diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f8099ed22e..4f92fe46f8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,16 +16,6 @@ jobs:
       matrix:
         goos: [windows, linux]
         root: ["", test] # cannot specify "./... ./test/..." unless in go workspace
-        include:
-          - goos: linux
-            root: ""
-            dirs: >-
-              ./cmd/gcs/...
-              ./cmd/gcstools/...
-              ./internal/guest...
-              ./internal/tools/...
-              ./pkg/...
-              ./ext4/...
 
     steps:
       - name: Checkout
@@ -40,15 +30,15 @@ jobs:
 
       - uses: golangci/golangci-lint-action@v3
         with:
-          version: v1.52
+          version: v1.54
           args: >-
             --verbose
             --max-issues-per-linter=0
             --max-same-issues=0
             --modules-download-mode=readonly
             --timeout=10m
-            ${{ matrix.dirs }}
-          working-directory: ${{ matrix.root }}
+            --config=${{ github.workspace }}/.golangci.yml
+          working-directory: ${{ github.workspace }}/${{ matrix.root }}
         env:
           GOOS: ${{ matrix.goos }}
 
diff --git a/cmd/containerd-shim-runhcs-v1/nopformatter.go b/cmd/containerd-shim-runhcs-v1/nopformatter.go
index 5e0e38c110..495d0ff226 100644
--- a/cmd/containerd-shim-runhcs-v1/nopformatter.go
+++ b/cmd/containerd-shim-runhcs-v1/nopformatter.go
@@ -4,7 +4,7 @@ import (
 	"github.com/sirupsen/logrus"
 )
 
-type nopFormatter struct{}
+type NopFormatter struct{}
 
 // Format does nothing and returns a nil slice.
-func (nopFormatter) Format(*logrus.Entry) ([]byte, error) { return nil, nil }
+func (NopFormatter) Format(*logrus.Entry) ([]byte, error) { return nil, nil }
diff --git a/cmd/containerd-shim-runhcs-v1/pod.go b/cmd/containerd-shim-runhcs-v1/pod.go
index 17146bbfd0..f531e25ee6 100644
--- a/cmd/containerd-shim-runhcs-v1/pod.go
+++ b/cmd/containerd-shim-runhcs-v1/pod.go
@@ -106,7 +106,7 @@ func createPod(ctx context.Context, events publisher, req *task.CreateTaskReques
 	}
 
 	var parent *uvm.UtilityVM
-	var lopts *uvm.OptionsLCOW //nolint:staticcheck
+	var lopts *uvm.OptionsLCOW
 	if oci.IsIsolated(s) {
 		// Create the UVM parent
 		opts, err := oci.SpecToUVMCreateOpts(ctx, s, fmt.Sprintf("%s@vm", req.ID), owner)
diff --git a/cmd/containerd-shim-runhcs-v1/serve.go b/cmd/containerd-shim-runhcs-v1/serve.go
index 0f18212fe4..4eee0d6475 100644
--- a/cmd/containerd-shim-runhcs-v1/serve.go
+++ b/cmd/containerd-shim-runhcs-v1/serve.go
@@ -154,7 +154,7 @@ var serveCommand = cli.Command{
 		case runhcsopts.Options_FILE:
 			panic("file log output mode is not supported")
 		case runhcsopts.Options_ETW:
-			logrus.SetFormatter(nopFormatter{})
+			logrus.SetFormatter(NopFormatter{})
 			logrus.SetOutput(io.Discard)
 		}
 
diff --git a/cmd/ncproxy/ncproxy_v0_service.go b/cmd/ncproxy/ncproxy_v0_service.go
index cd953ee625..55c33a0ab8 100644
--- a/cmd/ncproxy/ncproxy_v0_service.go
+++ b/cmd/ncproxy/ncproxy_v0_service.go
@@ -1,3 +1,5 @@
+//go:build windows
+
 package main
 
