From 19f15a840ccc5117f8729aef32449e2fb331340e Mon Sep 17 00:00:00 2001
From: Dmitriy Matrenichev <dmitry.matrenichev@siderolabs.com>
Date: Thu, 21 Mar 2024 00:33:39 +0300
Subject: [PATCH] chore: bump golangci-lint to 1.57.0

Fix all discovered issues.

Signed-off-by: Dmitriy Matrenichev <dmitry.matrenichev@siderolabs.com>
---
 .golangci.yml                                 | 26 +++++++++----------
 Dockerfile                                    |  1 +
 Makefile                                      |  2 +-
 cmd/installer/pkg/install/manifest.go         |  4 ---
 cmd/talosctl/cmd/mgmt/cluster/create.go       |  6 ++---
 cmd/talosctl/cmd/talos/config_test.go         |  1 -
 cmd/talosctl/cmd/talos/containers.go          | 11 ++++----
 cmd/talosctl/cmd/talos/logs.go                |  2 +-
 cmd/talosctl/cmd/talos/stats.go               | 11 ++++----
 cmd/talosctl/pkg/talos/action/tracker.go      |  2 --
 .../pkg/talos/yamlstrip/yamlstrip_test.go     |  2 --
 hack/cloud-image-uploader/aws.go              |  5 ----
 hack/cloud-image-uploader/azure.go            |  4 +--
 hack/gotagsrewrite/main_test.go               |  2 --
 .../app/apid/pkg/backend/apid_factory_test.go |  2 +-
 internal/app/apid/pkg/backend/apid_test.go    | 22 ++++++++--------
 .../pkg/adapters/kubespan/peer_status_test.go |  2 --
 .../controllers/cluster/affiliate_merge.go    |  2 --
 .../controllers/cluster/discovery_service.go  |  2 --
 .../controllers/cluster/kubernetes_pull.go    |  2 --
 .../pkg/controllers/k8s/kubelet_spec_test.go  |  4 ---
 .../pkg/controllers/k8s/kubelet_static_pod.go |  2 --
 .../machined/pkg/controllers/k8s/manifest.go  |  2 --
 .../pkg/controllers/k8s/node_apply_test.go    |  6 -----
 .../serviceaccount/crd_controller.go          |  2 +-
 .../pkg/controllers/kubespan/manager.go       |  4 ---
 .../pkg/controllers/kubespan/manager_test.go  |  4 ---
 .../pkg/controllers/network/address_config.go |  1 -
 .../pkg/controllers/network/address_merge.go  |  2 --
 .../controllers/network/address_merge_test.go |  4 +--
 .../pkg/controllers/network/address_spec.go   |  2 +-
 .../pkg/controllers/network/address_status.go |  3 ---
 .../pkg/controllers/network/cmdline_test.go   |  2 --
 .../pkg/controllers/network/etcfile_test.go   |  2 --
 .../controllers/network/hostname_config.go    |  1 -
 .../network/internal/probe/probe_test.go      |  4 +--
 .../pkg/controllers/network/link_config.go    |  1 -
 .../pkg/controllers/network/link_merge.go     |  2 --
 .../controllers/network/link_merge_test.go    |  4 +--
 .../pkg/controllers/network/link_spec_test.go | 11 +++++---
 .../pkg/controllers/network/link_status.go    |  2 --
 .../pkg/controllers/network/node_address.go   |  2 --
 .../controllers/network/operator_config.go    |  1 -
 .../pkg/controllers/network/operator_merge.go |  2 --
 .../network/operator_merge_test.go            |  4 +--
 .../pkg/controllers/network/operator_spec.go  | 12 ---------
 .../controllers/network/operator_spec_test.go |  2 +-
 .../network/operator_vip_config.go            |  1 -
 .../controllers/network/platform_config.go    |  2 +-
 .../controllers/network/resolver_config.go    |  1 -
 .../pkg/controllers/network/route_config.go   |  1 -
 .../pkg/controllers/network/route_merge.go    |  2 --
 .../controllers/network/route_merge_test.go   |  4 +--
 .../pkg/controllers/network/route_status.go   |  2 --
 .../controllers/network/timeserver_config.go  |  1 -
 .../controllers/runtime/events_sink_test.go   |  2 +-
 .../runtime/kernel_param_defaults_test.go     |  4 ---
 .../pkg/controllers/runtime/kmsg_log.go       |  2 --
 .../pkg/controllers/runtime/machine_status.go |  2 +-
 .../machined/pkg/runtime/logging/circular.go  |  2 --
 .../pkg/runtime/logging/extract_test.go       |  1 -
 .../v1alpha1/bootloader/grub/quote_test.go    |  4 ---
 .../v1alpha1/platform/metal/url/map_test.go   |  2 --
 .../v1alpha1/platform/metal/url/url_test.go   |  2 --
 .../platform/metal/url/variable_test.go       |  4 ---
 .../v1alpha1/platform/nocloud/nocloud_test.go |  2 --
 .../v1alpha1/platform/vmware/vmware_test.go   |  2 --
 .../runtime/v1alpha1/v1alpha1_controller.go   |  4 ---
 .../runtime/v1alpha1/v1alpha1_events_test.go  | 24 ++++++++---------
 .../v1alpha1/v1alpha1_priority_lock_test.go   |  2 --
 .../v1alpha1/v1alpha1_sequencer_tasks.go      |  2 --
 .../runtime/v1alpha2/v1alpha2_controller.go   |  2 --
 .../machined/pkg/system/events/events_test.go |  4 +--
 .../machined/pkg/system/health/health_test.go |  8 +++---
 .../machined/pkg/system/integration_test.go   |  2 +-
 .../runner/containerd/containerd_test.go      |  6 ++---
 .../pkg/system/runner/process/process_test.go |  2 +-
 .../app/machined/pkg/system/services/etcd.go  |  2 +-
 internal/app/poweroff/poweroff_test.go        |  2 --
 internal/app/trustd/internal/reg/reg_test.go  |  2 --
 internal/integration/api/apid.go              |  4 ---
 internal/integration/api/apply-config.go      |  2 +-
 internal/integration/api/discovery.go         |  2 +-
 internal/integration/api/etcd-recover.go      |  2 --
 internal/integration/api/firewall.go          |  2 --
 internal/integration/api/logs.go              |  4 +--
 internal/integration/api/reset.go             |  2 +-
 internal/integration/api/resources.go         |  2 --
 internal/integration/base/api.go              |  2 +-
 internal/integration/cli/config.go            |  4 ---
 internal/integration/cli/gen.go               |  2 --
 internal/integration/cli/list.go              |  1 -
 internal/integration/cli/logs.go              |  2 +-
 internal/integration/cli/validate.go          |  4 ---
 internal/integration/provision/provision.go   |  4 +--
 .../pkg/containers/image/resolver_test.go     |  4 ---
 internal/pkg/cri/pods.go                      |  4 ---
 internal/pkg/dashboard/components/termui.go   |  4 +--
 internal/pkg/dashboard/dashboard.go           |  3 +--
 .../dashboard/resourcedata/resourcedata.go    |  2 --
 .../pkg/discovery/registry/kubernetes_test.go |  4 ---
 internal/pkg/dns/dns_test.go                  |  4 +--
 internal/pkg/environment/environment_test.go  |  2 --
 internal/pkg/etcd/endpoints.go                |  2 +-
 internal/pkg/extensions/extensions_test.go    |  2 --
 internal/pkg/extensions/validate.go           |  2 +-
 internal/pkg/logind/broker.go                 |  2 +-
 .../internal/adv/syslinux/syslinux_test.go    |  2 +-
 internal/pkg/miniprocfs/processes_test.go     |  8 +++---
 internal/pkg/mount/all.go                     |  2 +-
 internal/pkg/ntp/ntp_test.go                  |  2 +-
 internal/pkg/secureboot/tpm2/pcr_test.go      |  2 --
 internal/pkg/tui/components/formlabel.go      |  3 ++-
 internal/pkg/tui/components/table.go          |  2 +-
 internal/pkg/tui/installer/state.go           |  2 --
 pkg/archiver/walker_test.go                   |  1 -
 pkg/cluster/apply-config.go                   |  6 ++---
 pkg/cluster/sonobuoy/sonobuoy.go              |  2 --
 pkg/download/download_test.go                 |  2 --
 pkg/imager/extensions/rebuild.go              |  2 +-
 pkg/kubeconfig/generate_test.go               |  2 --
 pkg/kubernetes/kubernetes.go                  | 18 ++++++-------
 pkg/machinery/client/config/config.go         |  2 +-
 pkg/machinery/client/config/config_test.go    |  2 --
 pkg/machinery/client/resolver/roundrobin.go   |  2 +-
 pkg/machinery/client/status_test.go           |  2 --
 .../compatibility/talos_version_test.go       |  2 --
 pkg/machinery/config/config_schema_test.go    |  2 --
 .../config/configloader/configloader_test.go  |  3 +--
 .../internal/decoder/decoder_test.go          |  6 +----
 .../internal/decoder/unknown_keys.go          |  2 +-
 .../config/container/container_test.go        |  2 --
 pkg/machinery/config/contract_test.go         |  1 -
 pkg/machinery/config/encoder/documentation.go |  4 +--
 pkg/machinery/config/encoder/encoder.go       |  8 +++---
 pkg/machinery/config/encoder/encoder_test.go  |  2 +-
 .../config/generate/generate_test.go          |  2 --
 .../config/generate/secrets/generate_test.go  |  2 --
 pkg/machinery/config/machine/machine_test.go  |  2 --
 pkg/machinery/config/merge/merge.go           |  2 +-
 .../config/types/network/rule_config_test.go  |  2 --
 .../config/types/runtime/event_sink_test.go   |  2 --
 .../config/types/runtime/kmsg_log_test.go     |  2 --
 .../types/siderolink/siderolink_test.go       |  2 --
 .../types/v1alpha1/v1alpha1_stability_test.go |  2 --
 .../v1alpha1/v1alpha1_validation_test.go      |  4 ---
 .../extensions/services/services_test.go      |  2 --
 pkg/machinery/meta/meta_test.go               |  4 ---
 pkg/machinery/nethelpers/vlan_test.go         |  2 --
 .../resources/cluster/affiliate_test.go       |  2 --
 pkg/machinery/resources/k8s/endpoint.go       |  2 --
 .../resources/network/condition_test.go       |  2 --
 pkg/machinery/resources/network/link_test.go  |  2 --
 pkg/machinery/resources/runtime/condition.go  |  1 -
 .../resources/runtime/condition_test.go       |  2 --
 pkg/provision/providers/vm/dhcpd.go           |  2 --
 pkg/provision/providers/vm/tftpd.go           |  2 --
 pkg/reporter/reporter.go                      |  2 +-
 158 files changed, 141 insertions(+), 380 deletions(-)

diff --git a/.golangci.yml b/.golangci.yml
index 2ff017a9f..26a23ef63 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -15,13 +15,6 @@ run:
   # include test files or not, default is true
   tests: true
 
