diff --git a/.golangci.yml b/.golangci.yml
index fd3c0767de..fb210c4364 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -110,6 +110,9 @@ linters-settings:
     for-loops: false # Report preallocation suggestions on for loops, false by default
   gci:
     local-prefixes: github.com/talos-systems/talos
+  cyclop:
+    # the maximal code complexity to report
+    max-complexity: 20
 
 linters:
   enable-all: true
@@ -118,6 +121,8 @@ linters:
     - typecheck
     - gochecknoglobals
     - gochecknoinits
+    - ifshort
+    - forbidigo
     - funlen
     - godox
     - gocognit
@@ -126,7 +131,12 @@ linters:
     - nestif
     - exhaustivestruct
     - errorlint
+    - paralleltest
+    - thelper
     - wrapcheck
+    # abandoned linters for which golangci shows the warning that the repo is archived by the owner
+    - interfacer
+    - maligned
   disable-all: false
   fast: false
 
diff --git a/Dockerfile b/Dockerfile
index 13dcfff4fd..3761a81109 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -48,7 +48,7 @@ ENV PATH /toolchain/bin:/toolchain/go/bin
 RUN ["/toolchain/bin/mkdir", "/bin", "/tmp"]
 RUN ["/toolchain/bin/ln", "-svf", "/toolchain/bin/bash", "/bin/sh"]
 RUN ["/toolchain/bin/ln", "-svf", "/toolchain/etc/ssl", "/etc/ssl"]
-RUN curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | bash -s -- -b /toolchain/bin v1.32.2
+RUN curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | bash -s -- -b /toolchain/bin v1.38.0
 ARG GOFUMPT_VERSION
 RUN cd $(mktemp -d) \
     && go mod init tmp \
diff --git a/cmd/installer/cmd/install.go b/cmd/installer/cmd/install.go
index 928b44bb06..9138c0fb25 100644
--- a/cmd/installer/cmd/install.go
+++ b/cmd/installer/cmd/install.go
@@ -49,9 +49,5 @@ func runInstallCmd() (err error) {
 		return err
 	}
 
-	if err = install.Install(p, seq, options); err != nil {
-		return err
-	}
-
-	return nil
+	return install.Install(p, seq, options)
 }
diff --git a/cmd/installer/pkg/install/install.go b/cmd/installer/pkg/install/install.go
index f60e66429d..6e5f0e5ea6 100644
--- a/cmd/installer/pkg/install/install.go
+++ b/cmd/installer/pkg/install/install.go
@@ -86,8 +86,6 @@ type Installer struct {
 }
 
 // NewInstaller initializes and returns an Installer.
-//
-//nolint:gocyclo
 func NewInstaller(cmdline *procfs.Cmdline, seq runtime.Sequence, opts *Options) (i *Installer, err error) {
 	i = &Installer{
 		cmdline: cmdline,
@@ -162,7 +160,7 @@ func (i *Installer) probeBootPartition() error {
 // Install fetches the necessary data locations and copies or extracts
 // to the target locations.
 //
-//nolint:gocyclo
+//nolint:gocyclo,cyclop
 func (i *Installer) Install(seq runtime.Sequence) (err error) {
 	if i.options.Board != constants.BoardNone {
 		var b runtime.Board
diff --git a/cmd/installer/pkg/install/manifest.go b/cmd/installer/pkg/install/manifest.go
index fb8492515e..d402e11ca8 100644
--- a/cmd/installer/pkg/install/manifest.go
+++ b/cmd/installer/pkg/install/manifest.go
@@ -186,7 +186,7 @@ func (m *Manifest) checkMounts(device Device) error {
 			f, err = os.Open(path)
 			if err != nil {
 				// ignore error in case process got removed
-				return nil
+				return nil //nolint:nilerr
 			}
 
 			defer f.Close() //nolint:errcheck
@@ -213,7 +213,7 @@ func (m *Manifest) checkMounts(device Device) error {
 	return nil
 }
 
-//nolint:gocyclo
+//nolint:gocyclo,cyclop
 func (m *Manifest) executeOnDevice(device Device, targets []*Target) (err error) {
 	if err = m.checkMounts(device); err != nil {
 		return err
@@ -365,11 +365,7 @@ func (m *Manifest) executeOnDevice(device Device, targets []*Target) (err error)
 		}
 	}
 
-	if err = m.restoreContents(targets); err != nil {
-		return err
-	}
-
-	return nil
+	return m.restoreContents(targets)
 }
 
 //nolint:gocyclo
@@ -506,7 +502,6 @@ func (m *Manifest) zeroDevice(device Device) (err error) {
 }
 
 // Partition creates a new partition on the specified device.
-//nolint:dupl,gocyclo
 func (t *Target) Partition(pt *gpt.GPT, pos int, bd *blockdevice.BlockDevice) (err error) {
 	if t.Skip {
 		part := pt.Partitions().FindByName(t.Label)
diff --git a/cmd/installer/pkg/install/target.go b/cmd/installer/pkg/install/target.go
index 41664ca769..ea7b1a6e23 100644
--- a/cmd/installer/pkg/install/target.go
+++ b/cmd/installer/pkg/install/target.go
@@ -26,7 +26,7 @@ import (
 
 // Target represents an installation partition.
 //
-//nolint:golint,maligned
+//nolint:maligned
 type Target struct {
 	*partition.FormatOptions
 	Device string
@@ -174,8 +174,6 @@ func (t *Target) Locate(pt *gpt.GPT) (*gpt.Partition, error) {
 }
 
 // Format creates a filesystem on the device/partition.
-//
-//nolint:gocyclo
 func (t *Target) Format() error {
 	if t.Skip {
 		return nil
diff --git a/cmd/talosctl/cmd/docs.go b/cmd/talosctl/cmd/docs.go
index 31101e60e6..0a7ce4385b 100644
--- a/cmd/talosctl/cmd/docs.go
+++ b/cmd/talosctl/cmd/docs.go
@@ -111,11 +111,7 @@ func GenMarkdownReference(cmd *cobra.Command, w io.Writer, linkHandler func(stri
 		}
 	}
 
-	if err := doc.GenMarkdownCustom(cmd, w, linkHandler); err != nil {
-		return err
-	}
-
-	return nil
+	return doc.GenMarkdownCustom(cmd, w, linkHandler)
 }
 
 func init() {
diff --git a/cmd/talosctl/cmd/mgmt/cluster/create.go b/cmd/talosctl/cmd/mgmt/cluster/create.go
index f0f17caad1..d0daef5cf4 100644
--- a/cmd/talosctl/cmd/mgmt/cluster/create.go
+++ b/cmd/talosctl/cmd/mgmt/cluster/create.go
@@ -117,7 +117,7 @@ var createCmd = &cobra.Command{
 	},
 }
 
-//nolint:gocyclo
+//nolint:gocyclo,cyclop
 func create(ctx context.Context) (err error) {
 	if masters < 1 {
 		return fmt.Errorf("number of masters can't be less than 1")
@@ -707,7 +707,7 @@ func getDisks() ([]*provision.Disk, error) {
 				DiskMountPoint: partitionPath,
 			}
 			diskSize += partitionSize
-			partitionIndex++
+			partitionIndex++ //nolint:wastedassign
 		}
 
 		disks = append(disks, &provision.Disk{
diff --git a/cmd/talosctl/cmd/talos/dashboard/data/diff.go b/cmd/talosctl/cmd/talos/dashboard/data/diff.go
index db28a7ec0c..648e7891a3 100644
--- a/cmd/talosctl/cmd/talos/dashboard/data/diff.go
+++ b/cmd/talosctl/cmd/talos/dashboard/data/diff.go
@@ -6,80 +6,80 @@ package data
 
 import "github.com/talos-systems/talos/pkg/machinery/api/machine"
 
-func cpuInfoDiff(old, new *machine.CPUStat) *machine.CPUStat {
-	if old == nil || new == nil {
+func cpuInfoDiff(old, next *machine.CPUStat) *machine.CPUStat {
+	if old == nil || next == nil {
 		return &machine.CPUStat{}
 	}
 
 	// TODO: support wraparound
 	return &machine.CPUStat{
-		User:      new.User - old.User,
-		Nice:      new.Nice - old.Nice,
-		System:    new.System - old.System,
-		Idle:      new.Idle - old.Idle,
-		Iowait:    new.Iowait - old.Iowait,
-		Irq:       new.Irq - old.Irq,
-		SoftIrq:   new.SoftIrq - old.SoftIrq,
-		Steal:     new.Steal - old.Steal,
-		Guest:     new.Guest - old.Guest,
-		GuestNice: new.GuestNice - old.GuestNice,
+		User:      next.User - old.User,
+		Nice:      next.Nice - old.Nice,
+		System:    next.System - old.System,
+		Idle:      next.Idle - old.Idle,
+		Iowait:    next.Iowait - old.Iowait,
+		Irq:       next.Irq - old.Irq,
+		SoftIrq:   next.SoftIrq - old.SoftIrq,
+		Steal:     next.Steal - old.Steal,
+		Guest:     next.Guest - old.Guest,
+		GuestNice: next.GuestNice - old.GuestNice,
 	}
 }
 
-func netDevDiff(old, new *machine.NetDev) *machine.NetDev {
-	if old == nil || new == nil {
+func netDevDiff(old, next *machine.NetDev) *machine.NetDev {
+	if old == nil || next == nil {
 		return &machine.NetDev{}
 	}
 
 	// TODO: support wraparound
 	return &machine.NetDev{
-		Name:         new.Name,
-		RxBytes:      new.RxBytes - old.RxBytes,
-		RxPackets:    new.RxPackets - old.RxPackets,
-		RxErrors:     new.RxErrors - old.RxErrors,
-		RxDropped:    new.RxDropped - old.RxDropped,
-		RxFifo:       new.RxFifo - old.RxFifo,
-		RxFrame:      new.RxFrame - old.RxFrame,
-		RxCompressed: new.RxCompressed - old.RxCompressed,
-		RxMulticast:  new.RxMulticast - old.RxMulticast,
-		TxBytes:      new.TxBytes - old.TxBytes,
-		TxPackets:    new.TxPackets - old.TxPackets,
-		TxErrors:     new.TxErrors - old.TxErrors,
-		TxDropped:    new.TxDropped - old.TxDropped,
-		TxFifo:       new.TxFifo - old.TxFifo,
-		TxCollisions: new.TxCollisions - old.TxCollisions,
-		TxCarrier:    new.TxCarrier - old.TxCarrier,
-		TxCompressed: new.TxCompressed - old.TxCompressed,
+		Name:         next.Name,
+		RxBytes:      next.RxBytes - old.RxBytes,
+		RxPackets:    next.RxPackets - old.RxPackets,
+		RxErrors:     next.RxErrors - old.RxErrors,
+		RxDropped:    next.RxDropped - old.RxDropped,
+		RxFifo:       next.RxFifo - old.RxFifo,
+		RxFrame:      next.RxFrame - old.RxFrame,
+		RxCompressed: next.RxCompressed - old.RxCompressed,
+		RxMulticast:  next.RxMulticast - old.RxMulticast,
+		TxBytes:      next.TxBytes - old.TxBytes,
+		TxPackets:    next.TxPackets - old.TxPackets,
+		TxErrors:     next.TxErrors - old.TxErrors,
+		TxDropped:    next.TxDropped - old.TxDropped,
+		TxFifo:       next.TxFifo - old.TxFifo,
+		TxCollisions: next.TxCollisions - old.TxCollisions,
+		TxCarrier:    next.TxCarrier - old.TxCarrier,
+		TxCompressed: next.TxCompressed - old.TxCompressed,
 	}
 }
 