 import (
diff --git a/cmd/ncproxy/ncproxy_v0_service_test.go b/cmd/ncproxy/ncproxy_v0_service_test.go
index 136740e6eb..09f08489e4 100644
--- a/cmd/ncproxy/ncproxy_v0_service_test.go
+++ b/cmd/ncproxy/ncproxy_v0_service_test.go
@@ -1,3 +1,5 @@
+//go:build windows
+
 package main
 
 import (
diff --git a/cmd/ncproxy/utilities_test.go b/cmd/ncproxy/utilities_test.go
index e369ce2ae5..361f052992 100644
--- a/cmd/ncproxy/utilities_test.go
+++ b/cmd/ncproxy/utilities_test.go
@@ -1,3 +1,5 @@
+//go:build windows
+
 package main
 
 import (
diff --git a/internal/cmd/io_npipe.go b/internal/cmd/io_npipe.go
index 614f34ca29..9f9a7e1b48 100644
--- a/internal/cmd/io_npipe.go
+++ b/internal/cmd/io_npipe.go
@@ -6,7 +6,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"math/rand"
 	"net"
 	"sync"
 	"syscall"
@@ -20,11 +19,6 @@ import (
 	"golang.org/x/sys/windows"
 )
 
-func init() {
-	// Need to seed for the rng in backoff.NextBackoff()
-	rand.Seed(time.Now().UnixNano())
-}
-
 // NewNpipeIO creates connected upstream io. It is the callers responsibility to validate that `if terminal == true`, `stderr == ""`. retryTimeout
 // refers to the timeout used to try and reconnect to the server end of the named pipe if the connection is severed. A value of 0 for retryTimeout
 // is treated as an infinite timeout.
diff --git a/internal/gcs/iochannel.go b/internal/gcs/iochannel.go
index 5af6b81aaf..5733f49011 100644
--- a/internal/gcs/iochannel.go
+++ b/internal/gcs/iochannel.go
@@ -1,3 +1,5 @@
+//go:build windows
+
 package gcs
 
 import (
diff --git a/internal/oci/annotations.go b/internal/oci/annotations.go
index d2771a65b1..5d4a90ea36 100644
--- a/internal/oci/annotations.go
+++ b/internal/oci/annotations.go
@@ -78,9 +78,9 @@ func ParseAnnotationsBool(ctx context.Context, a map[string]string, key string,
 	return def
 }
 
-// parseAnnotationsUint32 searches `a` for `key` and if found verifies that the
+// ParseAnnotationsUint32 searches `a` for `key` and if found verifies that the
 // value is a 32 bit unsigned integer. If `key` is not found returns `def`.
-func parseAnnotationsUint32(ctx context.Context, a map[string]string, key string, def uint32) uint32 {
+func ParseAnnotationsUint32(ctx context.Context, a map[string]string, key string, def uint32) uint32 {
 	if v, ok := a[key]; ok {
 		countu, err := strconv.ParseUint(v, 10, 32)
 		if err == nil {
@@ -92,9 +92,9 @@ func parseAnnotationsUint32(ctx context.Context, a map[string]string, key string
 	return def
 }
 
-// parseAnnotationsUint64 searches `a` for `key` and if found verifies that the
+// ParseAnnotationsUint64 searches `a` for `key` and if found verifies that the
 // value is a 64 bit unsigned integer. If `key` is not found returns `def`.
-func parseAnnotationsUint64(ctx context.Context, a map[string]string, key string, def uint64) uint64 {
+func ParseAnnotationsUint64(ctx context.Context, a map[string]string, key string, def uint64) uint64 {
 	if v, ok := a[key]; ok {
 		countu, err := strconv.ParseUint(v, 10, 64)
 		if err == nil {
@@ -105,8 +105,8 @@ func parseAnnotationsUint64(ctx context.Context, a map[string]string, key string
 	return def
 }
 