-  # which files to skip: they will be analyzed, but issues from them
-  # won't be reported. Default value is empty list, but there is
-  # no need to include all autogenerated files, we confidently recognize
-  # autogenerated files. If it's not please let us know.
-  skip-files:
-    - .*\\.pb\\.go$
-
   # list of build tags, all linters use it. Default is empty list.
   build-tags:
     - integration
@@ -33,7 +26,12 @@ run:
 # output configuration options
 output:
   # colored-line-number|line-number|json|tab|checkstyle, default is "colored-line-number"
-  format: line-number
+  formats:
+    - format: line-number
+      path: stdout
+  print-issued-lines: true
+  print-linter-name: true
+  uniq-by-line: true
   sort-results: true
 
 # all available settings of specific linters
@@ -46,12 +44,7 @@ linters-settings:
     # report about assignment of errors to blank identifier: `num, _ := strconv.Atoi(numStr)`;
     # default is false: such cases aren't reported by default.
     check-blank: true
-  govet:
-    # report about shadowed variables
-    check-shadowing: true
-  gofmt:
-    # simplify code: gofmt with `-s` option, true by default
-    simplify: true
+  govet: { }
   gocyclo:
     # minimal code complexity to report, 30 by default (but we recommend 10-20)
     min-complexity: 10
@@ -79,6 +72,8 @@ linters-settings:
     allow-no-explanation: []
     require-explanation: false
     require-specific: true
+  unused:
+    local-variables-are-used: false
   prealloc:
     # XXX: we don't recommend using this linter before doing performance profiling.
     # For most programs usage of prealloc will be a premature optimization.
@@ -166,6 +161,9 @@ issues:
     - ^ST1000 # ST1000: at least one file in a package should have a package comment (stylecheck)
     - parameter '\w+' seems to be unused, consider removing or renaming it as _ # noisy check, especially when the usage is an interface implementation
 
+  exclude-files:
+    - .*\\.pb\\.go$
+
   exclude-rules:
     - path: cmd/talosctl/cmd
       linters:
diff --git a/Dockerfile b/Dockerfile
index 97fa15b4e..318bb9a0c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -938,6 +938,7 @@ FROM base AS lint-go
 COPY .golangci.yml .
 ENV GOGC 50
 ENV GOLANGCI_LINT_CACHE /.cache/lint
+RUN golangci-lint config verify --config .golangci.yml
 RUN --mount=type=cache,target=/.cache golangci-lint run --config .golangci.yml
 WORKDIR /src/pkg/machinery
 RUN --mount=type=cache,target=/.cache golangci-lint run --config ../../.golangci.yml
diff --git a/Makefile b/Makefile
index 578887d48..6d7043023 100644
--- a/Makefile
+++ b/Makefile
@@ -55,7 +55,7 @@ GOIMPORTS_VERSION ?= v0.19.0
 # renovate: datasource=go depName=mvdan.cc/gofumpt
 GOFUMPT_VERSION ?= v0.6.0
 # renovate: datasource=go depName=github.com/golangci/golangci-lint
-GOLANGCILINT_VERSION ?= v1.56.2
+GOLANGCILINT_VERSION ?= v1.57.0
 # renovate: datasource=go depName=golang.org/x/tools
 STRINGER_VERSION ?= v0.19.0
 # renovate: datasource=go depName=github.com/dmarkham/enumer
diff --git a/cmd/installer/pkg/install/manifest.go b/cmd/installer/pkg/install/manifest.go
index 348df170a..5a9eb978f 100644
--- a/cmd/installer/pkg/install/manifest.go
+++ b/cmd/installer/pkg/install/manifest.go
@@ -200,8 +200,6 @@ func (m *Manifest) checkMounts(device Device) error {
 	}
 
 	for _, path := range matches {
-		path := path
-
 		if err = func() error {
 			var f *os.File
 
@@ -390,8 +388,6 @@ func (m *Manifest) executeOnDevice(device Device, targets []*Target) (err error)
 	}
 
 	for _, target := range targets {
-		target := target
-
 		err = retry.Constant(time.Minute, retry.WithUnits(100*time.Millisecond)).Retry(func() error {
 			e := target.Format(m.Printf)
 			if e != nil {
diff --git a/cmd/talosctl/cmd/mgmt/cluster/create.go b/cmd/talosctl/cmd/mgmt/cluster/create.go
index bcca91790..8ad46690e 100644
--- a/cmd/talosctl/cmd/mgmt/cluster/create.go
+++ b/cmd/talosctl/cmd/mgmt/cluster/create.go
@@ -641,7 +641,7 @@ func create(ctx context.Context, flags *pflag.FlagSet) error {
 			endpointList = []string{ips[0][0].String()}
 		default:
 			// use control plane nodes as endpoints, client-side load-balancing
-			for i := 0; i < controlplanes; i++ {
+			for i := range controlplanes {
 				endpointList = append(endpointList, ips[0][i].String())
 			}
 		}
@@ -750,7 +750,7 @@ func create(ctx context.Context, flags *pflag.FlagSet) error {
 	provisionOptions = append(provisionOptions, provision.WithTalosConfig(configBundle.TalosConfig()))
 
 	// Create the controlplane nodes.
-	for i := 0; i < controlplanes; i++ {
+	for i := range controlplanes {
 		var cfg config.Provider
 
 		nodeIPs := make([]netip.Addr, len(cidrs))
@@ -796,7 +796,7 @@ func create(ctx context.Context, flags *pflag.FlagSet) error {
 	}
 
 	// append extra disks
-	for i := 0; i < extraDisks; i++ {
+	for range extraDisks {
 		disks = append(disks, &provision.Disk{
 			Size:            uint64(extraDiskSize) * 1024 * 1024,
 			SkipPreallocate: !clusterDiskPreallocate,
diff --git a/cmd/talosctl/cmd/talos/config_test.go b/cmd/talosctl/cmd/talos/config_test.go
index 7f032f18d..5d41fa41a 100644
--- a/cmd/talosctl/cmd/talos/config_test.go
+++ b/cmd/talosctl/cmd/talos/config_test.go
@@ -90,7 +90,6 @@ Certificate expires: 10 years from now (2031-07-03)
 	}
 
 	for _, tc := range testCases {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/cmd/talosctl/cmd/talos/containers.go b/cmd/talosctl/cmd/talos/containers.go
index cdbe2020e..cb41a1b56 100644
--- a/cmd/talosctl/cmd/talos/containers.go
+++ b/cmd/talosctl/cmd/talos/containers.go
@@ -69,13 +69,12 @@ func containerRender(remotePeer *peer.Peer, resp *machineapi.ContainersResponse)
 	defaultNode := client.AddrFromPeer(remotePeer)
 
 	for _, msg := range resp.Messages {
-		resp := msg
-		sort.Slice(resp.Containers,
+		sort.Slice(msg.Containers,
 			func(i, j int) bool {
-				return strings.Compare(resp.Containers[i].Id, resp.Containers[j].Id) < 0
+				return strings.Compare(msg.Containers[i].Id, msg.Containers[j].Id) < 0
 			})
 
-		for _, p := range resp.Containers {
+		for _, p := range msg.Containers {
 			display := p.Id
 			if p.Id != p.PodId {
 				// container in a sandbox
@@ -84,8 +83,8 @@ func containerRender(remotePeer *peer.Peer, resp *machineapi.ContainersResponse)
 
 			node := defaultNode
 
-			if resp.Metadata != nil {
-				node = resp.Metadata.Hostname
+			if msg.Metadata != nil {
+				node = msg.Metadata.Hostname
 			}
 
 			fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%d\t%s\n", node, p.Namespace, display, p.Image, p.Pid, p.Status)
diff --git a/cmd/talosctl/cmd/talos/logs.go b/cmd/talosctl/cmd/talos/logs.go
index 01c96ed30..79c426a38 100644
--- a/cmd/talosctl/cmd/talos/logs.go
+++ b/cmd/talosctl/cmd/talos/logs.go
@@ -85,7 +85,7 @@ var logsCmd = &cobra.Command{
 					continue
 				}
 
-				node := defaultNode
+				node := defaultNode //nolint:copyloopvar
 				if data.Metadata != nil && data.Metadata.Hostname != "" {
 					node = data.Metadata.Hostname
 				}
diff --git a/cmd/talosctl/cmd/talos/stats.go b/cmd/talosctl/cmd/talos/stats.go
index c5d763388..090cba9b4 100644
--- a/cmd/talosctl/cmd/talos/stats.go
+++ b/cmd/talosctl/cmd/talos/stats.go
@@ -69,13 +69,12 @@ func statsRender(remotePeer *peer.Peer, resp *machineapi.StatsResponse) error {
 	defaultNode := client.AddrFromPeer(remotePeer)
 
 	for _, msg := range resp.Messages {
-		resp := msg
-		sort.Slice(resp.Stats,
+		sort.Slice(msg.Stats,
 			func(i, j int) bool {
-				return strings.Compare(resp.Stats[i].Id, resp.Stats[j].Id) < 0
+				return strings.Compare(msg.Stats[i].Id, msg.Stats[j].Id) < 0
 			})
 