-func diskStatDiff(old, new *machine.DiskStat) *machine.DiskStat {
-	if old == nil || new == nil {
+func diskStatDiff(old, next *machine.DiskStat) *machine.DiskStat {
+	if old == nil || next == nil {
 		return &machine.DiskStat{}
 	}
 
 	// TODO: support wraparound
 	return &machine.DiskStat{
-		Name:             new.Name,
-		ReadCompleted:    new.ReadCompleted - old.ReadCompleted,
-		ReadMerged:       new.ReadMerged - old.ReadMerged,
-		ReadSectors:      new.ReadSectors - old.ReadSectors,
-		WriteCompleted:   new.WriteCompleted - old.WriteCompleted,
-		WriteMerged:      new.WriteMerged - old.WriteMerged,
-		WriteSectors:     new.WriteSectors - old.WriteSectors,
-		DiscardCompleted: new.DiscardCompleted - old.DiscardCompleted,
-		DiscardMerged:    new.DiscardMerged - old.DiscardMerged,
-		DiscardSectors:   new.DiscardSectors - old.DiscardSectors,
+		Name:             next.Name,
+		ReadCompleted:    next.ReadCompleted - old.ReadCompleted,
+		ReadMerged:       next.ReadMerged - old.ReadMerged,
+		ReadSectors:      next.ReadSectors - old.ReadSectors,
+		WriteCompleted:   next.WriteCompleted - old.WriteCompleted,
+		WriteMerged:      next.WriteMerged - old.WriteMerged,
+		WriteSectors:     next.WriteSectors - old.WriteSectors,
+		DiscardCompleted: next.DiscardCompleted - old.DiscardCompleted,
+		DiscardMerged:    next.DiscardMerged - old.DiscardMerged,
+		DiscardSectors:   next.DiscardSectors - old.DiscardSectors,
 	}
 }
 
-func procDiff(old, new *machine.ProcessInfo) *machine.ProcessInfo {
-	if old == nil || new == nil {
+func procDiff(old, next *machine.ProcessInfo) *machine.ProcessInfo {
+	if old == nil || next == nil {
 		return &machine.ProcessInfo{}
 	}
 
 	// TODO: support wraparound
 	return &machine.ProcessInfo{
-		CpuTime: new.CpuTime - old.CpuTime,
+		CpuTime: next.CpuTime - old.CpuTime,
 	}
 }
diff --git a/cmd/talosctl/cmd/talos/dashboard/source.go b/cmd/talosctl/cmd/talos/dashboard/source.go
index d83999c6a7..15667e6682 100644
--- a/cmd/talosctl/cmd/talos/dashboard/source.go
+++ b/cmd/talosctl/cmd/talos/dashboard/source.go
@@ -75,7 +75,7 @@ func (source *APISource) run(dataCh chan<- *data.Data) {
 	}
 }
 
-//nolint:gocyclo
+//nolint:gocyclo,cyclop
 func (source *APISource) gather() *data.Data {
 	result := &data.Data{
 		Timestamp: time.Now(),
diff --git a/cmd/talosctl/cmd/talos/dashboard/ui.go b/cmd/talosctl/cmd/talos/dashboard/ui.go
index 41c9cc79e7..1b8271f935 100644
--- a/cmd/talosctl/cmd/talos/dashboard/ui.go
+++ b/cmd/talosctl/cmd/talos/dashboard/ui.go
@@ -133,7 +133,7 @@ func (u *UI) Main(ctx context.Context, dataCh <-chan *data.Data) error {
 			case "q", "<C-c>":
 				return nil
 			case "<Resize>":
-				payload := e.Payload.(ui.Resize) //nolint:errcheck
+				payload := e.Payload.(ui.Resize) //nolint:errcheck,forcetypeassert
 
 				u.Resize(payload.Width, payload.Height)
 				ui.Clear()
diff --git a/cmd/talosctl/cmd/talos/output/table.go b/cmd/talosctl/cmd/talos/output/table.go
index 4399fcf52e..2a98903948 100644
--- a/cmd/talosctl/cmd/talos/output/table.go
+++ b/cmd/talosctl/cmd/talos/output/table.go
@@ -43,13 +43,13 @@ func (table *Table) WriteHeader(definition resource.Resource, withEvents bool) e
 		fields = append([]string{"*"}, fields...)
 	}
 
-	resourceDefinitionSpec := definition.(*resource.Any).Value().(map[string]interface{}) //nolint:errcheck
+	resourceDefinitionSpec := definition.(*resource.Any).Value().(map[string]interface{}) //nolint:errcheck,forcetypeassert
 
-	table.displayType = resourceDefinitionSpec["displayType"].(string) //nolint:errcheck
+	table.displayType = resourceDefinitionSpec["displayType"].(string) //nolint:errcheck,forcetypeassert
 
 	for _, col := range resourceDefinitionSpec["printColumns"].([]interface{}) {
-		column := col.(map[string]interface{}) //nolint:errcheck
-		name := column["name"].(string)        //nolint:errcheck
+		column := col.(map[string]interface{}) //nolint:errcheck,forcetypeassert
+		name := column["name"].(string)        //nolint:errcheck,forcetypeassert
 
 		fields = append(fields, strings.ToUpper(name))
 
diff --git a/cmd/talosctl/cmd/talos/processes.go b/cmd/talosctl/cmd/talos/processes.go
index 4099d1de39..c093172863 100644
--- a/cmd/talosctl/cmd/talos/processes.go
+++ b/cmd/talosctl/cmd/talos/processes.go
@@ -169,7 +169,6 @@ var cpu = func(p1, p2 *machineapi.ProcessInfo) bool {
 	return p1.CpuTime > p2.CpuTime
 }
 
-//nolint:gocyclo
 func processesOutput(ctx context.Context, c *client.Client) (output string, err error) {
 	var remotePeer peer.Peer
 
@@ -179,7 +178,7 @@ func processesOutput(ctx context.Context, c *client.Client) (output string, err
 		// up display
 		// TODO: Update server side code to not throw an error when process
 		// no longer exists ( /proc/1234/comm no such file or directory )
-		return output, nil
+		return output, nil //nolint:nilerr
 	}
 
 	defaultNode := client.AddrFromPeer(&remotePeer)
diff --git a/cmd/talosctl/cmd/talos/service.go b/cmd/talosctl/cmd/talos/service.go
index a857d4964f..d4bbfc68bf 100644
--- a/cmd/talosctl/cmd/talos/service.go
+++ b/cmd/talosctl/cmd/talos/service.go
@@ -139,7 +139,7 @@ func serviceInfo(ctx context.Context, c *client.Client, id string) error {
 			//nolint:errcheck
 			ts, _ := ptypes.Timestamp(event.Ts)
 			fmt.Fprintf(w, "%s\t[%s]: %s (%s ago)\n", label, event.State, event.Msg, time.Since(ts).Round(time.Second))
-			label = ""
+			label = "" //nolint:wastedassign
 		}
 	}
 
diff --git a/internal/app/init/main.go b/internal/app/init/main.go
index 65f720e0d0..6d58972e40 100644
--- a/internal/app/init/main.go
+++ b/internal/app/init/main.go
@@ -63,11 +63,7 @@ func run() (err error) {
 	// Switch into the new rootfs.
 	log.Println("entering the rootfs")
 
-	if err = switchroot.Switch(constants.NewRoot, pseudo); err != nil {
-		return err
-	}
-
-	return nil
+	return switchroot.Switch(constants.NewRoot, pseudo)
 }
 
 func recovery() {
diff --git a/internal/app/machined/internal/server/v1alpha1/v1alpha1_monitoring.go b/internal/app/machined/internal/server/v1alpha1/v1alpha1_monitoring.go
index a9046a0c70..894ab81ab0 100644
--- a/internal/app/machined/internal/server/v1alpha1/v1alpha1_monitoring.go
+++ b/internal/app/machined/internal/server/v1alpha1/v1alpha1_monitoring.go
@@ -235,7 +235,7 @@ func (s *Server) NetworkDeviceStats(ctx context.Context, in *empty.Empty) (*mach
 
 	for _, line := range info {
 		resp.Devices[i] = translateNetDevLine(line)
-		i++
+		i++ //nolint:wastedassign
 	}
 
 	reply := &machine.NetworkDeviceStatsResponse{
diff --git a/internal/app/machined/internal/server/v1alpha1/v1alpha1_resource.go b/internal/app/machined/internal/server/v1alpha1/v1alpha1_resource.go
index d6abba9da8..c12f6e52bf 100644
--- a/internal/app/machined/internal/server/v1alpha1/v1alpha1_resource.go
+++ b/internal/app/machined/internal/server/v1alpha1/v1alpha1_resource.go
@@ -81,7 +81,7 @@ func (s *ResourceServer) resolveResourceKind(ctx context.Context, kind *resource
 			continue
 		}
 
-		spec := resourceDefinition.Spec().(meta.ResourceDefinitionSpec) //nolint:errcheck
+		spec := resourceDefinition.Spec().(meta.ResourceDefinitionSpec) //nolint:errcheck,forcetypeassert
 
 		for _, alias := range spec.Aliases {
 			if strings.EqualFold(alias, kind.Type) {
diff --git a/internal/app/machined/internal/server/v1alpha1/v1alpha1_server.go b/internal/app/machined/internal/server/v1alpha1/v1alpha1_server.go
index 5c8e284607..c859fb0edc 100644
--- a/internal/app/machined/internal/server/v1alpha1/v1alpha1_server.go
+++ b/internal/app/machined/internal/server/v1alpha1/v1alpha1_server.go
@@ -223,7 +223,7 @@ func (s *Server) Reboot(ctx context.Context, in *empty.Empty) (reply *machine.Re
 
 // Rollback implements the machine.MachineServer interface.
 //
-//nolint:dupl,gocyclo
+//nolint:gocyclo
 func (s *Server) Rollback(ctx context.Context, in *machine.RollbackRequest) (*machine.RollbackResponse, error) {
 	log.Printf("rollback via API received")
 
@@ -286,8 +286,6 @@ func (s *Server) Rollback(ctx context.Context, in *machine.RollbackRequest) (*ma
 }
 
 // Bootstrap implements the machine.MachineServer interface.
-//
-//nolint:dupl
 func (s *Server) Bootstrap(ctx context.Context, in *machine.BootstrapRequest) (reply *machine.BootstrapResponse, err error) {
 	log.Printf("bootstrap request received")
 
@@ -351,7 +349,7 @@ func (s *Server) Shutdown(ctx context.Context, in *empty.Empty) (reply *machine.
 
