diff --git a/src/security/certstore.cpp b/src/security/certstore.cpp
index cea117a..b78d63f 100644
--- a/src/security/certstore.cpp
+++ b/src/security/certstore.cpp
@@ -51,7 +51,7 @@
 unsigned
 CertificateStore::loadLocalCertificates()
 {
-    std::lock_guard<std::mutex> l(lock_);
+    std::lock_guard l(lock_);
     if (logger_)
         logger_->debug("CertificateStore: loading certificates from {}", certPath_);
 
@@ -134,7 +134,7 @@
 std::vector<std::string>
 CertificateStore::getPinnedCertificates() const
 {
-    std::lock_guard<std::mutex> l(lock_);
+    std::lock_guard l(lock_);
 
     std::vector<std::string> certIds;
     certIds.reserve(certs_.size());
@@ -150,7 +150,7 @@
         auto cit = certs_.find(k);
         return cit != certs_.cend() ? cit->second : std::shared_ptr<crypto::Certificate>{};
     };
-    std::unique_lock<std::mutex> l(lock_);
+    std::unique_lock l(lock_);
     auto crt = getCertificate_(k);
     // Check if certificate is complete
     // If the certificate has been splitted, reconstruct it
@@ -191,7 +191,7 @@
 std::shared_ptr<crypto::Certificate>
 CertificateStore::findCertificateByName(const std::string& name, crypto::NameType type) const
 {
-    std::unique_lock<std::mutex> l(lock_);
+    std::unique_lock l(lock_);
     for (auto& i : certs_) {
         if (i.second->getName() == name)
             return i.second;
@@ -207,7 +207,7 @@
 std::shared_ptr<crypto::Certificate>
 CertificateStore::findCertificateByUID(const std::string& uid) const
 {
-    std::unique_lock<std::mutex> l(lock_);
+    std::unique_lock l(lock_);
     for (auto& i : certs_) {
         if (i.second->getUID() == uid)
             return i.second;
@@ -284,7 +284,7 @@
         ids.reserve(certs.size());
         scerts.reserve(certs.size());
         {
-            std::lock_guard<std::mutex> l(lock_);
+            std::lock_guard l(lock_);
 
             for (auto& cert : certs) {
                 try {
@@ -311,7 +311,7 @@
 unsigned
 CertificateStore::unpinCertificatePath(const std::string& path)
 {
-    std::lock_guard<std::mutex> l(lock_);
+    std::lock_guard l(lock_);
 
     auto certs = paths_.find(path);
     if (certs == std::end(paths_))
@@ -350,7 +350,7 @@
     std::vector<std::string> ids {};
     {
         auto c = cert;
-        std::lock_guard<std::mutex> l(lock_);
+        std::lock_guard l(lock_);
         while (c) {
             bool inserted;
             auto id = c->getId().toString();
@@ -384,7 +384,7 @@
 bool
 CertificateStore::unpinCertificate(const std::string& id)
 {
-    std::lock_guard<std::mutex> l(lock_);
+    std::lock_guard l(lock_);
 