-		for _, s := range resp.Stats {
+		for _, s := range msg.Stats {
 			display := s.Id
 			if s.Id != s.PodId {
 				// container in a sandbox
@@ -84,8 +83,8 @@ func statsRender(remotePeer *peer.Peer, resp *machineapi.StatsResponse) error {
 
 			node := defaultNode
 
-			if resp.Metadata != nil {
-				node = resp.Metadata.Hostname
+			if msg.Metadata != nil {
+				node = msg.Metadata.Hostname
 			}
 
 			fmt.Fprintf(w, "%s\t%s\t%s\t%.2f\t%d\n", node, s.Namespace, display, float64(s.MemoryUsage)*1e-6, s.CpuUsage)
diff --git a/cmd/talosctl/pkg/talos/action/tracker.go b/cmd/talosctl/pkg/talos/action/tracker.go
index fa35933db..ea66fec9f 100644
--- a/cmd/talosctl/pkg/talos/action/tracker.go
+++ b/cmd/talosctl/pkg/talos/action/tracker.go
@@ -163,8 +163,6 @@ func (a *Tracker) Run() error {
 		var trackEg errgroup.Group
 
 		for _, node := range a.cliContext.Nodes {
-			node := node
-
 			var (
 				dmesg *circular.Buffer
 				err   error
diff --git a/cmd/talosctl/pkg/talos/yamlstrip/yamlstrip_test.go b/cmd/talosctl/pkg/talos/yamlstrip/yamlstrip_test.go
index f73f9933e..81b36955e 100644
--- a/cmd/talosctl/pkg/talos/yamlstrip/yamlstrip_test.go
+++ b/cmd/talosctl/pkg/talos/yamlstrip/yamlstrip_test.go
@@ -20,8 +20,6 @@ func TestComments(t *testing.T) {
 	require.NoError(t, err)
 
 	for _, path := range testCases {
-		path := path
-
 		t.Run(filepath.Base(path), func(t *testing.T) {
 			in, err := os.ReadFile(path)
 			require.NoError(t, err)
diff --git a/hack/cloud-image-uploader/aws.go b/hack/cloud-image-uploader/aws.go
index 4dd7a7f63..46d45a880 100644
--- a/hack/cloud-image-uploader/aws.go
+++ b/hack/cloud-image-uploader/aws.go
@@ -89,9 +89,6 @@ func (au *AWSUploader) RegisterAMIs(ctx context.Context) error {
 	g, ctx = errgroup.WithContext(ctx)
 
 	for region, svc := range au.ec2svcs {
-		region := region
-		svc := svc
-
 		g.Go(func() error {
 			err := au.registerAMI(ctx, region, svc)
 			if err != nil {
@@ -147,8 +144,6 @@ func (au *AWSUploader) registerAMI(ctx context.Context, region string, svc *ec2.
 	var g errgroup.Group
 
 	for _, arch := range au.Options.Architectures {
-		arch := arch
-
 		g.Go(func() error {
 			err = au.registerAMIArch(ctx, region, svc, arch, bucketName, uploader)
 			if err != nil {
diff --git a/hack/cloud-image-uploader/azure.go b/hack/cloud-image-uploader/azure.go
index 5593d3bf7..7316c95eb 100644
--- a/hack/cloud-image-uploader/azure.go
+++ b/hack/cloud-image-uploader/azure.go
@@ -102,8 +102,6 @@ func (azu *AzureUploader) AzureGalleryUpload(ctx context.Context) error {
 	log.Printf("azure: uploading blobs for architectures: %+v\n", azu.Options.Architectures)
 
 	for _, arch := range azu.Options.Architectures {
-		arch := arch
-
 		g.Go(func() error {
 			log.Printf("azure: starting upload blob for %s\n", arch)
 
@@ -190,7 +188,7 @@ func (azu *AzureUploader) uploadAzureBlob(ctx context.Context, arch string) erro
 	var g *errgroup.Group
 	g, ctx = errgroup.WithContext(ctx)
 
-	for i := 0; i < concurrency; i++ {
+	for range concurrency {
 		g.Go(func() error {
 			for w := range workCh {
 				_, err = pageBlobClient.UploadPages(
diff --git a/hack/gotagsrewrite/main_test.go b/hack/gotagsrewrite/main_test.go
index 738bba140..912f6841d 100644
--- a/hack/gotagsrewrite/main_test.go
+++ b/hack/gotagsrewrite/main_test.go
@@ -24,8 +24,6 @@ func TestRun(t *testing.T) {
 	}
 
 	for name, test := range tests {
-		test := test
-
 		t.Run(name, func(t *testing.T) {
 			tempDir := t.TempDir()
 
diff --git a/internal/app/apid/pkg/backend/apid_factory_test.go b/internal/app/apid/pkg/backend/apid_factory_test.go
index 13791b3de..ac0b96528 100644
--- a/internal/app/apid/pkg/backend/apid_factory_test.go
+++ b/internal/app/apid/pkg/backend/apid_factory_test.go
@@ -48,7 +48,7 @@ func (suite *APIDFactorySuite) TestGetConcurrent() {
 
 	backendCh := make(chan proxy.Backend, 10)
 
-	for i := 0; i < 10; i++ {
+	for range 10 {
 		wg.Add(1)
 
 		go func() {
diff --git a/internal/app/apid/pkg/backend/apid_test.go b/internal/app/apid/pkg/backend/apid_test.go
index b7821d368..876d109f4 100644
--- a/internal/app/apid/pkg/backend/apid_test.go
+++ b/internal/app/apid/pkg/backend/apid_test.go
@@ -214,11 +214,11 @@ func TestAPIIdiosyncrasies(t *testing.T) {
 		storage.File_storage_storage_proto.Services(),
 		time.File_time_time_proto.Services(),
 	} {
-		for i := 0; i < services.Len(); i++ {
+		for i := range services.Len() {
 			service := services.Get(i)
 			methods := service.Methods()
 
-			for j := 0; j < methods.Len(); j++ {
+			for j := range methods.Len() {
 				method := methods.Get(j)
 
 				t.Run(
@@ -320,7 +320,7 @@ func testEnum(t *testing.T, enum protoreflect.EnumDescriptor, currentVersion *co
 	testDeprecated(t, enum, currentVersion)
 
 	values := enum.Values()
-	for i := 0; i < values.Len(); i++ {
+	for i := range values.Len() {
 		testDeprecated(t, values.Get(i), currentVersion)
 	}
 }
@@ -329,23 +329,23 @@ func testMessage(t *testing.T, message protoreflect.MessageDescriptor, currentVe
 	testDeprecated(t, message, currentVersion)
 
 	fields := message.Fields()
-	for i := 0; i < fields.Len(); i++ {
+	for i := range fields.Len() {
 		testDeprecated(t, fields.Get(i), currentVersion)
 	}
 
 	oneofs := message.Oneofs()
-	for i := 0; i < oneofs.Len(); i++ {
+	for i := range oneofs.Len() {
 		testDeprecated(t, oneofs.Get(i), currentVersion)
 	}
 
 	enums := message.Enums()
-	for i := 0; i < enums.Len(); i++ {
+	for i := range enums.Len() {
 		testEnum(t, enums.Get(i), currentVersion)
 	}
 
 	// test nested messages
 	messages := message.Messages()
-	for i := 0; i < messages.Len(); i++ {
+	for i := range messages.Len() {
 		testMessage(t, messages.Get(i), currentVersion)
 	}
 }
@@ -364,22 +364,22 @@ func TestDeprecatedAPIs(t *testing.T) {
 		time.File_time_time_proto,
 	} {
 		enums := file.Enums()
-		for i := 0; i < enums.Len(); i++ {
+		for i := range enums.Len() {
 			testEnum(t, enums.Get(i), currentVersion)
 		}
 
 		messages := file.Messages()
-		for i := 0; i < messages.Len(); i++ {
+		for i := range messages.Len() {
 			testMessage(t, messages.Get(i), currentVersion)
 		}
 
 		services := file.Services()
-		for i := 0; i < services.Len(); i++ {
+		for i := range services.Len() {
 			service := services.Get(i)
 			testDeprecated(t, service, currentVersion)
 
 			methods := service.Methods()
-			for j := 0; j < methods.Len(); j++ {
+			for j := range methods.Len() {
 				method := methods.Get(j)
 				testDeprecated(t, method, currentVersion)
 
diff --git a/internal/app/machined/pkg/adapters/kubespan/peer_status_test.go b/internal/app/machined/pkg/adapters/kubespan/peer_status_test.go
index c3af399f4..6807e7455 100644
--- a/internal/app/machined/pkg/adapters/kubespan/peer_status_test.go
+++ b/internal/app/machined/pkg/adapters/kubespan/peer_status_test.go
@@ -116,8 +116,6 @@ func TestPeerStatus_CalculateState(t *testing.T) {
 			expectedState:       kubespan.PeerStateUp,
 		},
 	} {
-		tt := tt
-
 		t.Run(tt.name, func(t *testing.T) {
 			peerStatus := kubespan.PeerStatusSpec{
 				LastHandshakeTime:  time.Now().Add(-tt.sinceLastHandshake),
diff --git a/internal/app/machined/pkg/controllers/cluster/affiliate_merge.go b/internal/app/machined/pkg/controllers/cluster/affiliate_merge.go
index ac558f585..8d8f71de5 100644
--- a/internal/app/machined/pkg/controllers/cluster/affiliate_merge.go
+++ b/internal/app/machined/pkg/controllers/cluster/affiliate_merge.go
@@ -78,8 +78,6 @@ func (ctrl *AffiliateMergeController) Run(ctx context.Context, r controller.Runt
 		touchedIDs := make(map[resource.ID]struct{}, len(mergedAffiliates))
 
 		for id, affiliateSpec := range mergedAffiliates {
-			affiliateSpec := affiliateSpec
-
 			if err = safe.WriterModify(ctx, r, cluster.NewAffiliate(cluster.NamespaceName, id), func(res *cluster.Affiliate) error {
 				*res.TypedSpec() = *affiliateSpec
 
diff --git a/internal/app/machined/pkg/controllers/cluster/discovery_service.go b/internal/app/machined/pkg/controllers/cluster/discovery_service.go
index 9177d8fd8..9db2a7ba6 100644
--- a/internal/app/machined/pkg/controllers/cluster/discovery_service.go
+++ b/internal/app/machined/pkg/controllers/cluster/discovery_service.go
@@ -305,8 +305,6 @@ func (ctrl *DiscoveryServiceController) Run(ctx context.Context, r controller.Ru
 		for _, discoveredAffiliate := range client.GetAffiliates() {
 			id := fmt.Sprintf("service/%s", discoveredAffiliate.Affiliate.NodeId)
 