 // Upgrade initiates an upgrade.
 //
-//nolint:dupl,gocyclo
+//nolint:gocyclo,cyclop
 func (s *Server) Upgrade(ctx context.Context, in *machine.UpgradeRequest) (reply *machine.UpgradeResponse, err error) {
 	var mu *concurrency.Mutex
 
@@ -494,7 +492,7 @@ func (opt *ResetOptions) GetSystemDiskTargets() []runtime.PartitionTarget {
 
 // Reset resets the node.
 //
-//nolint:dupl,gocyclo
+//nolint:gocyclo
 func (s *Server) Reset(ctx context.Context, in *machine.ResetRequest) (reply *machine.ResetResponse, err error) {
 	log.Printf("reset request received")
 
@@ -567,8 +565,6 @@ func (s *Server) Reset(ctx context.Context, in *machine.ResetRequest) (reply *ma
 }
 
 // Recover recovers the control plane.
-//
-//nolint:dupl
 func (s *Server) Recover(ctx context.Context, in *machine.RecoverRequest) (reply *machine.RecoverResponse, err error) {
 	log.Printf("recover request received")
 
@@ -778,6 +774,7 @@ func (s *Server) List(req *machine.ListRequest, obj machine.MachineService_ListS
 }
 
 // DiskUsage implements the machine.MachineServer interface.
+//nolint:cyclop
 func (s *Server) DiskUsage(req *machine.DiskUsageRequest, obj machine.MachineService_DiskUsageServer) error { //nolint:gocyclo
 	if req == nil {
 		req = new(machine.DiskUsageRequest)
@@ -1093,7 +1090,6 @@ func (s *Server) Kubeconfig(empty *empty.Empty, obj machine.MachineService_Kubec
 
 // Logs provides a service or container logs can be requested and the contents of the
 // log file are streamed in chunks.
-//nolint:gocyclo
 func (s *Server) Logs(req *machine.LogsRequest, l machine.MachineService_LogsServer) (err error) {
 	var chunk chunker.Chunker
 
@@ -1386,7 +1382,6 @@ func (s *Server) Containers(ctx context.Context, in *machine.ContainersRequest)
 }
 
 // Stats implements the machine.MachineServer interface.
-//nolint:gocyclo
 func (s *Server) Stats(ctx context.Context, in *machine.StatsRequest) (reply *machine.StatsResponse, err error) {
 	inspector, err := getContainerInspector(ctx, in.Namespace, in.Driver)
 	if err != nil {
diff --git a/internal/app/machined/pkg/controllers/config/k8s_control_plane.go b/internal/app/machined/pkg/controllers/config/k8s_control_plane.go
index 89460a39b3..46c238371d 100644
--- a/internal/app/machined/pkg/controllers/config/k8s_control_plane.go
+++ b/internal/app/machined/pkg/controllers/config/k8s_control_plane.go
@@ -24,8 +24,7 @@ import (
 )
 
 // K8sControlPlaneController manages config.K8sControlPlane based on configuration.
-type K8sControlPlaneController struct {
-}
+type K8sControlPlaneController struct{}
 
 // Name implements controller.Controller interface.
 func (ctrl *K8sControlPlaneController) Name() string {
diff --git a/internal/app/machined/pkg/controllers/config/machine_type.go b/internal/app/machined/pkg/controllers/config/machine_type.go
index 2b7b1550cb..4323f778e4 100644
--- a/internal/app/machined/pkg/controllers/config/machine_type.go
+++ b/internal/app/machined/pkg/controllers/config/machine_type.go
@@ -19,8 +19,7 @@ import (
 )
 
 // MachineTypeController manages config.MachineType based on configuration.
-type MachineTypeController struct {
-}
+type MachineTypeController struct{}
 
 // Name implements controller.Controller interface.
 func (ctrl *MachineTypeController) Name() string {
diff --git a/internal/app/machined/pkg/controllers/k8s/kubelet_static_pod_controller.go b/internal/app/machined/pkg/controllers/k8s/kubelet_static_pod_controller.go
index ec464398ec..a0f351d1bf 100644
--- a/internal/app/machined/pkg/controllers/k8s/kubelet_static_pod_controller.go
+++ b/internal/app/machined/pkg/controllers/k8s/kubelet_static_pod_controller.go
@@ -43,7 +43,7 @@ func (ctrl *KubeletStaticPodController) ManagedResources() (resource.Namespace,
 
 // Run implements controller.Controller interface.
 //
-//nolint:gocyclo
+//nolint:gocyclo,cyclop
 func (ctrl *KubeletStaticPodController) Run(ctx context.Context, r controller.Runtime, logger *log.Logger) error {
 	if err := r.UpdateDependencies([]controller.Dependency{
 		{
@@ -221,7 +221,7 @@ func (ctrl *KubeletStaticPodController) writePod(ctx context.Context, r controll
 
 	renderedPod, err := yaml.Marshal(staticPod.Spec())
 	if err != nil {
-		return nil
+		return err
 	}
 
 	podPath := ctrl.podPath(staticPod)
diff --git a/internal/app/machined/pkg/controllers/k8s/manifest_test.go b/internal/app/machined/pkg/controllers/k8s/manifest_test.go
index 1e1bb0194e..3aacea2145 100644
--- a/internal/app/machined/pkg/controllers/k8s/manifest_test.go
+++ b/internal/app/machined/pkg/controllers/k8s/manifest_test.go
@@ -194,14 +194,14 @@ func (suite *ManifestSuite) TestReconcileKubeProxyExtraArgs() {
 	r, err := suite.state.Get(suite.ctx, resource.NewMetadata(k8s.ControlPlaneNamespaceName, k8s.ManifestType, "10-kube-proxy", resource.VersionUndefined))
 	suite.Require().NoError(err)
 
-	manifest := r.(*k8s.Manifest) //nolint:errcheck
+	manifest := r.(*k8s.Manifest) //nolint:errcheck,forcetypeassert
 	suite.Assert().Len(manifest.Objects(), 3)
 
 	suite.Assert().Equal("DaemonSet", manifest.Objects()[0].GetKind())
 
 	ds := manifest.Objects()[0].Object
 	containerSpec := ds["spec"].(map[string]interface{})["template"].(map[string]interface{})["spec"].(map[string]interface{})["containers"].([]interface{})[0]
-	args := containerSpec.(map[string]interface{})["command"].([]interface{}) //nolint:errcheck
+	args := containerSpec.(map[string]interface{})["command"].([]interface{}) //nolint:errcheck,forcetypeassert
 
 	suite.Assert().Equal("--bind-address=\"::\"", args[len(args)-1])
 }
diff --git a/internal/app/machined/pkg/controllers/k8s/render_secrets_static_pod.go b/internal/app/machined/pkg/controllers/k8s/render_secrets_static_pod.go
index 7c3ddb03c8..87364dec33 100644
--- a/internal/app/machined/pkg/controllers/k8s/render_secrets_static_pod.go
+++ b/internal/app/machined/pkg/controllers/k8s/render_secrets_static_pod.go
@@ -40,7 +40,7 @@ func (ctrl *RenderSecretsStaticPodController) ManagedResources() (resource.Names
 
 // Run implements controller.Controller interface.
 //
-//nolint:gocyclo
+//nolint:gocyclo,cyclop
 func (ctrl *RenderSecretsStaticPodController) Run(ctx context.Context, r controller.Runtime, logger *log.Logger) error {
 	if err := r.UpdateDependencies([]controller.Dependency{
 		{
diff --git a/internal/app/machined/pkg/controllers/secrets/etcd.go b/internal/app/machined/pkg/controllers/secrets/etcd.go
index bbda65aaa5..4a5fe23918 100644
--- a/internal/app/machined/pkg/controllers/secrets/etcd.go
+++ b/internal/app/machined/pkg/controllers/secrets/etcd.go
@@ -34,7 +34,7 @@ func (ctrl *EtcdController) ManagedResources() (resource.Namespace, resource.Typ
 
 // Run implements controller.Controller interface.
 //
-//nolint:gocyclo,dupl
+//nolint:gocyclo
 func (ctrl *EtcdController) Run(ctx context.Context, r controller.Runtime, logger *log.Logger) error {
 	if err := r.UpdateDependencies([]controller.Dependency{
 		{
diff --git a/internal/app/machined/pkg/controllers/secrets/kubernetes.go b/internal/app/machined/pkg/controllers/secrets/kubernetes.go
index f11480bcca..722d2a5ce5 100644
--- a/internal/app/machined/pkg/controllers/secrets/kubernetes.go
+++ b/internal/app/machined/pkg/controllers/secrets/kubernetes.go
@@ -46,7 +46,7 @@ func (ctrl *KubernetesController) ManagedResources() (resource.Namespace, resour
 
 // Run implements controller.Controller interface.
 //
-//nolint:gocyclo,dupl
+//nolint:gocyclo
 func (ctrl *KubernetesController) Run(ctx context.Context, r controller.Runtime, logger *log.Logger) error {
 	if err := r.UpdateDependencies([]controller.Dependency{
 		{
diff --git a/internal/app/machined/pkg/controllers/v1alpha1/boostrap_status.go b/internal/app/machined/pkg/controllers/v1alpha1/boostrap_status.go
index 4b12504c9b..e225f206f1 100644
--- a/internal/app/machined/pkg/controllers/v1alpha1/boostrap_status.go
+++ b/internal/app/machined/pkg/controllers/v1alpha1/boostrap_status.go
@@ -37,8 +37,6 @@ func (ctrl *BootstrapStatusController) ManagedResources() (resource.Namespace, r
 }
 
 // Run implements controller.Controller interface.
-//
-//nolint:gocyclo
 func (ctrl *BootstrapStatusController) Run(ctx context.Context, r controller.Runtime, logger *log.Logger) error {
 	if err := r.UpdateDependencies([]controller.Dependency{
 		{
diff --git a/internal/app/machined/pkg/controllers/v1alpha1/service.go b/internal/app/machined/pkg/controllers/v1alpha1/service.go
index 6e80c4f000..fc64eb0f78 100644
--- a/internal/app/machined/pkg/controllers/v1alpha1/service.go
+++ b/internal/app/machined/pkg/controllers/v1alpha1/service.go
@@ -65,7 +65,7 @@ func (ctrl *ServiceController) Run(ctx context.Context, r controller.Runtime, lo
 				switch msg.Action { //nolint:exhaustive
 				case machine.ServiceStateEvent_RUNNING:
 					if err := r.Update(ctx, service, func(r resource.Resource) error {
-						svc := r.(*v1alpha1.Service) //nolint:errcheck
+						svc := r.(*v1alpha1.Service) //nolint:errcheck,forcetypeassert
 
 						svc.SetRunning(true)
 						svc.SetHealthy(msg.GetHealth().GetHealthy() && !msg.GetHealth().GetUnknown())
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/board/board.go b/internal/app/machined/pkg/runtime/v1alpha1/board/board.go
index 871b4b2d07..6579ae0621 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/board/board.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/board/board.go
@@ -21,8 +21,6 @@ import (
 )
 