     certs_.erase(id);
     return remove(certPath_ / id);
@@ -475,7 +475,7 @@
                                serialhex = std::move(serialhex),
                                ocspResponse = cert.ocspResponse] {
         if (l) l->d("Saving OCSP Response of device %s with serial %s", id.c_str(), serialhex.c_str());
-        std::lock_guard<std::mutex> lock(fileutils::getFileLock(path));
+        std::lock_guard lock(fileutils::getFileLock(path));
         fileutils::check_dir(dir.c_str());
         fileutils::saveFile(path, ocspResponse->pack());
     });
@@ -555,7 +555,7 @@
 {
     if (cert)
         certStore_.pinCertificate(cert, local);
-    std::lock_guard<std::recursive_mutex> lk(mutex_);
+    std::lock_guard lk(mutex_);
     updateKnownCerts();
     bool dirty {false};
     if (status == PermissionStatus::UNDEFINED) {
@@ -598,7 +598,7 @@
 TrustStore::PermissionStatus
 TrustStore::getCertificateStatus(const std::string& cert_id) const
 {
-    std::lock_guard<std::recursive_mutex> lk(mutex_);
+    std::lock_guard lk(mutex_);
     auto cert = certStore_.getCertificate(cert_id);
     if (!cert)
         return PermissionStatus::UNDEFINED;
@@ -637,7 +637,7 @@
 std::vector<std::string>
 TrustStore::getCertificatesByStatus(TrustStore::PermissionStatus status) const
 {
-    std::lock_guard<std::recursive_mutex> lk(mutex_);
+    std::lock_guard lk(mutex_);
     std::vector<std::string> ret;
     for (const auto& i : certStatus_)
         if (i.second.second.allowed == (status == TrustStore::PermissionStatus::ALLOWED))
@@ -652,7 +652,7 @@
 TrustStore::isAllowed(const crypto::Certificate& crt, bool allowPublic)
 {
     // Match by certificate pinning
-    std::lock_guard<std::recursive_mutex> lk(mutex_);
+    std::lock_guard lk(mutex_);
     bool allowed {allowPublic};
     for (auto c = &crt; c; c = c->issuer.get()) {
         auto status = getCertificateStatus(c->getId().toString()); // lock mutex_
diff --git a/src/security/diffie-hellman.cpp b/src/security/diffie-hellman.cpp
index 216e233..9c69f8b 100644
--- a/src/security/diffie-hellman.cpp
+++ b/src/security/diffie-hellman.cpp
@@ -106,7 +106,7 @@
 DhParams
 DhParams::loadDhParams(const std::filesystem::path& path)
 {
-    std::lock_guard<std::mutex> l(fileutils::getFileLock(path));
+    std::lock_guard l(fileutils::getFileLock(path));
     try {
         // writeTime throw exception if file doesn't exist
         auto writeTime = std::filesystem::last_write_time(path);
diff --git a/src/security/threadloop.h b/src/security/threadloop.h
index 7e18e1b..67b43ff 100644
--- a/src/security/threadloop.h
+++ b/src/security/threadloop.h
@@ -97,7 +97,7 @@
         if (std::this_thread::get_id() != get_id())
             throw std::runtime_error("can not call wait_for outside thread context");
 
-        std::unique_lock<std::mutex> lk(mutex_);
+        std::unique_lock lk(mutex_);
         cv_.wait_for(lk, rel_time, [this]() { return isStopping(); });
     }
 
@@ -107,7 +107,7 @@
         if (std::this_thread::get_id() != get_id())
             throw std::runtime_error("can not call wait_for outside thread context");
 
-        std::unique_lock<std::mutex> lk(mutex_);
+        std::unique_lock lk(mutex_);
         return cv_.wait_for(lk, rel_time, [this, pred] { return isStopping() || pred(); });
     }
 
@@ -117,7 +117,7 @@
         if (std::this_thread::get_id() != get_id())
             throw std::runtime_error("Can not call wait outside thread context");
 
-        std::unique_lock<std::mutex> lk(mutex_);
+        std::unique_lock lk(mutex_);
         cv_.wait(lk, [this, p = std::forward<Pred>(pred)] { return isStopping() || p(); });
     }
 
diff --git a/src/security/tls_session.cpp b/src/security/tls_session.cpp
index 1d7b24d..8d3539a 100644
--- a/src/security/tls_session.cpp
+++ b/src/security/tls_session.cpp
@@ -339,7 +339,7 @@
 {
     if (not transport_->isReliable()) {
         transport_->setOnRecv([this](const ValueType* buf, size_t len) {
-            std::lock_guard<std::mutex> lk {rxMutex_};
+            std::lock_guard lk {rxMutex_};
             if (rxQueue_.size() == INPUT_MAX_SIZE) {
                 rxQueue_.pop_front(); // drop oldest packet if input buffer is full
                 ++stRxRawPacketDropCnt_;
@@ -362,7 +362,7 @@
     stateCondition_.notify_all();
     rxCv_.notify_all();
     {
-        std::lock_guard<std::mutex> lock(requestsMtx_);
+        std::lock_guard lock(requestsMtx_);
         // requests_ store a shared_ptr, so we need to cancel requests
         // to not be stuck in verifyCertificateWrapper
         for (auto& request : requests_)
@@ -816,12 +816,12 @@
         if (cb)
             cb(response);
         if (auto request = response.request.lock()) {
-            std::lock_guard<std::mutex> lock(requestsMtx_);
+            std::lock_guard lock(requestsMtx_);
             requests_.erase(request);
         }
     });
     {
-        std::lock_guard<std::mutex> lock(requestsMtx_);
+        std::lock_guard lock(requestsMtx_);
         requests_.emplace(request);
     }
     request->send();
@@ -851,7 +851,7 @@
 std::size_t
 TlsSession::TlsSessionImpl::send(const ValueType* tx_data, std::size_t tx_size, std::error_code& ec)
 {
-    std::lock_guard<std::mutex> lk(sessionWriteMutex_);
+    std::lock_guard lk(sessionWriteMutex_);
     if (state_ != TlsSessionState::ESTABLISHED) {
         ec = std::error_code(GNUTLS_E_INVALID_SESSION, std::system_category());
         return 0;
@@ -959,7 +959,7 @@
         return -1;
     }
 
