diff --git a/.clang-tidy.yml b/.clang-tidy.yml
index c82a8f29ba..83052420de 100644
--- a/.clang-tidy.yml
+++ b/.clang-tidy.yml
@@ -6,6 +6,7 @@
 
 # https://clang.llvm.org/extra/clang-tidy/checks/list.html
 Checks:
+  - clang-analyzer-*
   - -clang-analyzer-optin.performance.Padding
   - -clang-analyzer-security.ArrayBound  # due to false positives with clang-tidy v21.1.0
   - -clang-analyzer-security.insecureAPI.bzero  # for FD_ZERO() (seen on macOS)
diff --git a/lib/http.c b/lib/http.c
index 61d426d9f5..e9ef131f8e 100644
--- a/lib/http.c
+++ b/lib/http.c
@@ -3185,7 +3185,7 @@ static statusline checkprotoprefix(struct Curl_easy *data,
   (((hdlen) >= (sizeof(n) - 1)) && curl_strnequal(n, hd, sizeof(n) - 1))
 
 #define HD_VAL(hd, hdlen, n) \
-  ((((hdlen) >= (sizeof(n) - 1)) && \
+  ((((hdlen) >= (sizeof(n) - 1)) && (hd) && \
     curl_strnequal(n, hd, sizeof(n) - 1)) ? ((hd) + (sizeof(n) - 1)) : NULL)
 
 /* HTTP header has field name `n` (a string constant) and contains `v`