 // CurrentBoard is a helper func for discovering the current board.
-//
-//nolint:gocyclo
 func CurrentBoard() (b runtime.Board, err error) {
 	var board string
 
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/adv/syslinux/syslinux.go b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/adv/syslinux/syslinux.go
index db21ff6b08..7f7ac8fce1 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/adv/syslinux/syslinux.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/adv/syslinux/syslinux.go
@@ -78,9 +78,9 @@ func (a ADV) ReadTagBytes(t uint8) (val []byte, ok bool) {
 			continue
 		}
 
-		len := int(a[i+1]) + i
+		length := int(a[i+1]) + i
 
-		val = a[i+2 : len+2]
+		val = a[i+2 : length+2]
 
 		ok = true
 
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/adv/talos/talos.go b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/adv/talos/talos.go
index e28087a91f..f2d8ff52e0 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/adv/talos/talos.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/adv/talos/talos.go
@@ -95,7 +95,7 @@ func (a *ADV) Unmarshal(buf []byte) error {
 	copy(buf[len(buf)-36:len(buf)-4], make([]byte, 32))
 
 	hash := sha256.New()
-	hash.Write(buf) //nolint:errcheck
+	hash.Write(buf)
 	actualChecksum := hash.Sum(nil)
 
 	if !bytes.Equal(checksum, actualChecksum) {
@@ -148,7 +148,7 @@ func (a *ADV) Marshal() ([]byte, error) {
 	}
 
 	hash := sha256.New()
-	hash.Write(buf) //nolint:errcheck
+	hash.Write(buf)
 	copy(buf[len(buf)-36:len(buf)-4], hash.Sum(nil))
 
 	return buf, nil
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/grub.go b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/grub.go
index 2080c594e8..85d8800fe9 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/grub.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/grub.go
@@ -202,9 +202,5 @@ func writeCfg(path string, grubcfg *Cfg) (err error) {
 
 	log.Printf("writing %s to disk", path)
 
-	if err = ioutil.WriteFile(path, wr.Bytes(), 0o600); err != nil {
-		return err
-	}
-
-	return nil
+	return ioutil.WriteFile(path, wr.Bytes(), 0o600)
 }
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/meta.go b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/meta.go
index 9f642373e2..709050af01 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/meta.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/meta.go
@@ -100,8 +100,6 @@ func (m *Meta) Write() error {
 }
 
 // Revert reverts the default bootloader label to the previous installation.
-//
-//nolint:gocyclo
 func (m *Meta) Revert() (err error) {
 	label, ok := m.LegacyADV.ReadTag(adv.Upgrade)
 	if !ok {
@@ -111,11 +109,7 @@ func (m *Meta) Revert() (err error) {
 	if label == "" {
 		m.LegacyADV.DeleteTag(adv.Upgrade)
 
-		if err = m.Write(); err != nil {
-			return err
-		}
-
-		return nil
+		return m.Write()
 	}
 
 	g := &grub.Grub{}
@@ -126,9 +120,5 @@ func (m *Meta) Revert() (err error) {
 
 	m.LegacyADV.DeleteTag(adv.Upgrade)
 
-	if err = m.Write(); err != nil {
-		return err
-	}
-
-	return nil
+	return m.Write()
 }
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/syslinux/syslinux.go b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/syslinux/syslinux.go
index 982cc7b365..6861a50a0f 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/syslinux/syslinux.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/syslinux/syslinux.go
@@ -81,8 +81,6 @@ func Prepare(dev string) (err error) {
 
 // Install implements the Bootloader interface. It sets up syslinux with the
 // specified kernel parameters.
-//
-//nolint:gocyclo
 func Install(fallback string, config interface{}, sequence runtime.Sequence, bootPartitionFound bool) (err error) {
 	syslinuxcfg, ok := config.(*Cfg)
 	if !ok {
@@ -156,8 +154,6 @@ func Labels() (current, next string, err error) {
 }
 
 // Default sets the default syslinx label.
-//
-//nolint:gocyclo
 func Default(label string) (err error) {
 	log.Printf("setting default label to %q", label)
 
@@ -176,11 +172,7 @@ func Default(label string) (err error) {
 
 	b = re.ReplaceAll(b, []byte(fmt.Sprintf("DEFAULT %s", label)))
 
-	if err = ioutil.WriteFile(SyslinuxConfig, b, 0o600); err != nil {
-		return err
-	}
-
-	return nil
+	return ioutil.WriteFile(SyslinuxConfig, b, 0o600)
 }
 
 func writeCfg(base, path string, syslinuxcfg *Cfg) (err error) {
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/platform/metal/metal.go b/internal/app/machined/pkg/runtime/v1alpha1/platform/metal/metal.go
index 80fe1a16ec..c4b9c7b582 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/platform/metal/metal.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/platform/metal/metal.go
@@ -38,8 +38,6 @@ func (m *Metal) Name() string {
 }
 
 // Configuration implements the platform.Platform interface.
-//
-//nolint:gocyclo
 func (m *Metal) Configuration(ctx context.Context) ([]byte, error) {
 	var option *string
 	if option = procfs.ProcCmdline().Get(constants.KernelParamConfig).First(); option == nil {
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/platform/platform.go b/internal/app/machined/pkg/runtime/v1alpha1/platform/platform.go
index ef316173ff..b899b052b5 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/platform/platform.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/platform/platform.go
@@ -25,8 +25,6 @@ import (
 )
 
 // CurrentPlatform is a helper func for discovering the current platform.
-//
-//nolint:gocyclo
 func CurrentPlatform() (p runtime.Platform, err error) {
 	var platform string
 
@@ -50,7 +48,6 @@ func NewPlatform(platform string) (p runtime.Platform, err error) {
 	return newPlatform(platform)
 }
 
-//nolint:gocyclo
 func newPlatform(platform string) (p runtime.Platform, err error) {
 	switch platform {
 	case "aws":
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_events.go b/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_events.go
index 3ae59f5921..63d71c7ff9 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_events.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_events.go
@@ -84,16 +84,16 @@ type Events struct {
 // Argument cap is a maximum event stream capacity (available event history).
 // Argument gap is a safety gap to separate consumer from the publisher.
 // Maximum available event history is (cap-gap).
-func NewEvents(cap, gap int) *Events {
+func NewEvents(capacity, gap int) *Events {
 	e := &Events{
-		stream: make([]runtime.Event, cap),
-		cap:    cap,
+		stream: make([]runtime.Event, capacity),
+		cap:    capacity,
 		gap:    gap,
 	}
 
-	if gap >= cap {
+	if gap >= capacity {
 		// we should never reach this, but if we do, panic so that we know.
-		panic("NewEvents: gap >= cap")
+		panic("NewEvents: gap >= capacity")
 	}
 
 	e.c = sync.NewCond(&e.mu)
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_sequencer_tasks.go b/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_sequencer_tasks.go
index a7788a1ab7..f0def7c2db 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_sequencer_tasks.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_sequencer_tasks.go
@@ -113,11 +113,7 @@ func EnforceKSPPRequirements(seq runtime.Sequence, data interface{}) (runtime.Ta
 			return err
 		}
 
-		if err = kspp.EnforceKSPPSysctls(); err != nil {
-			return err
-		}
-
-		return nil
+		return kspp.EnforceKSPPSysctls()
 	}, "enforceKSPPRequirements"
 }
 
@@ -144,18 +140,14 @@ func MountBPFFS(seq runtime.Sequence, data interface{}) (runtime.TaskExecutionFu
 			return err
 		}
 
-		if err = mount.Mount(mountpoints); err != nil {
-			return err
-		}
-
-		return nil
+		return mount.Mount(mountpoints)
 	}, "mountBPFFS"
 }
 
 const (
 	memoryCgroup                  = "memory"
 	memoryUseHierarchy            = "memory.use_hierarchy"
-	memoryUseHierarchyPermissions = os.FileMode(400)
+	memoryUseHierarchyPermissions = os.FileMode(0o400)
 )
 
 var memoryUseHierarchyContents = []byte(strconv.Itoa(1))
@@ -194,11 +186,7 @@ func MountPseudoFilesystems(seq runtime.Sequence, data interface{}) (runtime.Tas
 			return err
 		}
 
-		if err = mount.Mount(mountpoints); err != nil {
-			return err
-		}
-
-		return nil
+		return mount.Mount(mountpoints)
 	}, "mountPseudoFilesystems"
 }
 
@@ -256,11 +244,7 @@ func WriteRequiredSysctls(seq runtime.Sequence, data interface{}) (runtime.TaskE
 func SetRLimit(seq runtime.Sequence, data interface{}) (runtime.TaskExecutionFunc, string) {
 	return func(ctx context.Context, logger *log.Logger, r runtime.Runtime) (err error) {
 		// TODO(andrewrynhard): Should we read limit from /proc/sys/fs/nr_open?
-		if err = unix.Setrlimit(unix.RLIMIT_NOFILE, &unix.Rlimit{Cur: 1048576, Max: 1048576}); err != nil {
-			return err
-		}
-
-		return nil
+		return unix.Setrlimit(unix.RLIMIT_NOFILE, &unix.Rlimit{Cur: 1048576, Max: 1048576})
 	}, "setRLimit"
 }
 
@@ -409,11 +393,7 @@ func CreateEtcNetworkFiles(seq runtime.Sequence, data interface{}) (runtime.Task
 		}
 
 		// Create /etc/hosts
-		if err = Hosts(); err != nil {
-			return err
-		}
-
-		return nil
+		return Hosts()
 	}, "createEtcNetworkFiles"
 }
 
@@ -436,11 +416,7 @@ func SetupDiscoveryNetwork(seq runtime.Sequence, data interface{}) (runtime.Task
 		ctx, cancel := context.WithCancel(ctx)
 		defer cancel()
 
-		if err = nwd.Configure(ctx); err != nil {
-			return err
-		}
-
-		return nil
+		return nwd.Configure(ctx)
 	}, "setupDiscoveryNetwork"
 }
 
@@ -469,11 +445,7 @@ func LoadConfig(seq runtime.Sequence, data interface{}) (runtime.TaskExecutionFu
 
 			logger.Printf("storing config in memory")
 
-			if err = r.SetConfig(b); err != nil {
-				return err
-			}
-
-			return nil
+			return r.SetConfig(b)
 		}
 
 		cfg, err := configloader.NewFromFile(constants.ConfigPath)
@@ -496,11 +468,7 @@ func LoadConfig(seq runtime.Sequence, data interface{}) (runtime.TaskExecutionFu
 			return err
 		}
 
-		if err = r.SetConfig(b); err != nil {
-			return err
-		}
-
-		return nil
+		return r.SetConfig(b)
 	}, "loadConfig"
 }
 