-// parseAnnotationsString searches `a` for `key`. If `key` is not found returns `def`.
-func parseAnnotationsString(a map[string]string, key string, def string) string {
+// ParseAnnotationsString searches `a` for `key`. If `key` is not found returns `def`.
+func ParseAnnotationsString(a map[string]string, key string, def string) string {
 	if v, ok := a[key]; ok {
 		return v
 	}
diff --git a/internal/oci/uvm.go b/internal/oci/uvm.go
index 79a8893459..bd49a5ae6a 100644
--- a/internal/oci/uvm.go
+++ b/internal/oci/uvm.go
@@ -21,7 +21,7 @@ import (
 // not found searches `s` for the Windows CPU section. If neither are found
 // returns `def`.
 func ParseAnnotationsCPUCount(ctx context.Context, s *specs.Spec, annotation string, def int32) int32 {
-	if m := parseAnnotationsUint64(ctx, s.Annotations, annotation, 0); m != 0 {
+	if m := ParseAnnotationsUint64(ctx, s.Annotations, annotation, 0); m != 0 {
 		return int32(m)
 	}
 	if s.Windows != nil &&
@@ -38,7 +38,7 @@ func ParseAnnotationsCPUCount(ctx context.Context, s *specs.Spec, annotation str
 // not found searches `s` for the Windows CPU section. If neither are found
 // returns `def`.
 func ParseAnnotationsCPULimit(ctx context.Context, s *specs.Spec, annotation string, def int32) int32 {
-	if m := parseAnnotationsUint64(ctx, s.Annotations, annotation, 0); m != 0 {
+	if m := ParseAnnotationsUint64(ctx, s.Annotations, annotation, 0); m != 0 {
 		return int32(m)
 	}
 	if s.Windows != nil &&
@@ -55,7 +55,7 @@ func ParseAnnotationsCPULimit(ctx context.Context, s *specs.Spec, annotation str
 // not found searches `s` for the Windows CPU section. If neither are found
 // returns `def`.
 func ParseAnnotationsCPUWeight(ctx context.Context, s *specs.Spec, annotation string, def int32) int32 {
-	if m := parseAnnotationsUint64(ctx, s.Annotations, annotation, 0); m != 0 {
+	if m := ParseAnnotationsUint64(ctx, s.Annotations, annotation, 0); m != 0 {
 		return int32(m)
 	}
 	if s.Windows != nil &&
@@ -72,7 +72,7 @@ func ParseAnnotationsCPUWeight(ctx context.Context, s *specs.Spec, annotation st
 // annotation. If not found searches `s` for the Windows Storage section. If
 // neither are found returns `def`.
 func ParseAnnotationsStorageIops(ctx context.Context, s *specs.Spec, annotation string, def int32) int32 {
-	if m := parseAnnotationsUint64(ctx, s.Annotations, annotation, 0); m != 0 {
+	if m := ParseAnnotationsUint64(ctx, s.Annotations, annotation, 0); m != 0 {
 		return int32(m)
 	}
 	if s.Windows != nil &&
@@ -89,7 +89,7 @@ func ParseAnnotationsStorageIops(ctx context.Context, s *specs.Spec, annotation
 // If not found searches `s` for the Windows Storage section. If neither are
 // found returns `def`.
 func ParseAnnotationsStorageBps(ctx context.Context, s *specs.Spec, annotation string, def int32) int32 {
-	if m := parseAnnotationsUint64(ctx, s.Annotations, annotation, 0); m != 0 {
+	if m := ParseAnnotationsUint64(ctx, s.Annotations, annotation, 0); m != 0 {
 		return int32(m)
 	}
 	if s.Windows != nil &&
@@ -108,7 +108,7 @@ func ParseAnnotationsStorageBps(ctx context.Context, s *specs.Spec, annotation s
 //
 // Note: The returned value is in `MB`.
 func ParseAnnotationsMemory(ctx context.Context, s *specs.Spec, annotation string, def uint64) uint64 {
-	if m := parseAnnotationsUint64(ctx, s.Annotations, annotation, 0); m != 0 {
+	if m := ParseAnnotationsUint64(ctx, s.Annotations, annotation, 0); m != 0 {
 		return m
 	}
 	if s.Windows != nil &&
@@ -184,7 +184,7 @@ func handleAnnotationFullyPhysicallyBacked(ctx context.Context, a map[string]str
 // handleSecurityPolicy handles parsing SecurityPolicy and NoSecurityHardware and setting
