diff --git a/src/postgres_aws.cpp b/src/postgres_aws.cpp
index 160f31a4d..cb2de72eb 100644
--- a/src/postgres_aws.cpp
+++ b/src/postgres_aws.cpp
@@ -117,7 +117,7 @@ PostgresAwsRdsTokenConfig PostgresAws::ExtractTokenConfigFromSecret(optional_ptr
 	}
 
 	// Build the base connection string (without password)
-	for (const string opt_name : PostgresSecrets::ConnectionOptionNames()) {
+	for (const string &opt_name : PostgresSecrets::ConnectionOptionNames()) {
 		if (opt_name == "password" || opt_name == "passfile") {
 			continue;
 		}
diff --git a/src/postgres_scanner.cpp b/src/postgres_scanner.cpp
index 5348809bc..c0ea75e18 100644
--- a/src/postgres_scanner.cpp
+++ b/src/postgres_scanner.cpp
@@ -579,7 +579,7 @@ static BindInfo PostgresGetBindInfo(const optional_ptr<FunctionData> bind_data_p
 	auto &bind_data = bind_data_p->Cast<PostgresBindData>();
 	auto table = bind_data.GetTable();
 	BindInfo info(ScanType::EXTERNAL);
-	info.table = bind_data.GetTable().get();
+	info.table = table.get();
 	return info;
 }
 
diff --git a/src/storage/postgres_catalog.cpp b/src/storage/postgres_catalog.cpp
index bd98577cb..2ab239d9f 100644
--- a/src/storage/postgres_catalog.cpp
+++ b/src/storage/postgres_catalog.cpp
@@ -32,8 +32,8 @@ PostgresCatalog::PostgresCatalog(ClientContext &ctx, AttachedDatabase &db_p, str
                                  AccessMode access_mode, string schema_to_load, PostgresIsolationLevel isolation_level,
                                  const string &secret_name, SecretStorageTable secret_storage_table_p)
     : Catalog(db_p), attach_path(std::move(attach_path_p)), access_mode(access_mode), isolation_level(isolation_level),
-      secret_storage_table(std::move(secret_storage_table_p)), schemas(*this, schema_to_load),
-      connection_pool(make_shared_ptr<PostgresConnectionPool>(*this, ctx)), default_schema(schema_to_load) {
+      schemas(*this, schema_to_load), connection_pool(make_shared_ptr<PostgresConnectionPool>(*this, ctx)),
+      default_schema(schema_to_load), secret_storage_table(std::move(secret_storage_table_p)) {
 	auto secret_entry = GetSecretEntry(ctx, secret_name);
 	this->rds_token_config = PostgresAws::ExtractTokenConfigFromSecret(secret_entry);
 	if (!rds_token_config.Enabled()) {
@@ -78,7 +78,7 @@ string PostgresCatalog::CreateConnectionString(optional_ptr<SecretEntry> secret_
 		Value uri_val = kv_secret.TryGetValue("uri");
 		if (!uri_val.IsNull()) {
 			// no other options can be specified along with the URI
-			for (const string opt_name : PostgresSecrets::ConnectionOptionNames()) {
+			for (const string &opt_name : PostgresSecrets::ConnectionOptionNames()) {
 				if (!kv_secret.TryGetValue(opt_name).IsNull()) {
 					throw BinderException("Options with name \"%s\" cannot be specified when 'URI' option is specified",
 					                      opt_name);
@@ -93,7 +93,7 @@ string PostgresCatalog::CreateConnectionString(optional_ptr<SecretEntry> secret_
 		}
 
 		string new_connection_info;
-		for (const string opt_name : PostgresSecrets::ConnectionOptionNames()) {
+		for (const string &opt_name : PostgresSecrets::ConnectionOptionNames()) {
 			new_connection_info += PostgresUtils::ExtractConnectionOption(kv_secret, opt_name);
 		}
 		connection_string = new_connection_info + connection_string;