@@ -615,8 +583,6 @@ func ValidateConfig(seq runtime.Sequence, data interface{}) (runtime.TaskExecuti
 }
 
 // ResetNetwork resets the network.
-//
-//nolint:gocyclo
 func ResetNetwork(seq runtime.Sequence, data interface{}) (runtime.TaskExecutionFunc, string) {
 	return func(ctx context.Context, logger *log.Logger, r runtime.Runtime) (err error) {
 		nwd, err := networkd.New(r.Config())
@@ -687,11 +653,7 @@ func StartUdevd(seq runtime.Sequence, data interface{}) (runtime.TaskExecutionFu
 		ctx, cancel := context.WithTimeout(ctx, 5*time.Minute)
 		defer cancel()
 
-		if err = system.WaitForService(system.StateEventUp, svc.ID(r)).Wait(ctx); err != nil {
-			return err
-		}
-
-		return nil
+		return system.WaitForService(system.StateEventUp, svc.ID(r)).Wait(ctx)
 	}, "startUdevd"
 }
 
@@ -807,11 +769,7 @@ func MountOverlayFilesystems(seq runtime.Sequence, data interface{}) (runtime.Ta
 			return err
 		}
 
-		if err = mount.Mount(mountpoints); err != nil {
-			return err
-		}
-
-		return nil
+		return mount.Mount(mountpoints)
 	}, "mountOverlayFilesystems"
 }
 
@@ -945,11 +903,7 @@ func mountDisks(r runtime.Runtime) (err error) {
 		}
 	}
 
-	if err = mount.Mount(mountpoints); err != nil {
-		return err
-	}
-
-	return nil
+	return mount.Mount(mountpoints)
 }
 
 func unmountDisks(r runtime.Runtime) (err error) {
@@ -968,16 +922,12 @@ func unmountDisks(r runtime.Runtime) (err error) {
 		}
 	}
 
-	if err = mount.Unmount(mountpoints); err != nil {
-		return err
-	}
-
-	return nil
+	return mount.Unmount(mountpoints)
 }
 
 // WriteUserFiles represents the WriteUserFiles task.
 //
-//nolint:gocyclo
+//nolint:gocyclo,cyclop
 func WriteUserFiles(seq runtime.Sequence, data interface{}) (runtime.TaskExecutionFunc, string) {
 	return func(ctx context.Context, logger *log.Logger, r runtime.Runtime) (err error) {
 		var result *multierror.Error
@@ -1152,11 +1102,7 @@ func UnmountOverlayFilesystems(seq runtime.Sequence, data interface{}) (runtime.
 			return err
 		}
 
-		if err = mount.Unmount(mountpoints); err != nil {
-			return err
-		}
-
-		return nil
+		return mount.Unmount(mountpoints)
 	}, "unmountOverlayFilesystems"
 }
 
@@ -1196,11 +1142,7 @@ func UnmountPodMounts(seq runtime.Sequence, data interface{}) (runtime.TaskExecu
 			}
 		}
 
-		if err = scanner.Err(); err != nil {
-			return err
-		}
-
-		return nil
+		return scanner.Err()
 	}, "unmountPodMounts"
 }
 
@@ -1242,8 +1184,6 @@ func UnmountSystemDiskBindMounts(seq runtime.Sequence, data interface{}) (runtim
 
 // CordonAndDrainNode represents the task for stop all containerd tasks in the
 // k8s.io namespace.
-//
-//nolint:dupl
 func CordonAndDrainNode(seq runtime.Sequence, data interface{}) (runtime.TaskExecutionFunc, string) {
 	return func(ctx context.Context, logger *log.Logger, r runtime.Runtime) (err error) {
 		var nodename string
@@ -1258,19 +1198,13 @@ func CordonAndDrainNode(seq runtime.Sequence, data interface{}) (runtime.TaskExe
 			return err
 		}
 
-		if err = kubeHelper.CordonAndDrain(ctx, nodename); err != nil {
-			return err
-		}
-
-		return nil
+		return kubeHelper.CordonAndDrain(ctx, nodename)
 	}, "cordonAndDrainNode"
 }
 
 // UncordonNode represents the task for mark node as scheduling enabled.
 //
 // This action undoes the CordonAndDrainNode task.
-//
-//nolint:dupl
 func UncordonNode(seq runtime.Sequence, data interface{}) (runtime.TaskExecutionFunc, string) {
 	return func(ctx context.Context, logger *log.Logger, r runtime.Runtime) (err error) {
 		var nodename string
@@ -1289,16 +1223,11 @@ func UncordonNode(seq runtime.Sequence, data interface{}) (runtime.TaskExecution
 			return err
 		}
 
-		if err = kubeHelper.Uncordon(ctx, nodename, false); err != nil {
-			return err
-		}
-
-		return nil
+		return kubeHelper.Uncordon(ctx, nodename, false)
 	}, "uncordonNode"
 }
 
 // LeaveEtcd represents the task for removing a control plane node from etcd.
-//nolint:gocyclo
 func LeaveEtcd(seq runtime.Sequence, data interface{}) (runtime.TaskExecutionFunc, string) {
 	return func(ctx context.Context, logger *log.Logger, r runtime.Runtime) (err error) {
 		client, err := etcd.NewClientFromControlPlaneIPs(ctx, r.Config().Cluster().CA(), r.Config().Cluster().Endpoint())
@@ -1352,11 +1281,7 @@ func stopAndRemoveAllPods(stopAction cri.StopAction) runtime.TaskExecutionFunc {
 		// With the POD network mode pods out of the way, we kill the remaining
 		// pods.
 
-		if err = client.StopAndRemovePodSandboxes(ctx, stopAction); err != nil {
-			return err
-		}
-
-		return nil
+		return client.StopAndRemovePodSandboxes(ctx, stopAction)
 	}
 }
 
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_state.go b/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_state.go
index 226edb5b24..596237f469 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_state.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_state.go
@@ -40,8 +40,7 @@ type MachineState struct {
 }
 
 // ClusterState represents the cluster's state.
-type ClusterState struct {
-}
+type ClusterState struct{}
 
 // NewState initializes and returns the v1alpha1 state.
 func NewState() (s *State, err error) {
diff --git a/internal/app/machined/pkg/system/service_runner.go b/internal/app/machined/pkg/system/service_runner.go
index d01405a0e4..b7ab87e33f 100644
--- a/internal/app/machined/pkg/system/service_runner.go
+++ b/internal/app/machined/pkg/system/service_runner.go
@@ -414,7 +414,6 @@ func (svcrunner *ServiceRunner) notifyEvent(event StateEvent) {
 	}
 }
 
-//nolint:gocyclo
 func (svcrunner *ServiceRunner) inStateLocked(event StateEvent) bool {
 	switch event {
 	case StateEventUp:
diff --git a/internal/app/machined/pkg/system/services/etcd.go b/internal/app/machined/pkg/system/services/etcd.go
index ff99cb6320..5b0444da50 100644
--- a/internal/app/machined/pkg/system/services/etcd.go
+++ b/internal/app/machined/pkg/system/services/etcd.go
@@ -54,8 +54,6 @@ func (e *Etcd) ID(r runtime.Runtime) string {
 }
 
 // PreFunc implements the Service interface.
-//
-//nolint:gocyclo
 func (e *Etcd) PreFunc(ctx context.Context, r runtime.Runtime) (err error) {
 	if err = os.MkdirAll(constants.EtcdDataPath, 0o700); err != nil {
 		return err
@@ -206,11 +204,7 @@ func generatePKI(r runtime.Runtime) (err error) {
 		return err
 	}
 
-	if err := ioutil.WriteFile(constants.KubernetesEtcdPeerCert, certAndKey.Crt, 0o500); err != nil {
-		return err
-	}
-
-	return nil
+	return ioutil.WriteFile(constants.KubernetesEtcdPeerCert, certAndKey.Crt, 0o500)
 }
 
 func addMember(ctx context.Context, r runtime.Runtime, addrs []string, name string) (*clientv3.MemberListResponse, uint64, error) {
diff --git a/internal/app/machined/pkg/system/services/kubelet.go b/internal/app/machined/pkg/system/services/kubelet.go
index ced18b8ce9..4894cea347 100644
--- a/internal/app/machined/pkg/system/services/kubelet.go
+++ b/internal/app/machined/pkg/system/services/kubelet.go
@@ -64,8 +64,6 @@ func (k *Kubelet) ID(r runtime.Runtime) string {
 }
 
 // PreFunc implements the Service interface.
-//
-//nolint:gocyclo
 func (k *Kubelet) PreFunc(ctx context.Context, r runtime.Runtime) error {
 	cfg := struct {
 		Server               string
@@ -335,9 +333,5 @@ func writeKubeletConfig(r runtime.Runtime) error {
 		return err
 	}
 
-	if err := ioutil.WriteFile("/etc/kubernetes/kubelet.yaml", buf.Bytes(), 0o600); err != nil {
-		return err
-	}
-
-	return nil
+	return ioutil.WriteFile("/etc/kubernetes/kubelet.yaml", buf.Bytes(), 0o600)
 }
diff --git a/internal/app/machined/pkg/system/system.go b/internal/app/machined/pkg/system/system.go
index 0a0a47f56f..bbe882b5a5 100644
--- a/internal/app/machined/pkg/system/system.go
+++ b/internal/app/machined/pkg/system/system.go
@@ -18,6 +18,7 @@ import (
 	"github.com/talos-systems/talos/pkg/conditions"
 )
 
+// singleton the system services API interface.
 type singleton struct {
 	runtime runtime.Runtime
 
@@ -42,7 +43,7 @@ var (
 )
 
 // Services returns the instance of the system services API.
-//nolint:golint
+//nolint:revive,golint
 func Services(runtime runtime.Runtime) *singleton {
 	once.Do(func() {
 		instance = &singleton{
diff --git a/internal/app/maintenance/server/server.go b/internal/app/maintenance/server/server.go
index c65f81ed59..2144d1f458 100644
--- a/internal/app/maintenance/server/server.go
+++ b/internal/app/maintenance/server/server.go
@@ -79,7 +79,6 @@ func (s *Server) ApplyConfiguration(ctx context.Context, in *machine.ApplyConfig
 }
 
 // GenerateConfiguration implements the machine.MachineServer interface.
-//nolint:gocyclo
 func (s *Server) GenerateConfiguration(ctx context.Context, in *machine.GenerateConfigurationRequest) (reply *machine.GenerateConfigurationResponse, err error) {
 	if in.MachineConfig == nil {
 		return nil, fmt.Errorf("invalid generate request")
diff --git a/internal/app/networkd/pkg/networkd/netconf.go b/internal/app/networkd/pkg/networkd/netconf.go
index d730c754e3..6eebd91b95 100644
--- a/internal/app/networkd/pkg/networkd/netconf.go
+++ b/internal/app/networkd/pkg/networkd/netconf.go
@@ -21,7 +21,7 @@ import (
 
