")))?
             .map_err(|e| {
-                ProxyError::Proxy(format!(
-                    "upstream connect failed for {host}:{port}: {e}"
-                ))
+                ProxyError::Proxy(format!("upstream connect failed for {host}:{port}: {e}"))
             });
     }
 
diff --git a/src/transport/middle_proxy/mod.rs b/src/transport/middle_proxy/mod.rs
index 3a3642a..6dfbee6 100644
--- a/src/transport/middle_proxy/mod.rs
+++ b/src/transport/middle_proxy/mod.rs
@@ -4,7 +4,6 @@ mod codec;
 mod config_updater;
 mod handshake;
 mod health;
-mod http_fetch;
 #[cfg(test)]
 #[path = "tests/health_adversarial_tests.rs"]
 mod health_adversarial_tests;
@@ -14,6 +13,7 @@ mod health_integration_tests;
 #[cfg(test)]
 #[path = "tests/health_regression_tests.rs"]
 mod health_regression_tests;
+mod http_fetch;
 mod ping;
 mod pool;
 mod pool_config;
@@ -59,6 +59,7 @@ pub use pool::MePool;
 pub use pool_nat::{detect_public_ip, stun_probe};
 pub use registry::ConnRegistry;
 pub use rotation::{MeReinitTrigger, me_reinit_scheduler, me_rotation_task};
+#[allow(unused_imports)]
 pub use secret::{fetch_proxy_secret, fetch_proxy_secret_with_upstream};
 pub(crate) use selftest::{bnd_snapshot, timeskew_snapshot, upstream_bnd_snapshots};
 pub use wire::proto_flags_for_tag;
diff --git a/src/transport/middle_proxy/secret.rs b/src/transport/middle_proxy/secret.rs
index 450c80a..a167773 100644
--- a/src/transport/middle_proxy/secret.rs
+++ b/src/transport/middle_proxy/secret.rs
@@ -5,8 +5,8 @@ use tracing::{debug, info, warn};
 
 use super::http_fetch::https_get;
 use super::selftest::record_timeskew_sample;
-use crate::transport::UpstreamManager;
 use crate::error::{ProxyError, Result};
+use crate::transport::UpstreamManager;
 
 pub const PROXY_SECRET_MIN_LEN: usize = 32;
 
@@ -36,6 +36,7 @@ pub(super) fn validate_proxy_secret_len(data_len: usize, max_len: usize) -> Resu
 }
 
 /// Fetch Telegram proxy-secret binary.
+#[allow(dead_code)]
 pub async fn fetch_proxy_secret(cache_path: Option<&str>, max_len: usize) -> Result<Vec<u8>> {
     fetch_proxy_secret_with_upstream(cache_path, max_len, None).await
 }
@@ -88,6 +89,7 @@ pub async fn fetch_proxy_secret_with_upstream(
     }
 }
 
+#[allow(dead_code)]
 pub async fn download_proxy_secret_with_max_len(max_len: usize) -> Result<Vec<u8>> {
     download_proxy_secret_with_max_len_via_upstream(max_len, None).await
 }