diff --git a/src/libnm-core-impl/nm-setting-wireguard.c b/src/libnm-core-impl/nm-setting-wireguard.c
index f7157dc409..f78d637c93 100644
--- a/src/libnm-core-impl/nm-setting-wireguard.c
+++ b/src/libnm-core-impl/nm-setting-wireguard.c
@@ -1866,7 +1866,9 @@ clear_secrets(const NMSettInfoSetting *        sett_info,
                 if (j++ < 5) {
                     /* we use alloca() inside a loop here, but it is guarded to happen at most
                      * a few times. */
-                    name = peers_psk_get_secret_name_a(peer->public_key, &name_free);
+                    name = peers_psk_get_secret_name_a(/* lgtm [cpp/alloca-in-loop] */
+                                                       peer->public_key,
+                                                       &name_free);
                 } else {
                     name_free = peers_psk_get_secret_name_dup(peer->public_key);
                     name      = name_free;
diff --git a/src/libnmc-setting/nm-meta-setting-desc.c b/src/libnmc-setting/nm-meta-setting-desc.c
index 91177c36e1..3ac310bf88 100644
--- a/src/libnmc-setting/nm-meta-setting-desc.c
+++ b/src/libnmc-setting/nm-meta-setting-desc.c
@@ -123,7 +123,11 @@ _value_str_as_index_list(const char *value, gsize *out_len)
             if (!str_cloned) {
                 /* we use alloca() inside a loop here, but it is guarded to happen at most once. */
                 str_cloned = TRUE;
-                str        = nm_strndup_a(200, str, strlen(str), &str_clone_free);
+                str        = nm_strndup_a(/* lgtm [cpp/alloca-in-loop] */
+                                   200,
+                                   str,
+                                   strlen(str),
+                                   &str_clone_free);
             }
             s         = str;
             str[good] = '\0';