 // buildOptions translates the supplied config to nic.Option used for
 // configuring the interface.
-//nolint:gocyclo
+//nolint:gocyclo,cyclop
 func buildOptions(device config.Device, hostname string) (name string, opts []nic.Option, err error) {
 	opts = append(opts, nic.WithName(device.Interface()))
 
diff --git a/internal/app/networkd/pkg/networkd/networkd.go b/internal/app/networkd/pkg/networkd/networkd.go
index 81df7b97c8..a66ee3aa82 100644
--- a/internal/app/networkd/pkg/networkd/networkd.go
+++ b/internal/app/networkd/pkg/networkd/networkd.go
@@ -52,7 +52,7 @@ type Networkd struct {
 
 // New takes the supplied configuration and creates an abstract representation
 // of all interfaces (as nic.NetworkInterface).
-//nolint:gocyclo
+//nolint:gocyclo,cyclop
 func New(config config.Provider) (*Networkd, error) {
 	var (
 		hostname  string
@@ -302,11 +302,7 @@ func (n *Networkd) Hostname() (err error) {
 		return err
 	}
 
-	if err = unix.Setdomainname([]byte(domainname)); err != nil {
-		return err
-	}
-
-	return nil
+	return unix.Setdomainname([]byte(domainname))
 }
 
 //nolint:gocyclo
@@ -366,8 +362,8 @@ outer:
 	}
 
 	// Kernel
-	if kHostname := procfs.ProcCmdline().Get(constants.KernelParamHostname).First(); kHostname != nil {
-		hostname = *kHostname
+	if kernelHostname := procfs.ProcCmdline().Get(constants.KernelParamHostname).First(); kernelHostname != nil {
+		hostname = *kernelHostname
 	}
 
 	// Allow user supplied hostname to win
diff --git a/internal/app/networkd/pkg/nic/netlink.go b/internal/app/networkd/pkg/nic/netlink.go
index 09e7807c88..df28532178 100644
--- a/internal/app/networkd/pkg/nic/netlink.go
+++ b/internal/app/networkd/pkg/nic/netlink.go
@@ -108,11 +108,7 @@ func (n *NetworkInterface) configureWireguard(name string, config *wgtypes.Confi
 
 	defer c.Close() //nolint:errcheck
 
-	if err = c.ConfigureDevice(name, *config); err != nil {
-		return err
-	}
-
-	return nil
+	return c.ConfigureDevice(name, *config)
 }
 
 func (n *NetworkInterface) enslaveLink(bondIndex *uint32, links ...*net.Interface) error {
diff --git a/internal/app/networkd/pkg/nic/nic.go b/internal/app/networkd/pkg/nic/nic.go
index 686933d5f9..3bc5591850 100644
--- a/internal/app/networkd/pkg/nic/nic.go
+++ b/internal/app/networkd/pkg/nic/nic.go
@@ -128,7 +128,7 @@ func (n *NetworkInterface) Create() error {
 	if err == nil {
 		n.Link = iface
 
-		return err
+		return nil
 	}
 
 	switch {
@@ -374,7 +374,7 @@ func (n *NetworkInterface) renew(ctx context.Context, method address.Addressing)
 
 // configureInterface handles the actual address discovery mechanism and
 // netlink interaction to configure the interface.
-//nolint:gocyclo
+//nolint:gocyclo,cyclop
 func (n *NetworkInterface) configureInterface(method address.Addressing, link *net.Interface) error {
 	var err error
 
diff --git a/internal/app/networkd/pkg/nic/vars.go b/internal/app/networkd/pkg/nic/vars.go
index 56c6dd0591..a7fc26ee3e 100644
--- a/internal/app/networkd/pkg/nic/vars.go
+++ b/internal/app/networkd/pkg/nic/vars.go
@@ -2,7 +2,7 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-//nolint:golint,stylecheck
+//nolint:golint,stylecheck,revive
 package nic
 
 import "fmt"
diff --git a/internal/app/networkd/pkg/vip/vip.go b/internal/app/networkd/pkg/vip/vip.go
index cab9fef13d..c669bae352 100644
--- a/internal/app/networkd/pkg/vip/vip.go
+++ b/internal/app/networkd/pkg/vip/vip.go
@@ -83,7 +83,7 @@ func (c *vipController) maintain(ctx context.Context, netController vip.Network)
 	}
 }
 
-//nolint:gocyclo
+//nolint:gocyclo,cyclop
 func (c *vipController) campaign(ctx context.Context, netController vip.Network) error {
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
diff --git a/internal/app/timed/pkg/timex/timex.go b/internal/app/timed/pkg/timex/timex.go
index f00d6561e6..9d92e6fa2d 100644
--- a/internal/app/timed/pkg/timex/timex.go
+++ b/internal/app/timed/pkg/timex/timex.go
@@ -12,7 +12,7 @@ import (
 
 // Values for timex.mode.
 //
-//nolint:golint,stylecheck
+//nolint:golint,stylecheck,revive
 const (
 	ADJ_OFFSET    = 0x0001
 	ADJ_FREQUENCY = 0x0002
@@ -32,7 +32,7 @@ type Status int32
 
 // Clock statuses.
 //
-//nolint:golint,stylecheck
+//nolint:golint,stylecheck,revive
 const (
 	STA_PLL       = 0x0001 /* enable PLL updates (rw) */
 	STA_PPSFREQ   = 0x0002 /* enable PPS freq discipline (rw) */
@@ -86,7 +86,7 @@ type State int
 
 // Clock states.
 //
-//nolint:golint,stylecheck
+//nolint:golint,stylecheck,revive
 const (
 	TIME_OK State = iota
 	TIME_INS
diff --git a/internal/integration/api/etcd.go b/internal/integration/api/etcd.go
index ecac47a365..5f99bad337 100644
--- a/internal/integration/api/etcd.go
+++ b/internal/integration/api/etcd.go
@@ -82,8 +82,6 @@ func (suite *EtcdSuite) TestEtcdForfeitLeadership() {
 }
 
 // TestEtcdLeaveCluster tests removing an etcd member.
-//
-//nolint:gocyclo
 func (suite *EtcdSuite) TestEtcdLeaveCluster() {
 	if !suite.Capabilities().SupportsReboot {
 		suite.T().Skip("cluster doesn't support reboot (and reset)")
diff --git a/internal/integration/api/reboot.go b/internal/integration/api/reboot.go
index b248a3a48f..87f9d329c4 100644
--- a/internal/integration/api/reboot.go
+++ b/internal/integration/api/reboot.go
@@ -118,7 +118,7 @@ func (suite *RebootSuite) TestRebootAllNodes() {
 					return fmt.Errorf("bootID record not found for %q", node)
 				}
 
-				bootIDBefore := bootIDBeforeInterface.(string) //nolint:errcheck
+				bootIDBefore := bootIDBeforeInterface.(string) //nolint:errcheck,forcetypeassert
 
 				nodeCtx := client.WithNodes(suite.ctx, node)
 
diff --git a/internal/integration/provision/provision.go b/internal/integration/provision/provision.go
index cfb156d160..1d32438f94 100644
--- a/internal/integration/provision/provision.go
+++ b/internal/integration/provision/provision.go
@@ -48,7 +48,7 @@ type Settings struct {
 }
 
 // DefaultSettings filled in by test runner.
-var DefaultSettings Settings = Settings{
+var DefaultSettings = Settings{
 	CIDR:                       "172.21.0.0/24",
 	MTU:                        1500,
 	CPUs:                       2,
diff --git a/internal/pkg/circular/circular_test.go b/internal/pkg/circular/circular_test.go
index 36252dea0d..b7a2c7e7cf 100644
--- a/internal/pkg/circular/circular_test.go
+++ b/internal/pkg/circular/circular_test.go
@@ -101,7 +101,7 @@ func (suite *CircularSuite) TestStreamingReadWriter() {
 			suite.Require().Equal(l, n)
 
 			i += l
-			p = p[l:]
+			p = p[l:] //nolint:wastedassign
 		}
 	}()
 
@@ -192,7 +192,7 @@ func (suite *CircularSuite) TestStreamingMultipleReaders() {
 		suite.Require().Equal(l, n)
 
 		i += l
-		p = p[l:]
+		p = p[l:] //nolint:wastedassign
 	}
 }
 
diff --git a/internal/pkg/circular/options.go b/internal/pkg/circular/options.go
index 7eb76c2626..56281fa65a 100644
--- a/internal/pkg/circular/options.go
+++ b/internal/pkg/circular/options.go
@@ -26,26 +26,26 @@ func defaultOptions() Options {
 type OptionFunc func(*Options) error
 
 // WithInitialCapacity sets initial buffer capacity.
-func WithInitialCapacity(cap int) OptionFunc {
+func WithInitialCapacity(capacity int) OptionFunc {
 	return func(opt *Options) error {
-		if cap <= 0 {
-			return fmt.Errorf("initial capacity should be positive: %d", cap)
+		if capacity <= 0 {
+			return fmt.Errorf("initial capacity should be positive: %d", capacity)
 		}
 
-		opt.InitialCapacity = cap
+		opt.InitialCapacity = capacity
 
 		return nil
 	}
 }
 
 // WithMaxCapacity sets maximum buffer capacity.
-func WithMaxCapacity(cap int) OptionFunc {
+func WithMaxCapacity(capacity int) OptionFunc {
 	return func(opt *Options) error {
-		if cap <= 0 {
-			return fmt.Errorf("max capacity should be positive: %d", cap)
+		if capacity <= 0 {
+			return fmt.Errorf("max capacity should be positive: %d", capacity)
 		}
 
-		opt.MaxCapacity = cap
+		opt.MaxCapacity = capacity
 
 		return nil
 	}
diff --git a/internal/pkg/circular/reader.go b/internal/pkg/circular/reader.go
index a815d00f1d..9531e4b1fa 100644
--- a/internal/pkg/circular/reader.go
+++ b/internal/pkg/circular/reader.go
@@ -56,9 +56,8 @@ func (r *Reader) Read(p []byte) (n int, err error) {
 	}
 
 	i := int(r.off % int64(r.buf.opt.MaxCapacity))
-	l := r.buf.opt.MaxCapacity - i
 
-	if l < n {
+	if l := r.buf.opt.MaxCapacity - i; l < n {
 		copy(p, r.buf.data[i:])
 		copy(p[l:], r.buf.data[:n-l])
 	} else {
diff --git a/internal/pkg/circular/streaming.go b/internal/pkg/circular/streaming.go
index f49c3c3ed7..de8ff5ae15 100644
--- a/internal/pkg/circular/streaming.go
+++ b/internal/pkg/circular/streaming.go
@@ -59,9 +59,8 @@ func (r *StreamingReader) Read(p []byte) (n int, err error) {
 	}
 
 	i := int(r.off % int64(r.buf.opt.MaxCapacity))
-	l := r.buf.opt.MaxCapacity - i
 
-	if l < n {
+	if l := r.buf.opt.MaxCapacity - i; l < n {
 		copy(p, r.buf.data[i:])
 		copy(p[l:], r.buf.data[:n-l])
 	} else {
diff --git a/internal/pkg/configuration/configuration.go b/internal/pkg/configuration/configuration.go
index 51872644bb..26c0a09848 100644
--- a/internal/pkg/configuration/configuration.go
+++ b/internal/pkg/configuration/configuration.go
@@ -21,7 +21,7 @@ import (
 