-			discoveredAffiliate := discoveredAffiliate
-
 			if err = safe.WriterModify(ctx, r, cluster.NewAffiliate(cluster.RawNamespaceName, id), func(res *cluster.Affiliate) error {
 				*res.TypedSpec() = specAffiliate(discoveredAffiliate.Affiliate, discoveredAffiliate.Endpoints)
 
diff --git a/internal/app/machined/pkg/controllers/cluster/kubernetes_pull.go b/internal/app/machined/pkg/controllers/cluster/kubernetes_pull.go
index 6a33b1293..2d26f628f 100644
--- a/internal/app/machined/pkg/controllers/cluster/kubernetes_pull.go
+++ b/internal/app/machined/pkg/controllers/cluster/kubernetes_pull.go
@@ -156,8 +156,6 @@ func (ctrl *KubernetesPullController) Run(ctx context.Context, r controller.Runt
 		for _, affilateSpec := range affiliateSpecs {
 			id := fmt.Sprintf("k8s/%s", affilateSpec.NodeID)
 
-			affilateSpec := affilateSpec
-
 			if err = safe.WriterModify(ctx, r, cluster.NewAffiliate(cluster.RawNamespaceName, id), func(res *cluster.Affiliate) error {
 				*res.TypedSpec() = *affilateSpec
 
diff --git a/internal/app/machined/pkg/controllers/k8s/kubelet_spec_test.go b/internal/app/machined/pkg/controllers/k8s/kubelet_spec_test.go
index fec52ed90..304dc14b1 100644
--- a/internal/app/machined/pkg/controllers/k8s/kubelet_spec_test.go
+++ b/internal/app/machined/pkg/controllers/k8s/kubelet_spec_test.go
@@ -303,8 +303,6 @@ func TestNewKubeletConfigurationFail(t *testing.T) {
 			expectedErr: "2 errors occurred:\n\t* field \"authentication\" can't be overridden\n\t* field \"port\" can't be overridden\n\n",
 		},
 	} {
-		tt := tt
-
 		t.Run(
 			tt.name, func(t *testing.T) {
 				t.Parallel()
@@ -460,8 +458,6 @@ func TestNewKubeletConfigurationMerge(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
-
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/internal/app/machined/pkg/controllers/k8s/kubelet_static_pod.go b/internal/app/machined/pkg/controllers/k8s/kubelet_static_pod.go
index d115d5b3e..e75b636fa 100644
--- a/internal/app/machined/pkg/controllers/k8s/kubelet_static_pod.go
+++ b/internal/app/machined/pkg/controllers/k8s/kubelet_static_pod.go
@@ -194,8 +194,6 @@ func (ctrl *KubeletStaticPodController) refreshPodStatus(ctx context.Context, r
 	podsSeen := map[string]struct{}{}
 
 	for _, pod := range podList.Items {
-		pod := pod
-
 		switch pod.Metadata.Annotations.ConfigSource {
 		case "file":
 			// static pod from a file source
diff --git a/internal/app/machined/pkg/controllers/k8s/manifest.go b/internal/app/machined/pkg/controllers/k8s/manifest.go
index 2394ba271..c40a3a5ce 100644
--- a/internal/app/machined/pkg/controllers/k8s/manifest.go
+++ b/internal/app/machined/pkg/controllers/k8s/manifest.go
@@ -107,8 +107,6 @@ func (ctrl *ManifestController) Run(ctx context.Context, r controller.Runtime, l
 		}
 
 		for _, renderedManifest := range renderedManifests {
-			renderedManifest := renderedManifest
-
 			if err = safe.WriterModify(ctx, r, k8s.NewManifest(k8s.ControlPlaneNamespaceName, renderedManifest.name),
 				func(r *k8s.Manifest) error {
 					return k8sadapter.Manifest(r).SetYAML(renderedManifest.data)
diff --git a/internal/app/machined/pkg/controllers/k8s/node_apply_test.go b/internal/app/machined/pkg/controllers/k8s/node_apply_test.go
index 93b212fac..bd749fae0 100644
--- a/internal/app/machined/pkg/controllers/k8s/node_apply_test.go
+++ b/internal/app/machined/pkg/controllers/k8s/node_apply_test.go
@@ -112,8 +112,6 @@ func TestApplyLabels(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
-
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -297,8 +295,6 @@ func TestApplyTaints(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
-
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -395,8 +391,6 @@ func TestApplyCordoned(t *testing.T) {
 			expectedAnnotations:   map[string]string{"foo": "bar"},
 		},
 	} {
-		tt := tt
-
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/internal/app/machined/pkg/controllers/kubeaccess/serviceaccount/crd_controller.go b/internal/app/machined/pkg/controllers/kubeaccess/serviceaccount/crd_controller.go
index 754cc7a2e..0ecd5a406 100644
--- a/internal/app/machined/pkg/controllers/kubeaccess/serviceaccount/crd_controller.go
+++ b/internal/app/machined/pkg/controllers/kubeaccess/serviceaccount/crd_controller.go
@@ -230,7 +230,7 @@ func (t *CRDController) Run(ctx context.Context, workers int) error {
 
 	wg.Add(workers)
 
-	for i := 0; i < workers; i++ {
+	for range workers {
 		go func() {
 			wait.Until(func() { t.runWorker(ctx) }, time.Second, ctx.Done())
 			wg.Done()
diff --git a/internal/app/machined/pkg/controllers/kubespan/manager.go b/internal/app/machined/pkg/controllers/kubespan/manager.go
index 8a7d108eb..b62bd4ec3 100644
--- a/internal/app/machined/pkg/controllers/kubespan/manager.go
+++ b/internal/app/machined/pkg/controllers/kubespan/manager.go
@@ -339,8 +339,6 @@ func (ctrl *ManagerController) Run(ctx context.Context, r controller.Runtime, lo
 
 		// update peer statuses
 		for pubKey, peerStatus := range peerStatuses {
-			peerStatus := peerStatus
-
 			if err = safe.WriterModify(ctx, r,
 				kubespan.NewPeerStatus(
 					kubespan.NamespaceName,
@@ -418,8 +416,6 @@ func (ctrl *ManagerController) Run(ctx context.Context, r controller.Runtime, lo
 				ConfigLayer: network.ConfigOperator,
 			},
 		} {
-			spec := spec
-
 			if err = safe.WriterModify(ctx, r,
 				network.NewRouteSpec(
 					network.ConfigNamespaceName,
diff --git a/internal/app/machined/pkg/controllers/kubespan/manager_test.go b/internal/app/machined/pkg/controllers/kubespan/manager_test.go
index 928d7c9af..6079871dd 100644
--- a/internal/app/machined/pkg/controllers/kubespan/manager_test.go
+++ b/internal/app/machined/pkg/controllers/kubespan/manager_test.go
@@ -219,8 +219,6 @@ func (suite *ManagerSuite) TestReconcile() {
 	)
 
 	for _, peer := range []*kubespan.PeerSpec{peer1, peer2} {
-		peer := peer
-
 		ctest.AssertResource(suite,
 			peer.Metadata().ID(),
 			func(res *kubespan.PeerStatus, asrt *assert.Assertions) {
@@ -326,8 +324,6 @@ func (suite *ManagerSuite) TestReconcile() {
 	)
 
 	for _, peer := range []*kubespan.PeerSpec{peer1, peer2} {
-		peer := peer
-
 		ctest.AssertResource(suite,
 			peer.Metadata().ID(),
 			func(res *kubespan.PeerStatus, asrt *assert.Assertions) {
diff --git a/internal/app/machined/pkg/controllers/network/address_config.go b/internal/app/machined/pkg/controllers/network/address_config.go
index c9819d614..8170e03ca 100644
--- a/internal/app/machined/pkg/controllers/network/address_config.go
+++ b/internal/app/machined/pkg/controllers/network/address_config.go
@@ -160,7 +160,6 @@ func (ctrl *AddressConfigController) apply(ctx context.Context, r controller.Run
 	ids := make([]string, 0, len(addresses))
 
 	for _, address := range addresses {
-		address := address
 		id := network.LayeredID(address.ConfigLayer, network.AddressID(address.LinkName, address.Address))
 
 		if err := r.Modify(
diff --git a/internal/app/machined/pkg/controllers/network/address_merge.go b/internal/app/machined/pkg/controllers/network/address_merge.go
index 3ca1a5200..5d986a085 100644
--- a/internal/app/machined/pkg/controllers/network/address_merge.go
+++ b/internal/app/machined/pkg/controllers/network/address_merge.go
@@ -89,8 +89,6 @@ func (ctrl *AddressMergeController) Run(ctx context.Context, r controller.Runtim
 		conflictsDetected := 0
 
 		for id, address := range addresses {
-			address := address
-
 			if err = r.Modify(ctx, network.NewAddressSpec(network.NamespaceName, id), func(res resource.Resource) error {
 				addr := res.(*network.AddressSpec) //nolint:errcheck,forcetypeassert
 
diff --git a/internal/app/machined/pkg/controllers/network/address_merge_test.go b/internal/app/machined/pkg/controllers/network/address_merge_test.go
index 9ecf6bd7d..2a2450e4b 100644
--- a/internal/app/machined/pkg/controllers/network/address_merge_test.go
+++ b/internal/app/machined/pkg/controllers/network/address_merge_test.go
@@ -189,7 +189,7 @@ func (suite *AddressMergeSuite) TestMergeFlapping() {
 
 	flipflop := func(idx int) func() error {
 		return func() error {
-			for i := 0; i < 500; i++ {
+			for range 500 {
 				if err := suite.state.Create(suite.ctx, resources[idx]); err != nil {
 					return err
 				}
@@ -212,7 +212,7 @@ func (suite *AddressMergeSuite) TestMergeFlapping() {
 	eg.Go(
 		func() error {
 			// add/remove finalizer to the merged resource
-			for i := 0; i < 1000; i++ {
+			for range 1000 {
 				if err := suite.state.AddFinalizer(
 					suite.ctx,
 					resource.NewMetadata(
diff --git a/internal/app/machined/pkg/controllers/network/address_spec.go b/internal/app/machined/pkg/controllers/network/address_spec.go
index 7379ef5ac..7bfcde82e 100644
--- a/internal/app/machined/pkg/controllers/network/address_spec.go
+++ b/internal/app/machined/pkg/controllers/network/address_spec.go
@@ -302,7 +302,7 @@ func broadcastAddr(addr netip.Prefix) net.IP {
 
 	out := make(net.IP, n)
 
