diff --git a/Makefile b/Makefile
index 459c329ba..f3188609d 100644
--- a/Makefile
+++ b/Makefile
@@ -84,6 +84,10 @@ PYTHONPATH=$(shell pwd)/contrib/pyln-client:$(shell pwd)/contrib/pyln-testing:$(
 # Collect generated python files to be excluded from lint checks
 PYTHON_GENERATED=
 
+# Options to pass to cppcheck. Mostly used to exclude files that are
+# generated with external tools that we don't have control over
+CPPCHECK_OPTS=-q --language=c --std=c11 --error-exitcode=1 --suppressions-list=.cppcheck-suppress --inline-suppr
+
 # This is where we add new features as bitcoin adds them.
 FEATURES :=
 
@@ -471,10 +475,10 @@ check-includes: check-src-includes check-hdr-includes
 
 # cppcheck gets confused by list_for_each(head, i, list): thinks i is uninit.
 .cppcheck-suppress:
-	@git ls-files -- "*.c" "*.h" | grep -vE '^ccan/' | xargs grep -n '_for_each' | sed 's/\([^:]*:.*\):.*/uninitvar:\1/' > $@
+	@git ls-files -- "*.c" "*.h" | grep -vE '^(ccan|contrib)/' | xargs grep -n '_for_each' | sed 's/\([^:]*:.*\):.*/uninitvar:\1/' > $@
 
 check-cppcheck: .cppcheck-suppress
-	@trap 'rm -f .cppcheck-suppress' 0; git ls-files -- "*.c" "*.h" | grep -vE '^ccan/' | xargs cppcheck -q --language=c --std=c11 --error-exitcode=1 --suppressions-list=.cppcheck-suppress --inline-suppr
+	@trap 'rm -f .cppcheck-suppress' 0; git ls-files -- "*.c" "*.h" | grep -vE '^ccan/' | xargs cppcheck  ${CPPCHECK_OPTS}
 
 check-shellcheck:
 	@git ls-files -- "*.sh" | xargs shellcheck
diff --git a/contrib/libhsmd_python/Makefile b/contrib/libhsmd_python/Makefile
index 6a29008a9..af77f09cc 100644
--- a/contrib/libhsmd_python/Makefile
+++ b/contrib/libhsmd_python/Makefile
@@ -4,6 +4,7 @@ LIBHSMD_PY_GEN_FILES := contrib/libhsmd_python/swig_wrap.c \
 	contrib/libhsmd_python/libhsmd.py
 
 PYTHON_GENERATED += contrib/libhsmd_python/libhsmd.py
+CPPCHECK_OPTS += --suppress=nullPointer:contrib/libhsmd_python/swig_wrap.c
 
 # Swig by default generates stubs in the file's directory, which is
 # what we want.