diff --git a/.golangci.yml b/.golangci.yml
index fb210c4364..e9e051072c 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -99,6 +99,12 @@ linters-settings:
   nakedret:
     # make an issue if func has more lines of code than this setting and it has naked returns; default is 30
     max-func-lines: 30
+  nolintlint:
+    allow-unused: false
+    allow-leading-space: false
+    allow-no-explanation: []
+    require-explanation: false
+    require-specific: true
   prealloc:
     # XXX: we don't recommend using this linter before doing performance profiling.
     # For most programs usage of prealloc will be a premature optimization.
diff --git a/cmd/talosctl/cmd/talos/convert-k8s.go b/cmd/talosctl/cmd/talos/convert-k8s.go
index 8c5affc4bf..1dc550993c 100644
--- a/cmd/talosctl/cmd/talos/convert-k8s.go
+++ b/cmd/talosctl/cmd/talos/convert-k8s.go
@@ -36,7 +36,7 @@ func init() {
 	convertK8sCmd.Flags().BoolVar(&convertOptions.OnlyRemoveInitializedKey, "remove-initialized-key", false, "only remove bootkube initialized key (used in manual conversion)")
 
 	// hiding this flag as it should only be used in manual process (and it's documented there), but should never be used in automatic conversion
-	convertK8sCmd.Flags().MarkHidden("remove-initialized-key") //nolint: errcheck
+	convertK8sCmd.Flags().MarkHidden("remove-initialized-key") //nolint:errcheck
 
 	addCommand(convertK8sCmd)
 }
diff --git a/internal/app/networkd/pkg/server/server.go b/internal/app/networkd/pkg/server/server.go
index 6b1d5c4d9a..40616140b4 100644
--- a/internal/app/networkd/pkg/server/server.go
+++ b/internal/app/networkd/pkg/server/server.go
@@ -36,7 +36,7 @@ func (r *NetworkServer) Routes(ctx context.Context, in *empty.Empty) (reply *net
 		return nil, err
 	}
 
-	defer conn.Close() //nolint: errcheck
+	defer conn.Close() //nolint:errcheck
 
 	list, err := conn.Route.List()
 	if err != nil {
diff --git a/pkg/cluster/kubernetes/talos_managed.go b/pkg/cluster/kubernetes/talos_managed.go
index d04b1ee5cd..59a9d0144e 100644
--- a/pkg/cluster/kubernetes/talos_managed.go
+++ b/pkg/cluster/kubernetes/talos_managed.go
@@ -167,8 +167,8 @@ func upgradeConfigPatcher(options UpgradeOptions, service string, configResource
 			config.ClusterConfig = &v1alpha1config.ClusterConfig{}
 		}
 
-		configData := configResource.(*resource.Any).Value().(map[string]interface{}) //nolint: errcheck,forcetypeassert
-		configImage := configData["image"].(string)                                   //nolint: errcheck,forcetypeassert
+		configData := configResource.(*resource.Any).Value().(map[string]interface{}) //nolint:errcheck,forcetypeassert
+		configImage := configData["image"].(string)                                   //nolint:errcheck,forcetypeassert
 
 		switch service {
 		case kubeAPIServer: