diff --git a/noxfile.py b/noxfile.py
index d86cc9752bc3..4c29c4db2dec 100644
--- a/noxfile.py
+++ b/noxfile.py
@@ -188,7 +188,9 @@ def rust(session: nox.Session) -> None:
 
     with session.chdir("src/rust/"):
         session.run("cargo", "fmt", "--all", "--", "--check", external=True)
-        session.run("cargo", "clippy", "--", "-D", "warnings", external=True)
+        session.run(
+            "cargo", "clippy", "--all", "--", "-D", "warnings", external=True
+        )
 
         build_output = session.run(
             "cargo",
diff --git a/src/rust/cryptography-x509-validation/src/types.rs b/src/rust/cryptography-x509-validation/src/types.rs
index cf850ef9b26a..20b42bc06f61 100644
--- a/src/rust/cryptography-x509-validation/src/types.rs
+++ b/src/rust/cryptography-x509-validation/src/types.rs
@@ -113,13 +113,14 @@ impl<'a> DNSPattern<'a> {
     }
 }
 
-#[derive(Copy, Clone, Debug, PartialEq)]
+#[derive(Copy, Clone, Debug, PartialEq, Eq)]
 pub struct IPAddress(IpAddr);
 
 /// An `IPAddress` represents an IP address as defined in [RFC 5280 4.2.1.6].
 ///
 /// [RFC 5280 4.2.1.6]: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.6
 impl IPAddress {
+    #[allow(clippy::should_implement_trait)]
     pub fn from_str(s: &str) -> Option<Self> {
         IpAddr::from_str(s).ok().map(Self::from)
     }
@@ -175,7 +176,7 @@ impl IPAddress {
     pub fn mask(&self, prefix: u8) -> Self {
         match self.0 {
             IpAddr::V4(a) => {
-                let prefix = 32u8.checked_sub(prefix).unwrap_or(0).into();
+                let prefix = 32u8.saturating_sub(prefix).into();
                 let masked = u32::from_be_bytes(a.octets())
                     & u32::MAX
                         .checked_shr(prefix)
@@ -185,7 +186,7 @@ impl IPAddress {
                 Self::from_bytes(&masked.to_be_bytes()).unwrap()
             }
             IpAddr::V6(a) => {
-                let prefix = 128u8.checked_sub(prefix).unwrap_or(0).into();
+                let prefix = 128u8.saturating_sub(prefix).into();
                 let masked = u128::from_be_bytes(a.octets())
                     & u128::MAX
                         .checked_shr(prefix)
@@ -204,7 +205,7 @@ impl From<IpAddr> for IPAddress {
     }
 }
 
-#[derive(Debug, PartialEq)]
+#[derive(Debug, PartialEq, Eq)]
 pub struct IPRange {
     address: IPAddress,
     prefix: u8,