-    std::lock_guard<std::mutex> lk {rxMutex_};
+    std::lock_guard lk {rxMutex_};
     if (rxQueue_.empty()) {
         gnutls_transport_set_errno(session_, EAGAIN);
         return -1;
@@ -997,7 +997,7 @@
     }
 
     // non-reliable uses callback installed with setOnRecv()
-    std::unique_lock<std::mutex> lk {rxMutex_};
+    std::unique_lock lk {rxMutex_};
     rxCv_.wait_for(lk, timeout, [this] {
         return !rxQueue_.empty() or state_ == TlsSessionState::SHUTDOWN;
     });
@@ -1065,8 +1065,8 @@
     stateCondition_.notify_all();
 
     {
-        std::lock_guard<std::mutex> lk1(sessionReadMutex_);
-        std::lock_guard<std::mutex> lk2(sessionWriteMutex_);
+        std::lock_guard lk1(sessionReadMutex_);
+        std::lock_guard lk2(sessionWriteMutex_);
         if (session_) {
             if (transport_->isReliable())
                 gnutls_bye(session_, GNUTLS_SHUT_RDWR);
@@ -1119,7 +1119,7 @@
     std::size_t count;
     {
         // block until rx packet or shutdown
-        std::unique_lock<std::mutex> lk {rxMutex_};
+        std::unique_lock lk {rxMutex_};
         if (!rxCv_.wait_for(lk, COOKIE_TIMEOUT, [this] {
                 return !rxQueue_.empty() or state_ == TlsSessionState::SHUTDOWN;
             })) {
@@ -1140,7 +1140,7 @@
 
     // Peek and verify front packet
     {
-        std::lock_guard<std::mutex> lk {rxMutex_};
+        std::lock_guard lk {rxMutex_};
         auto& pkt = rxQueue_.front();
         std::memset(&prestate_, 0, sizeof(prestate_));
         ret = gnutls_dtls_cookie_verify(&cookie_key_, nullptr, 0, pkt.data(), pkt.size(), &prestate_);
@@ -1159,7 +1159,7 @@
 
         // Drop front packet
         {
-            std::lock_guard<std::mutex> lk {rxMutex_};
+            std::lock_guard lk {rxMutex_};
             rxQueue_.pop_front();
         }
 
@@ -1421,7 +1421,7 @@
             params_.logger->warn("[TLS] OOO pkt: 0x{:x}", pkt_seq);
     }
 
-    std::unique_lock<std::mutex> lk {rxMutex_};
+    std::unique_lock lk {rxMutex_};
     auto now = clock::now();
     if (reorderBuffer_.empty())
         lastReadTime_ = now;
@@ -1509,7 +1509,7 @@
             return state_.load() != TlsSessionState::ESTABLISHED
                    or newState_.load() != TlsSessionState::NONE;
         };
-        std::unique_lock<std::mutex> lk(stateMutex_);
+        std::unique_lock lk(stateMutex_);
         stateCondition_.wait(lk, disconnected);
         auto oldState = state_.load();
         if (oldState == TlsSessionState::ESTABLISHED) {
@@ -1524,7 +1524,7 @@
 
     // block until rx packet or state change
     {
-        std::unique_lock<std::mutex> lk {rxMutex_};
+        std::unique_lock lk {rxMutex_};
         if (nextFlush_.empty())
             rxCv_.wait(lk, [this] {
                 return state_ != TlsSessionState::ESTABLISHED or not rxQueue_.empty()
@@ -1693,7 +1693,7 @@
     while (true) {
         ssize_t ret;
         {
-            std::lock_guard<std::mutex> lk(pimpl_->sessionReadMutex_);
+            std::lock_guard lk(pimpl_->sessionReadMutex_);
             if (!pimpl_->session_)
                 return 0;
             ret = gnutls_record_recv(pimpl_->session_, data, size);
@@ -1703,7 +1703,7 @@
             return ret;
         }
 
-        std::lock_guard<std::mutex> lk(pimpl_->stateMutex_);
+        std::lock_guard lk(pimpl_->stateMutex_);
         if (ret == 0) {
             if (pimpl_) {
                 if (pimpl_->params_.logger)