-	for i := 0; i < n; i++ {
+	for i := range n {
 		out[i] = ip[i] | ^mask[i]
 	}
 
diff --git a/internal/app/machined/pkg/controllers/network/address_status.go b/internal/app/machined/pkg/controllers/network/address_status.go
index ea7945162..478076fb7 100644
--- a/internal/app/machined/pkg/controllers/network/address_status.go
+++ b/internal/app/machined/pkg/controllers/network/address_status.go
@@ -88,15 +88,12 @@ func (ctrl *AddressStatusController) Run(ctx context.Context, r controller.Runti
 		}
 
 		for _, addr := range addrs {
-			addr := addr
-
 			// TODO: should we use local address actually?
 			// from if_addr.h:
 			// IFA_ADDRESS is prefix address, rather than local interface address.
 			// * It makes no difference for normally configured broadcast interfaces,
 			// * but for point-to-point IFA_ADDRESS is DESTINATION address,
 			// * local address is supplied in IFA_LOCAL attribute.
-
 			ipAddr, _ := netip.AddrFromSlice(addr.Attributes.Address)
 			ipPrefix := netip.PrefixFrom(ipAddr, int(addr.PrefixLength))
 			id := network.AddressID(linkLookup[addr.Index], ipPrefix)
diff --git a/internal/app/machined/pkg/controllers/network/cmdline_test.go b/internal/app/machined/pkg/controllers/network/cmdline_test.go
index fd2164409..4a922e6a3 100644
--- a/internal/app/machined/pkg/controllers/network/cmdline_test.go
+++ b/internal/app/machined/pkg/controllers/network/cmdline_test.go
@@ -472,8 +472,6 @@ func (suite *CmdlineSuite) TestParse() {
 			},
 		},
 	} {
-		test := test
-
 		suite.Run(test.name, func() {
 			cmdline := procfs.NewCmdline(test.cmdline)
 
diff --git a/internal/app/machined/pkg/controllers/network/etcfile_test.go b/internal/app/machined/pkg/controllers/network/etcfile_test.go
index 3ae97f0cb..fb9117efd 100644
--- a/internal/app/machined/pkg/controllers/network/etcfile_test.go
+++ b/internal/app/machined/pkg/controllers/network/etcfile_test.go
@@ -210,8 +210,6 @@ func (suite *EtcFileConfigSuite) testFiles(resources []resource.Resource, conten
 	)
 
 	for _, id := range unexpectedIDs {
-		id := id
-
 		assertNoResource[*files.EtcFileSpec](suite.ctx, suite.T(), suite.state, id)
 	}
 }
diff --git a/internal/app/machined/pkg/controllers/network/hostname_config.go b/internal/app/machined/pkg/controllers/network/hostname_config.go
index 56b63e178..c757ec41a 100644
--- a/internal/app/machined/pkg/controllers/network/hostname_config.go
+++ b/internal/app/machined/pkg/controllers/network/hostname_config.go
@@ -181,7 +181,6 @@ func (ctrl *HostnameConfigController) apply(ctx context.Context, r controller.Ru
 	ids := make([]string, 0, len(specs))
 
 	for _, spec := range specs {
-		spec := spec
 		id := network.LayeredID(spec.ConfigLayer, network.HostnameID)
 
 		if err := r.Modify(
diff --git a/internal/app/machined/pkg/controllers/network/internal/probe/probe_test.go b/internal/app/machined/pkg/controllers/network/internal/probe/probe_test.go
index fa6756869..701dcdfaa 100644
--- a/internal/app/machined/pkg/controllers/network/internal/probe/probe_test.go
+++ b/internal/app/machined/pkg/controllers/network/internal/probe/probe_test.go
@@ -52,7 +52,7 @@ func TestProbeHTTP(t *testing.T) {
 	t.Cleanup(p.Stop)
 
 	// probe should always succeed
-	for i := 0; i < 3; i++ {
+	for range 3 {
 		assert.Equal(t, probe.Notification{
 			ID: "test",
 			Status: network.ProbeStatusSpec{
@@ -124,7 +124,7 @@ func TestProbeConsecutiveFailures(t *testing.T) {
 	// stop the test server, probe should fail
 	server.Close()
 
-	for i := 0; i < p.Spec.FailureThreshold-1; i++ {
+	for range p.Spec.FailureThreshold - 1 {
 		// probe should fail, but no notification should be sent yet (failure threshold not reached)
 		mockClock.Add(p.Spec.Interval)
 
diff --git a/internal/app/machined/pkg/controllers/network/link_config.go b/internal/app/machined/pkg/controllers/network/link_config.go
index 175551ee6..7ac402567 100644
--- a/internal/app/machined/pkg/controllers/network/link_config.go
+++ b/internal/app/machined/pkg/controllers/network/link_config.go
@@ -234,7 +234,6 @@ func (ctrl *LinkConfigController) apply(ctx context.Context, r controller.Runtim
 	ids := make([]string, 0, len(links))
 
 	for _, link := range links {
-		link := link
 		id := network.LayeredID(link.ConfigLayer, network.LinkID(link.Name))
 
 		if err := r.Modify(
diff --git a/internal/app/machined/pkg/controllers/network/link_merge.go b/internal/app/machined/pkg/controllers/network/link_merge.go
index 14acf120d..0b0d1adaf 100644
--- a/internal/app/machined/pkg/controllers/network/link_merge.go
+++ b/internal/app/machined/pkg/controllers/network/link_merge.go
@@ -103,8 +103,6 @@ func (ctrl *LinkMergeController) Run(ctx context.Context, r controller.Runtime,
 		conflictsDetected := 0
 
 		for id, link := range links {
-			link := link
-
 			if err = r.Modify(ctx, network.NewLinkSpec(network.NamespaceName, id), func(res resource.Resource) error {
 				l := res.(*network.LinkSpec) //nolint:errcheck,forcetypeassert
 
diff --git a/internal/app/machined/pkg/controllers/network/link_merge_test.go b/internal/app/machined/pkg/controllers/network/link_merge_test.go
index 46e52ebbe..77265c6e3 100644
--- a/internal/app/machined/pkg/controllers/network/link_merge_test.go
+++ b/internal/app/machined/pkg/controllers/network/link_merge_test.go
@@ -213,7 +213,7 @@ func (suite *LinkMergeSuite) TestMergeFlapping() {
 
 	flipflop := func(idx int) func() error {
 		return func() error {
-			for i := 0; i < 500; i++ {
+			for range 500 {
 				if err := suite.state.Create(suite.ctx, resources[idx]); err != nil {
 					return err
 				}
@@ -236,7 +236,7 @@ func (suite *LinkMergeSuite) TestMergeFlapping() {
 	eg.Go(
 		func() error {
 			// add/remove finalizer to the merged resource
-			for i := 0; i < 1000; i++ {
+			for range 1000 {
 				if err := suite.state.AddFinalizer(
 					suite.ctx,
 					resource.NewMetadata(
diff --git a/internal/app/machined/pkg/controllers/network/link_spec_test.go b/internal/app/machined/pkg/controllers/network/link_spec_test.go
index 91f3ff175..af8aac3c4 100644
--- a/internal/app/machined/pkg/controllers/network/link_spec_test.go
+++ b/internal/app/machined/pkg/controllers/network/link_spec_test.go
@@ -537,10 +537,13 @@ func (suite *LinkSpecSuite) TestBond8023ad() {
 	}
 	networkadapter.BondMasterSpec(&bond.TypedSpec().BondMaster).FillDefaults()
 
-	dummies := []resource.Resource{}
-	dummyNames := []string{}
+	//nolint:prealloc
+	var (
+		dummies    []resource.Resource
+		dummyNames []string
+	)
 
-	for i := 0; i < 4; i++ {
+	for range 4 {
 		dummyName := suite.uniqueDummyInterface()
 		dummy := network.NewLinkSpec(network.NamespaceName, dummyName)
 		*dummy.TypedSpec() = network.LinkSpecSpec{
@@ -944,7 +947,7 @@ func TestSortBonds(t *testing.T) {
 	seed := time.Now().Unix()
 	rnd := rand.New(rand.NewSource(seed))
 
-	for i := 0; i < 100; i++ {
+	for i := range 100 {
 		res := toResources(expectedSlice)
 		rnd.Shuffle(len(res), func(i, j int) { res[i], res[j] = res[j], res[i] })
 		netctrl.SortBonds(res)
diff --git a/internal/app/machined/pkg/controllers/network/link_status.go b/internal/app/machined/pkg/controllers/network/link_status.go
index a0998b6f4..40d9cc3bb 100644
--- a/internal/app/machined/pkg/controllers/network/link_status.go
+++ b/internal/app/machined/pkg/controllers/network/link_status.go
@@ -160,8 +160,6 @@ func (ctrl *LinkStatusController) reconcile(
 