 // implied options from the results. Both LCOW only, not WCOW
 func handleSecurityPolicy(ctx context.Context, a map[string]string, lopts *uvm.OptionsLCOW) {
-	lopts.SecurityPolicy = parseAnnotationsString(a, annotations.SecurityPolicy, lopts.SecurityPolicy)
+	lopts.SecurityPolicy = ParseAnnotationsString(a, annotations.SecurityPolicy, lopts.SecurityPolicy)
 	// allow actual isolated boot etc to be ignored if we have no hardware. Required for dev
 	// this is not a security issue as the attestation will fail without a genuine report
 	noSecurityHardware := ParseAnnotationsBool(ctx, a, annotations.NoSecurityHardware, false)
@@ -213,9 +213,9 @@ func handleSecurityPolicy(ctx context.Context, a map[string]string, lopts *uvm.O
 // sets options common to both WCOW and LCOW from annotations
 func specToUVMCreateOptionsCommon(ctx context.Context, opts *uvm.Options, s *specs.Spec) {
 	opts.MemorySizeInMB = ParseAnnotationsMemory(ctx, s, annotations.MemorySizeInMB, opts.MemorySizeInMB)
-	opts.LowMMIOGapInMB = parseAnnotationsUint64(ctx, s.Annotations, annotations.MemoryLowMMIOGapInMB, opts.LowMMIOGapInMB)
-	opts.HighMMIOBaseInMB = parseAnnotationsUint64(ctx, s.Annotations, annotations.MemoryHighMMIOBaseInMB, opts.HighMMIOBaseInMB)
-	opts.HighMMIOGapInMB = parseAnnotationsUint64(ctx, s.Annotations, annotations.MemoryHighMMIOGapInMB, opts.HighMMIOGapInMB)
+	opts.LowMMIOGapInMB = ParseAnnotationsUint64(ctx, s.Annotations, annotations.MemoryLowMMIOGapInMB, opts.LowMMIOGapInMB)
+	opts.HighMMIOBaseInMB = ParseAnnotationsUint64(ctx, s.Annotations, annotations.MemoryHighMMIOBaseInMB, opts.HighMMIOBaseInMB)
+	opts.HighMMIOGapInMB = ParseAnnotationsUint64(ctx, s.Annotations, annotations.MemoryHighMMIOGapInMB, opts.HighMMIOGapInMB)
 	opts.AllowOvercommit = ParseAnnotationsBool(ctx, s.Annotations, annotations.AllowOvercommit, opts.AllowOvercommit)
 	opts.EnableDeferredCommit = ParseAnnotationsBool(ctx, s.Annotations, annotations.EnableDeferredCommit, opts.EnableDeferredCommit)
 	opts.ProcessorCount = ParseAnnotationsCPUCount(ctx, s, annotations.ProcessorCount, opts.ProcessorCount)
@@ -223,11 +223,11 @@ func specToUVMCreateOptionsCommon(ctx context.Context, opts *uvm.Options, s *spe
 	opts.ProcessorWeight = ParseAnnotationsCPUWeight(ctx, s, annotations.ProcessorWeight, opts.ProcessorWeight)
 	opts.StorageQoSBandwidthMaximum = ParseAnnotationsStorageBps(ctx, s, annotations.StorageQoSBandwidthMaximum, opts.StorageQoSBandwidthMaximum)
 	opts.StorageQoSIopsMaximum = ParseAnnotationsStorageIops(ctx, s, annotations.StorageQoSIopsMaximum, opts.StorageQoSIopsMaximum)
-	opts.CPUGroupID = parseAnnotationsString(s.Annotations, annotations.CPUGroupID, opts.CPUGroupID)
-	opts.NetworkConfigProxy = parseAnnotationsString(s.Annotations, annotations.NetworkConfigProxy, opts.NetworkConfigProxy)
-	opts.ProcessDumpLocation = parseAnnotationsString(s.Annotations, annotations.ContainerProcessDumpLocation, opts.ProcessDumpLocation)
+	opts.CPUGroupID = ParseAnnotationsString(s.Annotations, annotations.CPUGroupID, opts.CPUGroupID)
+	opts.NetworkConfigProxy = ParseAnnotationsString(s.Annotations, annotations.NetworkConfigProxy, opts.NetworkConfigProxy)
+	opts.ProcessDumpLocation = ParseAnnotationsString(s.Annotations, annotations.ContainerProcessDumpLocation, opts.ProcessDumpLocation)
 	opts.NoWritableFileShares = ParseAnnotationsBool(ctx, s.Annotations, annotations.DisableWritableFileShares, opts.NoWritableFileShares)
-	opts.DumpDirectoryPath = parseAnnotationsString(s.Annotations, annotations.DumpDirectoryPath, opts.DumpDirectoryPath)
+	opts.DumpDirectoryPath = ParseAnnotationsString(s.Annotations, annotations.DumpDirectoryPath, opts.DumpDirectoryPath)
 }
 