 // Generate config for GenerateConfiguration grpc.
 //
-//nolint:gocyclo
+//nolint:gocyclo,cyclop
 func Generate(ctx context.Context, in *machine.GenerateConfigurationRequest) (reply *machine.GenerateConfigurationResponse, err error) {
 	var c config.Provider
 
diff --git a/internal/pkg/containers/containerd/containerd.go b/internal/pkg/containers/containerd/containerd.go
index 074ddaa7cb..8cb1e6266a 100644
--- a/internal/pkg/containers/containerd/containerd.go
+++ b/internal/pkg/containers/containerd/containerd.go
@@ -94,7 +94,7 @@ func (i *inspector) Images() (map[string]string, error) {
 	return imageList, nil
 }
 
-//nolint:gocyclo
+//nolint:gocyclo,cyclop
 func (i *inspector) containerInfo(cntr containerd.Container, imageList map[string]string, singleLookup bool) (*ctrs.Container, error) {
 	cp := &ctrs.Container{}
 
diff --git a/internal/pkg/encryption/keys/nodeid.go b/internal/pkg/encryption/keys/nodeid.go
index 997b85f632..6514c41fef 100644
--- a/internal/pkg/encryption/keys/nodeid.go
+++ b/internal/pkg/encryption/keys/nodeid.go
@@ -13,8 +13,7 @@ import (
 
 // NodeIDKeyHandler generates the key based on current node information
 // and provided template string.
-type NodeIDKeyHandler struct {
-}
+type NodeIDKeyHandler struct{}
 
 // NewNodeIDKeyHandler creates new NodeIDKeyHandler.
 func NewNodeIDKeyHandler() (*NodeIDKeyHandler, error) {
diff --git a/internal/pkg/etcd/etcd.go b/internal/pkg/etcd/etcd.go
index 65d943fb2a..36dde628f3 100644
--- a/internal/pkg/etcd/etcd.go
+++ b/internal/pkg/etcd/etcd.go
@@ -162,8 +162,6 @@ func (c *Client) LeaveCluster(ctx context.Context) error {
 }
 
 // RemoveMember removes the member from the etcd cluster.
-//
-//nolint:gocyclo
 func (c *Client) RemoveMember(ctx context.Context, hostname string) error {
 	resp, err := c.MemberList(ctx)
 	if err != nil {
diff --git a/internal/pkg/kmsg/kmsg.go b/internal/pkg/kmsg/kmsg.go
index 7dff356c61..543021d119 100644
--- a/internal/pkg/kmsg/kmsg.go
+++ b/internal/pkg/kmsg/kmsg.go
@@ -4,7 +4,6 @@
 
 // Package kmsg provides access to kernel log.
 //
-//nolint:dupl
 package kmsg
 
 import (
diff --git a/internal/pkg/kmsg/reader_test.go b/internal/pkg/kmsg/reader_test.go
index b3b8b3536e..f1a11252d8 100644
--- a/internal/pkg/kmsg/reader_test.go
+++ b/internal/pkg/kmsg/reader_test.go
@@ -16,6 +16,7 @@ import (
 	"github.com/talos-systems/talos/internal/pkg/kmsg"
 )
 
+//nolint:thelper
 func skipIfNoKmsg(t *testing.T) {
 	f, err := os.OpenFile("/dev/kmsg", os.O_RDONLY, 0)
 	if err != nil {
@@ -54,6 +55,7 @@ func TestReaderFollowTail(t *testing.T) {
 	testReaderFollow(t, false, kmsg.FromTail())
 }
 
+//nolint:thelper
 func testReaderFollow(t *testing.T, expectMessages bool, options ...kmsg.Option) {
 	skipIfNoKmsg(t)
 
diff --git a/internal/pkg/kubeconfig/merge.go b/internal/pkg/kubeconfig/merge.go
index f8bedaf897..4845b79aaa 100644
--- a/internal/pkg/kubeconfig/merge.go
+++ b/internal/pkg/kubeconfig/merge.go
@@ -56,7 +56,7 @@ const (
 
 // Merge the provided kubernetes config in.
 //
-//nolint:gocyclo
+//nolint:gocyclo,cyclop
 func (merger *Merger) Merge(config *clientcmdapi.Config, options MergeOptions) error {
 	mappedClusters := map[string]string{}
 	mappedAuthInfos := map[string]string{}
diff --git a/internal/pkg/mount/switchroot/switchroot.go b/internal/pkg/mount/switchroot/switchroot.go
index 714a18d181..a6384fa442 100644
--- a/internal/pkg/mount/switchroot/switchroot.go
+++ b/internal/pkg/mount/switchroot/switchroot.go
@@ -16,7 +16,6 @@ import (
 
 // Switch moves the rootfs to a specified directory. See
 // https://github.com/karelzak/util-linux/blob/master/sys-utils/switch_root.c.
-//nolint:gocyclo
 func Switch(prefix string, mountpoints *mount.Points) (err error) {
 	log.Println("moving mounts to the new rootfs")
 
diff --git a/internal/pkg/tui/components/form.go b/internal/pkg/tui/components/form.go
index ccc5a6cc2d..54b9fb3d6c 100644
--- a/internal/pkg/tui/components/form.go
+++ b/internal/pkg/tui/components/form.go
@@ -77,7 +77,7 @@ func (item *Item) assign(value string) error {
 }
 
 // createFormItems dynamically creates tview.FormItem list based on the wrapped type.
-//nolint:gocyclo
+//nolint:gocyclo,cyclop
 func (item *Item) createFormItems() ([]tview.Primitive, error) {
 	res := []tview.Primitive{}
 
diff --git a/pkg/archiver/tar_test.go b/pkg/archiver/tar_test.go
index 3b710d300b..88387b4024 100644
--- a/pkg/archiver/tar_test.go
+++ b/pkg/archiver/tar_test.go
@@ -23,7 +23,6 @@ type TarSuite struct {
 	CommonSuite
 }
 
-//nolint:gocyclo
 func (suite *TarSuite) TestArchiveDir() {
 	ch, err := archiver.Walker(context.Background(), suite.tmpDir)
 	suite.Require().NoError(err)
diff --git a/pkg/archiver/walker.go b/pkg/archiver/walker.go
index 76efb88314..fa414f92cc 100644
--- a/pkg/archiver/walker.go
+++ b/pkg/archiver/walker.go
@@ -79,7 +79,7 @@ func WithFileTypes(fileType ...FileType) WalkerOption {
 
 // Walker provides a channel of file info/paths for archival.
 //
-//nolint:gocyclo
+//nolint:gocyclo,cyclop
 func Walker(ctx context.Context, rootPath string, options ...WalkerOption) (<-chan FileItem, error) {
 	var opts walkerOptions
 	opts.maxRecurseDepth = -1
diff --git a/pkg/cluster/check/kubernetes.go b/pkg/cluster/check/kubernetes.go
index 733c2ac134..9502889a3c 100644
--- a/pkg/cluster/check/kubernetes.go
+++ b/pkg/cluster/check/kubernetes.go
@@ -55,7 +55,7 @@ func K8sAllNodesReportedAssertion(ctx context.Context, cluster ClusterInfo) erro
 
 // K8sFullControlPlaneAssertion checks whether all the master nodes are k8s master nodes.
 //
-//nolint:gocyclo
+//nolint:gocyclo,cyclop
 func K8sFullControlPlaneAssertion(ctx context.Context, cluster ClusterInfo) error {
 	clientset, err := cluster.K8sClient(ctx)
 	if err != nil {
diff --git a/pkg/cluster/check/service.go b/pkg/cluster/check/service.go
index 2210a33d36..76f0afb85d 100644
--- a/pkg/cluster/check/service.go
+++ b/pkg/cluster/check/service.go
@@ -20,8 +20,6 @@ import (
 var ErrServiceNotFound = fmt.Errorf("service not found")
 
 // ServiceStateAssertion checks whether service reached some specified state.
-//
-//nolint:gocyclo
 func ServiceStateAssertion(ctx context.Context, cluster ClusterInfo, service string, states ...string) error {
 	cli, err := cluster.Client()
 	if err != nil {
diff --git a/pkg/cluster/kubernetes/convert.go b/pkg/cluster/kubernetes/convert.go
index fbd011e9d3..a669501c5e 100644
--- a/pkg/cluster/kubernetes/convert.go
+++ b/pkg/cluster/kubernetes/convert.go
@@ -56,7 +56,7 @@ type ConvertProvider interface {
 
 // ConvertToStaticPods the self-hosted Kubernetes control plane to Talos-managed static pods-based control plane.
 //
-//nolint:gocyclo
+//nolint:gocyclo,cyclop
 func ConvertToStaticPods(ctx context.Context, cluster ConvertProvider, options ConvertOptions) error {
 	var err error
 
diff --git a/pkg/copy/copy.go b/pkg/copy/copy.go
index d622ee84f9..2bb84c3fef 100644
--- a/pkg/copy/copy.go
+++ b/pkg/copy/copy.go
@@ -2,7 +2,7 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-package copy
+package copy //nolint:predeclared
 
 import (
 	"io"
diff --git a/pkg/download/download.go b/pkg/download/download.go
index f1df3c6764..d26eae2caf 100644
--- a/pkg/download/download.go
+++ b/pkg/download/download.go
@@ -72,7 +72,6 @@ func WithErrorOnEmptyResponse(e error) Option {
 }
 
 // Download downloads a config.
-//nolint:gocyclo
 func Download(ctx context.Context, endpoint string, opts ...Option) (b []byte, err error) {
 	u, err := url.Parse(endpoint)
 	if err != nil {
diff --git a/pkg/follow/follow.go b/pkg/follow/follow.go
index 28525f1962..d87f834f91 100644
--- a/pkg/follow/follow.go
+++ b/pkg/follow/follow.go
@@ -47,8 +47,6 @@ func NewReader(readCtx context.Context, source *os.File) *Reader {
 }
 
 // Read implements io.Reader interface.
-//
-//nolint:gocyclo
 func (r *Reader) Read(p []byte) (n int, err error) {
 	r.mu.Lock()
 	if r.closed {
diff --git a/pkg/machinery/client/reply.go b/pkg/machinery/client/reply.go
index a9221974bf..19050a41a3 100644
--- a/pkg/machinery/client/reply.go
+++ b/pkg/machinery/client/reply.go
@@ -31,7 +31,7 @@ func (ne *NodeError) Unwrap() error {
 