 	// for every rtnetlink discovered link
 	for _, link := range links {
-		link := link
-
 		var (
 			ethState      *ethtool.LinkState
 			ethInfo       *ethtool.LinkInfo
diff --git a/internal/app/machined/pkg/controllers/network/node_address.go b/internal/app/machined/pkg/controllers/network/node_address.go
index 38b829621..a37f7afeb 100644
--- a/internal/app/machined/pkg/controllers/network/node_address.go
+++ b/internal/app/machined/pkg/controllers/network/node_address.go
@@ -318,8 +318,6 @@ func updateAccumulativeAddresses(ctx context.Context, r controller.Runtime, id r
 		spec := r.(*network.NodeAddress).TypedSpec()
 
 		for _, ip := range accumulative {
-			ip := ip
-
 			// find insert position using binary search
 			i := sort.Search(len(spec.Addresses), func(j int) bool {
 				return !spec.Addresses[j].Addr().Less(ip.Addr())
diff --git a/internal/app/machined/pkg/controllers/network/operator_config.go b/internal/app/machined/pkg/controllers/network/operator_config.go
index a2b2f4c44..03546801f 100644
--- a/internal/app/machined/pkg/controllers/network/operator_config.go
+++ b/internal/app/machined/pkg/controllers/network/operator_config.go
@@ -301,7 +301,6 @@ func (ctrl *OperatorConfigController) apply(ctx context.Context, r controller.Ru
 	ids := make([]string, 0, len(specs))
 
 	for _, spec := range specs {
-		spec := spec
 		id := network.LayeredID(spec.ConfigLayer, network.OperatorID(spec.Operator, spec.LinkName))
 
 		if err := r.Modify(
diff --git a/internal/app/machined/pkg/controllers/network/operator_merge.go b/internal/app/machined/pkg/controllers/network/operator_merge.go
index 61bfcd6c7..1df70e425 100644
--- a/internal/app/machined/pkg/controllers/network/operator_merge.go
+++ b/internal/app/machined/pkg/controllers/network/operator_merge.go
@@ -89,8 +89,6 @@ func (ctrl *OperatorMergeController) Run(ctx context.Context, r controller.Runti
 		conflictsDetected := 0
 
 		for id, operator := range operators {
-			operator := operator
-
 			if err = r.Modify(ctx, network.NewOperatorSpec(network.NamespaceName, id), func(res resource.Resource) error {
 				op := res.(*network.OperatorSpec) //nolint:errcheck,forcetypeassert
 
diff --git a/internal/app/machined/pkg/controllers/network/operator_merge_test.go b/internal/app/machined/pkg/controllers/network/operator_merge_test.go
index 0d5c48609..66db5c485 100644
--- a/internal/app/machined/pkg/controllers/network/operator_merge_test.go
+++ b/internal/app/machined/pkg/controllers/network/operator_merge_test.go
@@ -212,7 +212,7 @@ func (suite *OperatorMergeSuite) TestMergeFlapping() {
 
 	flipflop := func(idx int) func() error {
 		return func() error {
-			for i := 0; i < 500; i++ {
+			for range 500 {
 				if err := suite.state.Create(suite.ctx, resources[idx]); err != nil {
 					return err
 				}
@@ -235,7 +235,7 @@ func (suite *OperatorMergeSuite) TestMergeFlapping() {
 	eg.Go(
 		func() error {
 			// add/remove finalizer to the merged resource
-			for i := 0; i < 1000; i++ {
+			for range 1000 {
 				if err := suite.state.AddFinalizer(
 					suite.ctx,
 					resource.NewMetadata(
diff --git a/internal/app/machined/pkg/controllers/network/operator_spec.go b/internal/app/machined/pkg/controllers/network/operator_spec.go
index 8c5de6384..d897973d9 100644
--- a/internal/app/machined/pkg/controllers/network/operator_spec.go
+++ b/internal/app/machined/pkg/controllers/network/operator_spec.go
@@ -281,8 +281,6 @@ func (ctrl *OperatorSpecController) reconcileOperatorOutputs(ctx context.Context
 
 	for _, op := range ctrl.operators {
 		for _, addressSpec := range op.Operator.AddressSpecs() {
-			addressSpec := addressSpec
-
 			if err := apply(
 				network.NewAddressSpec(
 					network.ConfigNamespaceName,
@@ -297,8 +295,6 @@ func (ctrl *OperatorSpecController) reconcileOperatorOutputs(ctx context.Context
 		}
 
 		for _, routeSpec := range op.Operator.RouteSpecs() {
-			routeSpec := routeSpec
-
 			if err := apply(
 				network.NewRouteSpec(
 					network.ConfigNamespaceName,
@@ -316,8 +312,6 @@ func (ctrl *OperatorSpecController) reconcileOperatorOutputs(ctx context.Context
 		}
 
 		for _, linkSpec := range op.Operator.LinkSpecs() {
-			linkSpec := linkSpec
-
 			if err := apply(
 				network.NewLinkSpec(
 					network.ConfigNamespaceName,
@@ -332,8 +326,6 @@ func (ctrl *OperatorSpecController) reconcileOperatorOutputs(ctx context.Context
 		}
 
 		for _, hostnameSpec := range op.Operator.HostnameSpecs() {
-			hostnameSpec := hostnameSpec
-
 			if err := apply(
 				network.NewHostnameSpec(
 					network.ConfigNamespaceName,
@@ -348,8 +340,6 @@ func (ctrl *OperatorSpecController) reconcileOperatorOutputs(ctx context.Context
 		}
 
 		for _, resolverSpec := range op.Operator.ResolverSpecs() {
-			resolverSpec := resolverSpec
-
 			if err := apply(
 				network.NewResolverSpec(
 					network.ConfigNamespaceName,
@@ -364,8 +354,6 @@ func (ctrl *OperatorSpecController) reconcileOperatorOutputs(ctx context.Context
 		}
 
 		for _, timeserverSpec := range op.Operator.TimeServerSpecs() {
-			timeserverSpec := timeserverSpec
-
 			if err := apply(
 				network.NewTimeServerSpec(
 					network.ConfigNamespaceName,
diff --git a/internal/app/machined/pkg/controllers/network/operator_spec_test.go b/internal/app/machined/pkg/controllers/network/operator_spec_test.go
index dc250f990..76fec8098 100644
--- a/internal/app/machined/pkg/controllers/network/operator_spec_test.go
+++ b/internal/app/machined/pkg/controllers/network/operator_spec_test.go
@@ -198,7 +198,7 @@ func (suite *OperatorSpecSuite) assertRunning(runningIDs []string, assertFunc fu
 	}
 
 	for id := range runningOperators {
-		found := false
+		found := false //nolint:copyloopvar
 
 		for _, expectedID := range runningIDs {
 			if expectedID == id {
diff --git a/internal/app/machined/pkg/controllers/network/operator_vip_config.go b/internal/app/machined/pkg/controllers/network/operator_vip_config.go
index 5ab1a9484..f392adc16 100644
--- a/internal/app/machined/pkg/controllers/network/operator_vip_config.go
+++ b/internal/app/machined/pkg/controllers/network/operator_vip_config.go
@@ -174,7 +174,6 @@ func (ctrl *OperatorVIPConfigController) apply(ctx context.Context, r controller
 	ids := make([]string, 0, len(specs))
 
 	for _, spec := range specs {
-		spec := spec
 		id := network.LayeredID(spec.ConfigLayer, network.OperatorID(spec.Operator, spec.LinkName))
 
 		if err := r.Modify(
diff --git a/internal/app/machined/pkg/controllers/network/platform_config.go b/internal/app/machined/pkg/controllers/network/platform_config.go
index 9cb8d0374..ba29913d3 100644
--- a/internal/app/machined/pkg/controllers/network/platform_config.go
+++ b/internal/app/machined/pkg/controllers/network/platform_config.go
@@ -485,7 +485,7 @@ func (ctrl *PlatformConfigController) apply(ctx context.Context, r controller.Ru
 		resourceNamespace := resourceEmpty.Metadata().Namespace()
 		resourceType := resourceEmpty.Metadata().Type()
 
-		for i := 0; i < specType.length; i++ {
+		for i := range specType.length {
 			spec := specType.getter(i)
 
 			id, err := specType.idBuilder(spec)
diff --git a/internal/app/machined/pkg/controllers/network/resolver_config.go b/internal/app/machined/pkg/controllers/network/resolver_config.go
index a65c51811..5528bfa75 100644
--- a/internal/app/machined/pkg/controllers/network/resolver_config.go
+++ b/internal/app/machined/pkg/controllers/network/resolver_config.go
@@ -138,7 +138,6 @@ func (ctrl *ResolverConfigController) apply(ctx context.Context, r controller.Ru
 	ids := make([]string, 0, len(specs))
 
 	for _, spec := range specs {
-		spec := spec
 		id := network.LayeredID(spec.ConfigLayer, network.ResolverID)
 
 		if err := r.Modify(
diff --git a/internal/app/machined/pkg/controllers/network/route_config.go b/internal/app/machined/pkg/controllers/network/route_config.go
index 18e2c8602..b819a71dc 100644
--- a/internal/app/machined/pkg/controllers/network/route_config.go
+++ b/internal/app/machined/pkg/controllers/network/route_config.go
@@ -154,7 +154,6 @@ func (ctrl *RouteConfigController) apply(ctx context.Context, r controller.Runti
 	ids := make([]string, 0, len(routes))
 
 	for _, route := range routes {
-		route := route
 		id := network.LayeredID(route.ConfigLayer, network.RouteID(route.Table, route.Family, route.Destination, route.Gateway, route.Priority, route.OutLinkName))
 
 		if err := r.Modify(
diff --git a/internal/app/machined/pkg/controllers/network/route_merge.go b/internal/app/machined/pkg/controllers/network/route_merge.go
index 13095666f..8a054fbbc 100644
--- a/internal/app/machined/pkg/controllers/network/route_merge.go
+++ b/internal/app/machined/pkg/controllers/network/route_merge.go
@@ -87,8 +87,6 @@ func (ctrl *RouteMergeController) Run(ctx context.Context, r controller.Runtime,
 		conflictsDetected := 0
 
