diff --git a/.golangci.yaml b/.golangci.yaml
index 6423df7732..c947d98999 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -59,6 +59,7 @@ linters-settings:
   testifylint:
     enable-all: true
   errcheck:
+    check-blank: true
     check-type-assertions: true
     exclude-functions:
       - (*github.com/spf13/cobra.Command).Help
@@ -68,10 +69,13 @@ linters-settings:
 issues:
   # Revive rules that are disabled by default.
   include:
+    - EXC0001
     - EXC0012
     - EXC0013
     - EXC0014
     - EXC0015
-  # Exclude linting code copied from Helm.
   exclude-dirs:
-    - "src/cmd/tools/helm"
+    - "src/cmd/tools/helm"     # Exclude linting code copied from Helm.
+    - "src/internal/packager"
+    - "src/pkg/packager"       # TODO(mkcp): Delete packager rules once refactor is complete
+    - "src/internal/packager2" # TODO(mkcp): Delete packager rules once refactor is complete
diff --git a/src/cmd/package.go b/src/cmd/package.go
index 4f0c31322a..70371531d7 100644
--- a/src/cmd/package.go
+++ b/src/cmd/package.go
@@ -128,7 +128,7 @@ var packageMirrorCmd = &cobra.Command{
 			pkgConfig.PkgOpts.SkipSignatureValidation = true
 		}
 	},
-	RunE: func(cmd *cobra.Command, args []string) error {
+	RunE: func(cmd *cobra.Command, args []string) (err error) {
 		var c *cluster.Cluster
 		if dns.IsServiceURL(pkgConfig.InitOpts.RegistryInfo.Address) || dns.IsServiceURL(pkgConfig.InitOpts.GitServer.Address) {
 			var err error
@@ -157,8 +157,11 @@ var packageMirrorCmd = &cobra.Command{
 		if err != nil {
 			return err
 		}
-		//nolint: errcheck // ignore
-		defer pkgLayout.Cleanup()
+		defer func() {
+			// Cleanup package files
+			err = errors.Join(err, pkgLayout.Cleanup())
+		}()
+
 		mirrorOpt := packager2.MirrorOptions{
 			Cluster:         c,
 			PkgLayout:       pkgLayout,
@@ -194,7 +197,7 @@ var packageInspectCmd = &cobra.Command{
 			return err
 		}
 
-		cluster, _ := cluster.NewCluster()
+		cluster, _ := cluster.NewCluster() //nolint:errcheck
 		inspectOpt := packager2.ZarfInspectOptions{
 			Source:                  src,
 			SkipSignatureValidation: pkgConfig.PkgOpts.SkipSignatureValidation,
@@ -211,7 +214,10 @@ var packageInspectCmd = &cobra.Command{
 				return fmt.Errorf("failed to inspect package: %w", err)
 			}
 			for _, image := range output {
-				fmt.Fprintln(os.Stdout, "-", image)
+				_, err := fmt.Fprintln(os.Stdout, "-", image)
+				if err != nil {
+					return err
+				}
 			}
 		}
 
@@ -291,7 +297,7 @@ var packageRemoveCmd = &cobra.Command{
 			filters.ByLocalOS(runtime.GOOS),
 			filters.BySelectState(pkgConfig.PkgOpts.OptionalComponents),
 		)
-		cluster, _ := cluster.NewCluster()
+		cluster, _ := cluster.NewCluster() //nolint:errcheck
 		removeOpt := packager2.RemoveOptions{
 			Source:                  packageSource,
 			Cluster:                 cluster,
diff --git a/src/pkg/utils/cosign.go b/src/pkg/utils/cosign.go
index fe6ac9279a..a06beae49f 100644
--- a/src/pkg/utils/cosign.go
+++ b/src/pkg/utils/cosign.go
@@ -233,14 +233,14 @@ func GetCosignArtifacts(image string) ([]string, error) {
 
 	// Return empty if we don't have a signature on the image
 	var remoteOpts []ociremote.Option
-	simg, _ := ociremote.SignedEntity(ref, remoteOpts...) // TODO(mkcp): //nolint:errcheck
+	simg, _ := ociremote.SignedEntity(ref, remoteOpts...) //nolint:errcheck
 	if simg == nil {
 		return nil, nil
 	}
 
