diff --git a/src/core/auth.rs b/src/core/auth.rs
index 080f1a3cd..1fee4b837 100644
--- a/src/core/auth.rs
+++ b/src/core/auth.rs
@@ -32,6 +32,9 @@ use std::io::Write as _;
 use std::path::Path;
 use std::sync::OnceLock;
 
+#[cfg(unix)]
+use std::os::unix::fs::{OpenOptionsExt as _, PermissionsExt as _};
+
 use axum::http::{header, Method, StatusCode};
 use axum::middleware::Next;
 use axum::response::{IntoResponse, Response};
@@ -189,7 +192,6 @@ fn write_token_file(path: &Path, token: &str) -> anyhow::Result<()> {
 
     #[cfg(unix)]
     {
-        use std::os::unix::fs::OpenOptionsExt as _;
         let mut file = std::fs::OpenOptions::new()
             .write(true)
             .create(true)
@@ -238,7 +240,6 @@ mod tests {
     #[cfg(unix)]
     #[test]
     fn token_file_has_owner_only_permissions() {
-        use std::os::unix::fs::PermissionsExt as _;
         let tmp = std::env::temp_dir().join(format!("core-auth-perms-{}", std::process::id()));
         std::fs::create_dir_all(&tmp).unwrap();
         let path = tmp.join("core.token");
diff --git a/src/openhuman/service/common.rs b/src/openhuman/service/common.rs
index 88f3a7752..c4d5a1e7e 100644
--- a/src/openhuman/service/common.rs
+++ b/src/openhuman/service/common.rs
@@ -5,6 +5,9 @@ use std::fs;
 use std::path::PathBuf;
 use std::process::{Command, Stdio};
 
+#[cfg(windows)]
+use std::os::windows::process::CommandExt;
+
 pub(crate) const SERVICE_LABEL: &str = "com.openhuman.core";
 pub(crate) const LEGACY_SERVICE_LABEL: &str = "com.openhuman.daemon";
 pub(crate) const LEGACY_APP_LABEL: &str = "com.openhuman.app";
@@ -107,7 +110,6 @@ pub(crate) fn xml_escape(input: &str) -> String {
 /// console — visible to users (#1475 follow-up to #731 + #1338).
 #[cfg(windows)]
 fn no_window(cmd: &mut Command) {
-    use std::os::windows::process::CommandExt;
     cmd.creation_flags(0x0800_0000); // CREATE_NO_WINDOW
 }
 
diff --git a/src/openhuman/service/windows.rs b/src/openhuman/service/windows.rs
index 50974641d..d7e36bb45 100644
--- a/src/openhuman/service/windows.rs
+++ b/src/openhuman/service/windows.rs
@@ -3,6 +3,8 @@
 use crate::openhuman::config::Config;
 use anyhow::Result;
 use std::fs;
+// File is `#[cfg(windows)]`-gated at the module level — no per-item guard needed.
+use std::os::windows::process::CommandExt;
 use std::path::PathBuf;
 use std::process::Command;
 
@@ -131,7 +133,6 @@ pub(crate) fn uninstall(config: &Config) -> Result<ServiceStatus> {
 }
 
 fn is_task_exists_windows(task_name: &str) -> Result<bool> {
-    use std::os::windows::process::CommandExt;
     let result = Command::new("schtasks")
         .args(["/Query", "/TN", task_name])
         .creation_flags(0x0800_0000) // CREATE_NO_WINDOW
diff --git a/src/openhuman/update/core.rs b/src/openhuman/update/core.rs
index 054f8e509..375983ecf 100644
--- a/src/openhuman/update/core.rs
+++ b/src/openhuman/update/core.rs
@@ -4,6 +4,9 @@
 use std::io::Write;
 use std::path::PathBuf;
 
+#[cfg(unix)]
+use std::os::unix::fs::PermissionsExt as _;
+
 use crate::openhuman::config::UpdateRestartStrategy;
 use crate::openhuman::update::types::{GitHubAsset, GitHubRelease, UpdateApplyResult, UpdateInfo};
 
@@ -265,7 +268,6 @@ pub async fn download_and_stage_with_version(
     // Set executable permission on Unix.
     #[cfg(unix)]
     {
-        use std::os::unix::fs::PermissionsExt;
         std::fs::set_permissions(&tmp_path, std::fs::Permissions::from_mode(0o755))
             .map_err(|e| format!("failed to set executable permission: {e}"))?;
     }