 // SpecToUVMCreateOpts parses `s` and returns either `*uvm.OptionsLCOW` or
@@ -250,16 +250,16 @@ func SpecToUVMCreateOpts(ctx context.Context, s *specs.Spec, id, owner string) (
 		*/
 
 		lopts.EnableColdDiscardHint = ParseAnnotationsBool(ctx, s.Annotations, annotations.EnableColdDiscardHint, lopts.EnableColdDiscardHint)
-		lopts.VPMemDeviceCount = parseAnnotationsUint32(ctx, s.Annotations, annotations.VPMemCount, lopts.VPMemDeviceCount)
-		lopts.VPMemSizeBytes = parseAnnotationsUint64(ctx, s.Annotations, annotations.VPMemSize, lopts.VPMemSizeBytes)
+		lopts.VPMemDeviceCount = ParseAnnotationsUint32(ctx, s.Annotations, annotations.VPMemCount, lopts.VPMemDeviceCount)
+		lopts.VPMemSizeBytes = ParseAnnotationsUint64(ctx, s.Annotations, annotations.VPMemSize, lopts.VPMemSizeBytes)
 		lopts.VPMemNoMultiMapping = ParseAnnotationsBool(ctx, s.Annotations, annotations.VPMemNoMultiMapping, lopts.VPMemNoMultiMapping)
 		lopts.VPCIEnabled = ParseAnnotationsBool(ctx, s.Annotations, annotations.VPCIEnabled, lopts.VPCIEnabled)
-		lopts.BootFilesPath = parseAnnotationsString(s.Annotations, annotations.BootFilesRootPath, lopts.BootFilesPath)
+		lopts.BootFilesPath = ParseAnnotationsString(s.Annotations, annotations.BootFilesRootPath, lopts.BootFilesPath)
 		lopts.EnableScratchEncryption = ParseAnnotationsBool(ctx, s.Annotations, annotations.EncryptedScratchDisk, lopts.EnableScratchEncryption)
-		lopts.SecurityPolicy = parseAnnotationsString(s.Annotations, annotations.SecurityPolicy, lopts.SecurityPolicy)
-		lopts.SecurityPolicyEnforcer = parseAnnotationsString(s.Annotations, annotations.SecurityPolicyEnforcer, lopts.SecurityPolicyEnforcer)
-		lopts.UVMReferenceInfoFile = parseAnnotationsString(s.Annotations, annotations.UVMReferenceInfoFile, lopts.UVMReferenceInfoFile)
-		lopts.KernelBootOptions = parseAnnotationsString(s.Annotations, annotations.KernelBootOptions, lopts.KernelBootOptions)
+		lopts.SecurityPolicy = ParseAnnotationsString(s.Annotations, annotations.SecurityPolicy, lopts.SecurityPolicy)
+		lopts.SecurityPolicyEnforcer = ParseAnnotationsString(s.Annotations, annotations.SecurityPolicyEnforcer, lopts.SecurityPolicyEnforcer)
+		lopts.UVMReferenceInfoFile = ParseAnnotationsString(s.Annotations, annotations.UVMReferenceInfoFile, lopts.UVMReferenceInfoFile)
+		lopts.KernelBootOptions = ParseAnnotationsString(s.Annotations, annotations.KernelBootOptions, lopts.KernelBootOptions)
 		lopts.DisableTimeSyncService = ParseAnnotationsBool(ctx, s.Annotations, annotations.DisableLCOWTimeSyncService, lopts.DisableTimeSyncService)
 		handleAnnotationPreferredRootFSType(ctx, s.Annotations, lopts)
 		handleAnnotationKernelDirectBoot(ctx, s.Annotations, lopts)
@@ -273,7 +273,7 @@ func SpecToUVMCreateOpts(ctx context.Context, s *specs.Spec, id, owner string) (
 		handleSecurityPolicy(ctx, s.Annotations, lopts)
 