 	// Errors are dogsled because these functions always return a name.Tag which we can check for layers
-	sigRef, _ := ociremote.SignatureTag(ref, remoteOpts...)   // TODO(mkcp): //nolint:errcheck
-	attRef, _ := ociremote.AttestationTag(ref, remoteOpts...) // TODO(mkcp): //nolint:errcheck
+	sigRef, _ := ociremote.SignatureTag(ref, remoteOpts...)   //nolint:errcheck
+	attRef, _ := ociremote.AttestationTag(ref, remoteOpts...) //nolint:errcheck
 
 	ss, err := simg.Signatures()
 	if err != nil {
diff --git a/src/test/e2e/20_zarf_init_test.go b/src/test/e2e/20_zarf_init_test.go
index de981f9b13..5f7fd569ec 100644
--- a/src/test/e2e/20_zarf_init_test.go
+++ b/src/test/e2e/20_zarf_init_test.go
@@ -104,8 +104,8 @@ func TestZarfInit(t *testing.T) {
 	verifyZarfServiceLabels(t)
 
 	// Special sizing-hacking for reducing resources where Kind + CI eats a lot of free cycles (ignore errors)
-	_, _, _ = e2e.Kubectl(t, "scale", "deploy", "-n", "kube-system", "coredns", "--replicas=1") // TODO(mkcp): intentionally ignored, mark nolint
-	_, _, _ = e2e.Kubectl(t, "scale", "deploy", "-n", "zarf", "agent-hook", "--replicas=1")     // TODO(mkcp): intentionally ignored, mark nolint
+	_, _, _ = e2e.Kubectl(t, "scale", "deploy", "-n", "kube-system", "coredns", "--replicas=1") //nolint:errcheck
+	_, _, _ = e2e.Kubectl(t, "scale", "deploy", "-n", "zarf", "agent-hook", "--replicas=1")     //nolint:errcheck
 }
 
 func checkLogForSensitiveState(t *testing.T, logText string, zarfState types.ZarfState) {
diff --git a/src/test/e2e/28_wait_test.go b/src/test/e2e/28_wait_test.go
index aeaea654df..2881966863 100644
--- a/src/test/e2e/28_wait_test.go
+++ b/src/test/e2e/28_wait_test.go
@@ -51,7 +51,7 @@ func TestNoWait(t *testing.T) {
 	case <-time.After(30 * time.Second):
 		t.Error("Timeout waiting for zarf deploy (it tried to wait)")
 		t.Log("Removing hanging namespace...")
-		_, _, _ = e2e.Kubectl(t, "delete", "namespace", "no-wait", "--force=true", "--wait=false", "--grace-period=0") // TODO(mkcp): intentionally ignored, mark nolint
+		_, _, _ = e2e.Kubectl(t, "delete", "namespace", "no-wait", "--force=true", "--wait=false", "--grace-period=0") //nolint:errcheck
 	}
 	require.NoError(t, err, stdOut, stdErr)
 
diff --git a/src/test/external/ext_out_cluster_test.go b/src/test/external/ext_out_cluster_test.go
index 2f4fbbfa2a..323bdc57af 100644
--- a/src/test/external/ext_out_cluster_test.go
+++ b/src/test/external/ext_out_cluster_test.go
@@ -57,10 +57,10 @@ func (suite *ExtOutClusterTestSuite) SetupSuite() {
 	// Teardown any leftovers from previous tests
 	// NOTE(mkcp): We dogsled these errors because some of these commands will error if they don't cleanup a resource,
 	//   which is ok. A better solution would be checking for none or unexpected kinds of errors.
-	_ = exec.CmdWithPrint("k3d", "cluster", "delete", clusterName)   // TODO(mkcp): intentionally ignored, mark nolint
-	_ = exec.CmdWithPrint("k3d", "registry", "delete", registryHost) // TODO(mkcp): intentionally ignored, mark nolint
-	_ = exec.CmdWithPrint("docker", "compose", "down")               // TODO(mkcp): intentionally ignored, mark nolint
-	_ = exec.CmdWithPrint("docker", "network", "remove", network)    // TODO(mkcp): intentionally ignored, mark nolint
+	_ = exec.CmdWithPrint("k3d", "cluster", "delete", clusterName)   //nolint:errcheck
+	_ = exec.CmdWithPrint("k3d", "registry", "delete", registryHost) //nolint:errcheck
+	_ = exec.CmdWithPrint("docker", "compose", "down")               //nolint:errcheck
+	_ = exec.CmdWithPrint("docker", "network", "remove", network)    //nolint:errcheck
 
 	// Setup a network for everything to live inside
 	err := exec.CmdWithPrint("docker", "network", "create", "--driver=bridge", "--subnet="+subnet, "--gateway="+gateway, network)