 		for id, route := range routes {
-			route := route
-
 			if err = r.Modify(ctx, network.NewRouteSpec(network.NamespaceName, id), func(res resource.Resource) error {
 				rt := res.(*network.RouteSpec) //nolint:errcheck,forcetypeassert
 
diff --git a/internal/app/machined/pkg/controllers/network/route_merge_test.go b/internal/app/machined/pkg/controllers/network/route_merge_test.go
index cca5fb876..bc6a63054 100644
--- a/internal/app/machined/pkg/controllers/network/route_merge_test.go
+++ b/internal/app/machined/pkg/controllers/network/route_merge_test.go
@@ -255,7 +255,7 @@ func (suite *RouteMergeSuite) TestMergeFlapping() {
 
 	flipflop := func(idx int) func() error {
 		return func() error {
-			for i := 0; i < 500; i++ {
+			for range 500 {
 				if err := suite.state.Create(suite.ctx, resources[idx]); err != nil {
 					return err
 				}
@@ -278,7 +278,7 @@ func (suite *RouteMergeSuite) TestMergeFlapping() {
 	eg.Go(
 		func() error {
 			// add/remove finalizer to the merged resource
-			for i := 0; i < 1000; i++ {
+			for range 1000 {
 				if err := suite.state.AddFinalizer(
 					suite.ctx,
 					resource.NewMetadata(
diff --git a/internal/app/machined/pkg/controllers/network/route_status.go b/internal/app/machined/pkg/controllers/network/route_status.go
index a8920057f..9167bca29 100644
--- a/internal/app/machined/pkg/controllers/network/route_status.go
+++ b/internal/app/machined/pkg/controllers/network/route_status.go
@@ -98,8 +98,6 @@ func (ctrl *RouteStatusController) Run(ctx context.Context, r controller.Runtime
 		}
 
 		for _, route := range routes {
-			route := route
-
 			dstAddr, _ := netip.AddrFromSlice(route.Attributes.Dst)
 			dstPrefix := netip.PrefixFrom(dstAddr, int(route.DstLength))
 			srcAddr, _ := netip.AddrFromSlice(route.Attributes.Src)
diff --git a/internal/app/machined/pkg/controllers/network/timeserver_config.go b/internal/app/machined/pkg/controllers/network/timeserver_config.go
index 769549c34..de4258561 100644
--- a/internal/app/machined/pkg/controllers/network/timeserver_config.go
+++ b/internal/app/machined/pkg/controllers/network/timeserver_config.go
@@ -138,7 +138,6 @@ func (ctrl *TimeServerConfigController) apply(ctx context.Context, r controller.
 	ids := make([]string, 0, len(specs))
 
 	for _, spec := range specs {
-		spec := spec
 		id := network.LayeredID(spec.ConfigLayer, network.TimeServerID)
 
 		if err := r.Modify(
diff --git a/internal/app/machined/pkg/controllers/runtime/events_sink_test.go b/internal/app/machined/pkg/controllers/runtime/events_sink_test.go
index 34ba6d468..d95df021f 100644
--- a/internal/app/machined/pkg/controllers/runtime/events_sink_test.go
+++ b/internal/app/machined/pkg/controllers/runtime/events_sink_test.go
@@ -206,7 +206,7 @@ func (suite *EventsSinkSuite) TestDrain() {
 	ctx, cancel := context.WithCancel(suite.ctx)
 	defer cancel()
 
-	for i := 0; i < 10; i++ {
+	for range 10 {
 		suite.events.Publish(
 			ctx,
 			&machine.PhaseEvent{
diff --git a/internal/app/machined/pkg/controllers/runtime/kernel_param_defaults_test.go b/internal/app/machined/pkg/controllers/runtime/kernel_param_defaults_test.go
index 9e4f52fd6..2471e9f45 100644
--- a/internal/app/machined/pkg/controllers/runtime/kernel_param_defaults_test.go
+++ b/internal/app/machined/pkg/controllers/runtime/kernel_param_defaults_test.go
@@ -77,8 +77,6 @@ func (suite *KernelParamDefaultsSuite) TestContainerMode() {
 	suite.startRuntime()
 
 	for _, prop := range getParams(runtime.ModeContainer) {
-		prop := prop
-
 		suite.Assert().NoError(retry.Constant(10*time.Second, retry.WithUnits(100*time.Millisecond)).Retry(
 			suite.assertResource(
 				resource.NewMetadata(runtimeresource.NamespaceName, runtimeresource.KernelParamDefaultSpecType, prop.Key, resource.VersionUndefined),
@@ -101,8 +99,6 @@ func (suite *KernelParamDefaultsSuite) TestMetalMode() {
 	suite.startRuntime()
 
 	for _, prop := range getParams(runtime.ModeMetal) {
-		prop := prop
-
 		suite.Assert().NoError(retry.Constant(10*time.Second, retry.WithUnits(100*time.Millisecond)).Retry(
 			suite.assertResource(
 				resource.NewMetadata(runtimeresource.NamespaceName, runtimeresource.KernelParamDefaultSpecType, prop.Key, resource.VersionUndefined),
diff --git a/internal/app/machined/pkg/controllers/runtime/kmsg_log.go b/internal/app/machined/pkg/controllers/runtime/kmsg_log.go
index 4eb35a0c7..59faad8f8 100644
--- a/internal/app/machined/pkg/controllers/runtime/kmsg_log.go
+++ b/internal/app/machined/pkg/controllers/runtime/kmsg_log.go
@@ -196,8 +196,6 @@ func (ctrl *KmsgLogDeliveryController) resend(ctx context.Context, r controller.
 		sendErrors := make(chan error, len(senders))
 
 		for _, sender := range senders {
-			sender := sender
-
 			go func() {
 				sendErrors <- sender.Send(sendCtx, e)
 			}()
diff --git a/internal/app/machined/pkg/controllers/runtime/machine_status.go b/internal/app/machined/pkg/controllers/runtime/machine_status.go
index 2dfb3fca7..0bb482818 100644
--- a/internal/app/machined/pkg/controllers/runtime/machine_status.go
+++ b/internal/app/machined/pkg/controllers/runtime/machine_status.go
@@ -400,7 +400,7 @@ func (ctrl *MachineStatusController) watchEvents() {
 		)
 
 		for ev := range eventCh {
-			newStage := oldStage
+			newStage := oldStage //nolint:copyloopvar
 
 			switch event := ev.Event.Payload.(type) {
 			case *machineapi.SequenceEvent:
diff --git a/internal/app/machined/pkg/runtime/logging/circular.go b/internal/app/machined/pkg/runtime/logging/circular.go
index 9c1be57d3..1ee64e34b 100644
--- a/internal/app/machined/pkg/runtime/logging/circular.go
+++ b/internal/app/machined/pkg/runtime/logging/circular.go
@@ -257,8 +257,6 @@ func (handler *circularHandler) resend(e *runtime.LogEvent) {
 		sendErrors := make(chan error, len(senders))
 
 		for _, sender := range senders {
-			sender := sender
-
 			go func() {
 				sendErrors <- sender.Send(sendCtx, e)
 			}()
diff --git a/internal/app/machined/pkg/runtime/logging/extract_test.go b/internal/app/machined/pkg/runtime/logging/extract_test.go
index acef58077..7b4363773 100644
--- a/internal/app/machined/pkg/runtime/logging/extract_test.go
+++ b/internal/app/machined/pkg/runtime/logging/extract_test.go
@@ -94,7 +94,6 @@ func TestParseLogLine(t *testing.T) {
 			},
 		},
 	} {
-		name, tc := name, tc
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/quote_test.go b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/quote_test.go
index 77b786313..f9a647b2a 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/quote_test.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/quote_test.go
@@ -45,8 +45,6 @@ func TestQuote(t *testing.T) {
 			expected: "http://my-host/config.yaml?uuid=\\$\\{uuid\\}\\&serial=\\$\\{serial\\}\\&mac=\\$\\{mac\\}\\&hostname=\\$\\{hostname\\}",
 		},
 	} {
-		test := test
-
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -94,8 +92,6 @@ func TestUnquote(t *testing.T) {
 			expected: "http://my-host/config.yaml?uuid=${uuid}&serial=${serial}&mac=${mac}&hostname=${hostname}",
 		},
 	} {
-		test := test
-
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/platform/metal/url/map_test.go b/internal/app/machined/pkg/runtime/v1alpha1/platform/metal/url/map_test.go
index 9c95106aa..5bb93725e 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/platform/metal/url/map_test.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/platform/metal/url/map_test.go
@@ -70,8 +70,6 @@ func TestMapValues(t *testing.T) {
 			},
 		},
 	} {
-		test := test
-
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/platform/metal/url/url_test.go b/internal/app/machined/pkg/runtime/v1alpha1/platform/metal/url/url_test.go
index 4e3cdc4d2..be8f884fa 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/platform/metal/url/url_test.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/platform/metal/url/url_test.go
@@ -88,8 +88,6 @@ func TestPopulate(t *testing.T) {
 			},
 		},
 	} {
-		test := test
-
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/platform/metal/url/variable_test.go b/internal/app/machined/pkg/runtime/v1alpha1/platform/metal/url/variable_test.go
index dcf79a5b5..9c7e59e83 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/platform/metal/url/variable_test.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/platform/metal/url/variable_test.go
@@ -59,8 +59,6 @@ func TestVariableMatches(t *testing.T) {
 			},
 		},
 	} {
-		test := test
-
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -138,8 +136,6 @@ func TestVariableReplace(t *testing.T) {
 			expected: "https://example.com?a=value1",
 		},
 	} {
-		test := test
-
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/platform/nocloud/nocloud_test.go b/internal/app/machined/pkg/runtime/v1alpha1/platform/nocloud/nocloud_test.go
index 8a9b68253..956942817 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/platform/nocloud/nocloud_test.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/platform/nocloud/nocloud_test.go
@@ -51,8 +51,6 @@ func TestParseMetadata(t *testing.T) {
 			expected: expectedNetworkConfigV2,
 		},
 	} {
-		tt := tt
-
 		t.Run(tt.name, func(t *testing.T) {
 			n := &nocloud.Nocloud{}
 