 		// override the default GuestState filename if specified
-		lopts.GuestStateFile = parseAnnotationsString(s.Annotations, annotations.GuestStateFile, lopts.GuestStateFile)
+		lopts.GuestStateFile = ParseAnnotationsString(s.Annotations, annotations.GuestStateFile, lopts.GuestStateFile)
 		return lopts, nil
 	} else if IsWCOW(s) {
 		wopts := uvm.NewDefaultOptionsWCOW(id, owner)
diff --git a/internal/uvm/constants.go b/internal/uvm/constants.go
index aebd58a391..5537cf13d7 100644
--- a/internal/uvm/constants.go
+++ b/internal/uvm/constants.go
@@ -1,3 +1,5 @@
+//go:build windows
+
 package uvm
 
 import (
diff --git a/internal/wclayer/baselayerreader.go b/internal/wclayer/baselayerreader.go
index ec4423effe..24f33a6a88 100644
--- a/internal/wclayer/baselayerreader.go
+++ b/internal/wclayer/baselayerreader.go
@@ -1,3 +1,5 @@
+//go:build windows
+
 package wclayer
 
 import (
diff --git a/internal/wclayer/converttobaselayer.go b/internal/wclayer/converttobaselayer.go
index ceb3b50835..6756be444c 100644
--- a/internal/wclayer/converttobaselayer.go
+++ b/internal/wclayer/converttobaselayer.go
@@ -1,3 +1,5 @@
+//go:build windows
+
 package wclayer
 
 import (
diff --git a/internal/winapi/utils.go b/internal/winapi/utils.go
index a2da570707..38c67b9b16 100644
--- a/internal/winapi/utils.go
+++ b/internal/winapi/utils.go
@@ -4,7 +4,6 @@ package winapi
 
 import (
 	"errors"
-	"reflect"
 	"syscall"
 	"unsafe"
 
@@ -14,11 +13,7 @@ import (
 // Uint16BufferToSlice wraps a uint16 pointer-and-length into a slice
 // for easier interop with Go APIs
 func Uint16BufferToSlice(buffer *uint16, bufferLength int) (result []uint16) {
-	hdr := (*reflect.SliceHeader)(unsafe.Pointer(&result))
-	hdr.Data = uintptr(unsafe.Pointer(buffer))
-	hdr.Cap = bufferLength
-	hdr.Len = bufferLength
-
+	result = unsafe.Slice(buffer, bufferLength)
 	return
 }