 // FilterMessages removes error Messagess from resp and builds multierror.
 //
-//nolint:gocyclo
+//nolint:gocyclo,cyclop
 func FilterMessages(resp interface{}, err error) (interface{}, error) {
 	if resp == nil {
 		return nil, err
diff --git a/pkg/machinery/config/configloader/configloader_test.go b/pkg/machinery/config/configloader/configloader_test.go
index 155aa081b1..6a7c49783f 100644
--- a/pkg/machinery/config/configloader/configloader_test.go
+++ b/pkg/machinery/config/configloader/configloader_test.go
@@ -11,7 +11,7 @@ import (
 	"github.com/stretchr/testify/suite"
 )
 
-//docgen: nodoc
+// docgen: nodoc
 type Suite struct {
 	suite.Suite
 }
diff --git a/pkg/machinery/config/encoder/encoder.go b/pkg/machinery/config/encoder/encoder.go
index dcbebd2cc5..5f2ee97042 100644
--- a/pkg/machinery/config/encoder/encoder.go
+++ b/pkg/machinery/config/encoder/encoder.go
@@ -84,7 +84,7 @@ func isSet(value reflect.Value) bool {
 	}
 }
 
-//nolint:gocyclo
+//nolint:gocyclo,cyclop
 func toYamlNode(in interface{}) (*yaml.Node, error) {
 	node := &yaml.Node{}
 
@@ -143,7 +143,7 @@ func toYamlNode(in interface{}) (*yaml.Node, error) {
 			}
 
 			var (
-				defined bool = isSet(v.Field(i))
+				defined = isSet(v.Field(i))
 
 				skip   bool
 				inline bool
diff --git a/pkg/machinery/config/provider.go b/pkg/machinery/config/provider.go
index 895f6950a0..8c41e2599b 100644
--- a/pkg/machinery/config/provider.go
+++ b/pkg/machinery/config/provider.go
@@ -368,8 +368,7 @@ type EncryptionKeyStatic interface {
 }
 
 // EncryptionKeyNodeID deterministically generated encryption key.
-type EncryptionKeyNodeID interface {
-}
+type EncryptionKeyNodeID interface{}
 
 // Encryption defines settings for the partition encryption.
 type Encryption interface {
diff --git a/pkg/machinery/config/types/v1alpha1/bundle/bundle.go b/pkg/machinery/config/types/v1alpha1/bundle/bundle.go
index 97177fc8b9..c7f8369af3 100644
--- a/pkg/machinery/config/types/v1alpha1/bundle/bundle.go
+++ b/pkg/machinery/config/types/v1alpha1/bundle/bundle.go
@@ -20,7 +20,7 @@ import (
 )
 
 // NewConfigBundle returns a new bundle.
-//nolint:gocyclo
+//nolint:gocyclo,cyclop
 func NewConfigBundle(opts ...Option) (*v1alpha1.ConfigBundle, error) {
 	options := DefaultOptions()
 
diff --git a/pkg/machinery/config/types/v1alpha1/generate/generate.go b/pkg/machinery/config/types/v1alpha1/generate/generate.go
index 941f3c6bec..7fc57bf7be 100644
--- a/pkg/machinery/config/types/v1alpha1/generate/generate.go
+++ b/pkg/machinery/config/types/v1alpha1/generate/generate.go
@@ -24,7 +24,6 @@ import (
 )
 
 // Config returns the talos config for a given node type.
-//nolint:gocyclo
 func Config(t machine.Type, in *Input) (c *v1alpha1.Config, err error) {
 	switch t {
 	case machine.TypeInit:
@@ -407,7 +406,6 @@ func NewAdminCertificateAndKey(currentTime time.Time, ca *x509.PEMEncodedCertifi
 
 // NewInput generates the sensitive data required to generate all config
 // types.
-//nolint:dupl,gocyclo
 func NewInput(clustername, endpoint, kubernetesVersion string, secrets *SecretsBundle, opts ...GenOption) (input *Input, err error) {
 	options := DefaultGenOptions()
 
diff --git a/pkg/machinery/config/types/v1alpha1/v1alpha1_configurator_bundle.go b/pkg/machinery/config/types/v1alpha1/v1alpha1_configurator_bundle.go
index afedba4857..6c79718bc0 100644
--- a/pkg/machinery/config/types/v1alpha1/v1alpha1_configurator_bundle.go
+++ b/pkg/machinery/config/types/v1alpha1/v1alpha1_configurator_bundle.go
@@ -20,7 +20,7 @@ import (
 )
 
 // ConfigBundle defines the group of v1alpha1 config files.
-//docgen: nodoc
+// docgen: nodoc
 type ConfigBundle struct {
 	InitCfg         *Config
 	ControlPlaneCfg *Config
diff --git a/pkg/machinery/config/types/v1alpha1/v1alpha1_types.go b/pkg/machinery/config/types/v1alpha1/v1alpha1_types.go
index 6a0c00acd6..9a1f23ad2b 100644
--- a/pkg/machinery/config/types/v1alpha1/v1alpha1_types.go
+++ b/pkg/machinery/config/types/v1alpha1/v1alpha1_types.go
@@ -155,7 +155,7 @@ var (
 		NameServers: []string{"9.8.7.6", "8.7.6.5"},
 	}
 
-	machineDisksExample []*MachineDisk = []*MachineDisk{
+	machineDisksExample = []*MachineDisk{
 		{
 			DeviceName: "/dev/sdb",
 			DiskPartitions: []*DiskPartition{
@@ -202,7 +202,7 @@ var (
 		TimeServers: []string{"time.cloudflare.com"},
 	}
 
-	machineSysctlsExample map[string]string = map[string]string{
+	machineSysctlsExample = map[string]string{
 		"kernel.domainname":   "talos.dev",
 		"net.ipv4.ip_forward": "0",
 	}
diff --git a/pkg/machinery/config/types/v1alpha1/v1alpha1_validation.go b/pkg/machinery/config/types/v1alpha1/v1alpha1_validation.go
index 0a791cb851..0a01c3e637 100644
--- a/pkg/machinery/config/types/v1alpha1/v1alpha1_validation.go
+++ b/pkg/machinery/config/types/v1alpha1/v1alpha1_validation.go
@@ -3,7 +3,6 @@
 // file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 // Package v1alpha1 provides user-facing v1alpha1 machine configs
-//nolint:dupl
 package v1alpha1
 
 import (
@@ -54,11 +53,10 @@ var (
 )
 
 // NetworkDeviceCheck defines the function type for checks.
-//nolint:dupl
 type NetworkDeviceCheck func(*Device) error
 
 // Validate implements the Configurator interface.
-//nolint:gocyclo
+//nolint:gocyclo,cyclop
 func (c *Config) Validate(mode config.RuntimeMode) error {
 	var result *multierror.Error
 
@@ -173,7 +171,6 @@ func (c *ClusterConfig) Validate() error {
 
 // ValidateNetworkDevices runs the specified validation checks specific to the
 // network devices.
-//nolint:dupl
 func ValidateNetworkDevices(d *Device, checks ...NetworkDeviceCheck) error {
 	var result *multierror.Error
 
@@ -193,7 +190,6 @@ func ValidateNetworkDevices(d *Device, checks ...NetworkDeviceCheck) error {
 }
 
 // CheckDeviceInterface ensures that the interface has been specified.
-//nolint:dupl
 func CheckDeviceInterface(d *Device) error {
 	var result *multierror.Error
 
@@ -209,8 +205,7 @@ func CheckDeviceInterface(d *Device) error {
 }
 
 // CheckDeviceAddressing ensures that an appropriate addressing method.
-// has been specified
-//nolint:dupl
+// has been specified.
 func CheckDeviceAddressing(d *Device) error {
 	var result *multierror.Error
 
@@ -241,7 +236,6 @@ func CheckDeviceAddressing(d *Device) error {
 }
 
 // CheckDeviceRoutes ensures that the specified routes are valid.
-//nolint:dupl
 func CheckDeviceRoutes(d *Device) error {
 	var result *multierror.Error
 
diff --git a/pkg/machinery/constants/constants.go b/pkg/machinery/constants/constants.go
index e93dac8a21..68fc2b2deb 100644
--- a/pkg/machinery/constants/constants.go
+++ b/pkg/machinery/constants/constants.go
@@ -407,7 +407,7 @@ const (
 )
 
 // See https://linux.die.net/man/3/klogctl
-//nolint:stylecheck
+//nolint:stylecheck,revive
 const (
 	// SYSLOG_ACTION_SIZE_BUFFER is a named type argument to klogctl.
 	//nolint:golint
diff --git a/pkg/provision/providers/docker/create.go b/pkg/provision/providers/docker/create.go
index 9798743b2f..626c5d4381 100644
--- a/pkg/provision/providers/docker/create.go
+++ b/pkg/provision/providers/docker/create.go
@@ -12,8 +12,6 @@ import (
 )
 
 // Create Talos cluster as a set of docker containers on docker network.
-//
-//nolint:gocyclo
 func (p *provisioner) Create(ctx context.Context, request provision.ClusterRequest, opts ...provision.Option) (provision.Cluster, error) {
 	var err error
 
diff --git a/pkg/provision/providers/firecracker/bootloader.go b/pkg/provision/providers/firecracker/bootloader.go
index ace4e7b59e..ed8262c7c5 100644
--- a/pkg/provision/providers/firecracker/bootloader.go
+++ b/pkg/provision/providers/firecracker/bootloader.go
@@ -56,8 +56,6 @@ func NewBootLoader(diskImage string) (*BootLoader, error) {
 }
 
 // ExtractAssets from disk image.
-//
-//nolint:gocyclo
 func (b *BootLoader) ExtractAssets() (assets BootAssets, err error) {
 	if err = b.findBootPartition(); err != nil {
 		return assets, err
diff --git a/pkg/provision/providers/qemu/launch.go b/pkg/provision/providers/qemu/launch.go
index 9b8fb1bcf9..f0619c2ac0 100644
--- a/pkg/provision/providers/qemu/launch.go
+++ b/pkg/provision/providers/qemu/launch.go
@@ -210,7 +210,7 @@ func checkPartitions(config *LaunchConfig) (bool, error) {
 	}
 
 	if err = diskTable.Read(); err != nil {
-		return false, nil
+		return false, err
 	}
 
 	return len(diskTable.Partitions().Items()) > 0, nil
@@ -349,8 +349,6 @@ func launchVM(config *LaunchConfig) error {
 // logfile in state directory.
 //
 // When signals SIGINT, SIGTERM are received, control process stops qemu and exits.
-//
-//nolint:gocyclo
 func Launch() error {
 	var config LaunchConfig
 
diff --git a/pkg/provision/providers/vm/launch.go b/pkg/provision/providers/vm/launch.go
index 2d8a87831a..504251e108 100644
--- a/pkg/provision/providers/vm/launch.go
+++ b/pkg/provision/providers/vm/launch.go
@@ -29,11 +29,7 @@ func ReadConfig(config interface{}) error {
 		return fmt.Errorf("extra unexpected input on stdin")
 	}
 
-	if err := os.Stdin.Close(); err != nil {
-		return err
-	}
-
-	return nil
+	return os.Stdin.Close()
 }
 
 // ConfigureSignals configures signal handling for the process.