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/platform/vmware/vmware_test.go b/internal/app/machined/pkg/runtime/v1alpha1/platform/vmware/vmware_test.go
index 6627ba1fd..7722e4da8 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/platform/vmware/vmware_test.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/platform/vmware/vmware_test.go
@@ -52,8 +52,6 @@ func TestApplyNetworkConfigV2a(t *testing.T) {
 			expected: expectedNetworkConfigMatchByName,
 		},
 	} {
-		tt := tt
-
 		t.Run(tt.name, func(t *testing.T) {
 			ctx := context.Background()
 			st := state.WrapCore(namespaced.NewState(inmem.Build))
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_controller.go b/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_controller.go
index f02164731..7dba09cba 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_controller.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_controller.go
@@ -303,12 +303,8 @@ func (c *Controller) runPhase(ctx context.Context, phase runtime.Phase, seq runt
 
 	for number, task := range phase.Tasks {
 		// Make the task number human friendly.
-		number := number
-
 		number++
 
-		task := task
-
 		eg.Go(func() error {
 			progress := fmt.Sprintf("%d/%d", number, len(phase.Tasks))
 
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_events_test.go b/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_events_test.go
index 4ce2413fd..5c960133d 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_events_test.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_events_test.go
@@ -76,13 +76,13 @@ func TestEvents_Publish(t *testing.T) {
 
 			got := uint32(0)
 
-			for i := 0; i < tt.watchers; i++ {
+			for range tt.watchers {
 				if err := e.Watch(func(events <-chan runtime.EventInfo) {
 					defer wg.Done()
 
 					l := rate.NewLimiter(500, tt.cap*8/10)
 
-					for j := 0; j < tt.messages; j++ {
+					for j := range tt.messages {
 						event, ok := <-events
 
 						if !ok {
@@ -110,7 +110,7 @@ func TestEvents_Publish(t *testing.T) {
 
 			l := rate.NewLimiter(500, tt.cap/2)
 
-			for i := 0; i < tt.messages; i++ {
+			for i := range tt.messages {
 				_ = l.Wait(context.Background()) //nolint:errcheck
 
 				e.Publish(context.Background(), &machine.SequenceEvent{
@@ -135,7 +135,7 @@ func receive(t *testing.T, e runtime.Watcher, n int, opts ...runtime.WatchOption
 	if err := e.Watch(func(events <-chan runtime.EventInfo) {
 		defer wg.Done()
 
-		for j := 0; j < n; j++ {
+		for range n {
 			event, ok := <-events
 			if !ok {
 				t.Fatalf("Watch: chanel closed")
@@ -186,7 +186,7 @@ func gen(k, l int) (result []int) {
 func TestEvents_WatchOptionsTailEvents(t *testing.T) {
 	e := NewEvents(100, 10)
 
-	for i := 0; i < 200; i++ {
+	for i := range 200 {
 		e.Publish(context.Background(), &machine.SequenceEvent{
 			Sequence: strconv.Itoa(i),
 		})
@@ -203,7 +203,7 @@ func TestEvents_WatchOptionsTailEvents(t *testing.T) {
 
 	e = NewEvents(100, 10)
 
-	for i := 0; i < 30; i++ {
+	for i := range 30 {
 		e.Publish(context.Background(), &machine.SequenceEvent{
 			Sequence: strconv.Itoa(i),
 		})
@@ -219,7 +219,7 @@ func TestEvents_WatchOptionsTailEvents(t *testing.T) {
 func TestEvents_WatchOptionsTailSeconds(t *testing.T) {
 	e := NewEvents(100, 10)
 
-	for i := 0; i < 20; i++ {
+	for i := range 20 {
 		e.Publish(context.Background(), &machine.SequenceEvent{
 			Sequence: strconv.Itoa(i),
 		})
@@ -242,7 +242,7 @@ func TestEvents_WatchOptionsTailSeconds(t *testing.T) {
 func TestEvents_WatchOptionsTailID(t *testing.T) {
 	e := NewEvents(100, 10)
 
-	for i := 0; i < 20; i++ {
+	for i := range 20 {
 		e.Publish(context.Background(), &machine.SequenceEvent{
 			Sequence: strconv.Itoa(i),
 		})
@@ -262,7 +262,7 @@ func BenchmarkWatch(b *testing.B) {
 
 	wg.Add(b.N)
 
-	for i := 0; i < b.N; i++ {
+	for range b.N {
 		_ = e.Watch(func(events <-chan runtime.EventInfo) { wg.Done() }) //nolint:errcheck
 	}
 
@@ -280,11 +280,11 @@ func BenchmarkPublish(bb *testing.B) {
 
 			wg.Add(watchers)
 
-			for j := 0; j < watchers; j++ {
+			for range watchers {
 				_ = e.Watch(func(events <-chan runtime.EventInfo) { //nolint:errcheck
 					defer wg.Done()
 
-					for i := 0; i < b.N; i++ {
+					for range b.N {
 						if _, ok := <-events; !ok {
 							return
 						}
@@ -296,7 +296,7 @@ func BenchmarkPublish(bb *testing.B) {
 
 			b.ResetTimer()
 
-			for i := 0; i < b.N; i++ {
+			for range b.N {
 				e.Publish(context.Background(), &ev)
 			}
 
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_priority_lock_test.go b/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_priority_lock_test.go
index 0a3a69232..3e223880b 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_priority_lock_test.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_priority_lock_test.go
@@ -102,8 +102,6 @@ func TestPriorityLockConcurrent(t *testing.T) {
 	sequenceCh := make(chan testSequenceNumber)
 
 	for seq := testSequenceNumber(1); seq <= 20; seq++ {
-		seq := seq
-
 		eg.Go(func() error {
 			ctx, err := lock.Lock(globalCtx, time.Second, seq)
 			if errors.Is(err, runtime.ErrLocked) {
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_sequencer_tasks.go b/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_sequencer_tasks.go
index 25de0d19e..cb28018ed 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_sequencer_tasks.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_sequencer_tasks.go
@@ -849,8 +849,6 @@ func partitionAndFormatDisks(logger *log.Logger, r runtime.Runtime) error {
 	}
 
 	for _, disk := range r.Config().Machine().Disks() {
-		disk := disk
-
 		if err := func() error {
 			bd, err := blockdevice.Open(disk.Device(), blockdevice.WithMode(blockdevice.ReadonlyMode))
 			if err != nil {
diff --git a/internal/app/machined/pkg/runtime/v1alpha2/v1alpha2_controller.go b/internal/app/machined/pkg/runtime/v1alpha2/v1alpha2_controller.go
index 88e6ea005..a6772e8ec 100644
--- a/internal/app/machined/pkg/runtime/v1alpha2/v1alpha2_controller.go
+++ b/internal/app/machined/pkg/runtime/v1alpha2/v1alpha2_controller.go
@@ -449,8 +449,6 @@ func (ctrl *Controller) updateLoggingConfig(ctx context.Context, dests []talosco
 	var wg sync.WaitGroup
 
 	for _, sender := range prevSenders {
-		sender := sender
-
 		wg.Add(1)
 
 		go func() {
diff --git a/internal/app/machined/pkg/system/events/events_test.go b/internal/app/machined/pkg/system/events/events_test.go
index c7846b8b8..2414db08a 100644
--- a/internal/app/machined/pkg/system/events/events_test.go
+++ b/internal/app/machined/pkg/system/events/events_test.go
@@ -32,7 +32,7 @@ func (suite *EventsSuite) TestEmpty() {
 func (suite *EventsSuite) TestSome() {
 	var e events.ServiceEvents
 
-	for i := 0; i < 5; i++ {
+	for i := range 5 {
 		e.Push(events.ServiceEvent{
 			Message: strconv.Itoa(i),
 		})
@@ -56,7 +56,7 @@ func (suite *EventsSuite) TestOverflow() {
 
 	numEvents := events.MaxEventsToKeep*2 + 3
 
-	for i := 0; i < numEvents; i++ {
+	for i := range numEvents {
 		e.Push(events.ServiceEvent{
 			Message: strconv.Itoa(i),
 		})
diff --git a/internal/app/machined/pkg/system/health/health_test.go b/internal/app/machined/pkg/system/health/health_test.go
index fb625471d..0bb920137 100644
--- a/internal/app/machined/pkg/system/health/health_test.go
+++ b/internal/app/machined/pkg/system/health/health_test.go
@@ -45,7 +45,7 @@ func (suite *CheckSuite) TestHealthy() {
 		errCh <- health.Run(ctx, &settings, &state, check)
 	}()
 
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(10 * time.Millisecond)
 
 		if atomic.LoadUint32(&called) > 2 {
@@ -94,7 +94,7 @@ func (suite *CheckSuite) TestHealthChange() {
 	}()
 
 	// wait for the first health change
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		if state.Get().Healthy != nil {
 			break
 		}
@@ -107,7 +107,7 @@ func (suite *CheckSuite) TestHealthChange() {
 
 	atomic.StoreUint32(&healthy, 1)
 
-	for i := 0; i < 10; i++ {
+	for range 10 {
 		time.Sleep(20 * time.Millisecond)
 
 		if *state.Get().Healthy {
@@ -162,7 +162,7 @@ func (suite *CheckSuite) TestCheckAbort() {
 	}()
 
 	// wait for the first health change
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		if state.Get().Healthy != nil {
 			break
 		}
diff --git a/internal/app/machined/pkg/system/integration_test.go b/internal/app/machined/pkg/system/integration_test.go
index e98e397f5..073174a6b 100644
--- a/internal/app/machined/pkg/system/integration_test.go
+++ b/internal/app/machined/pkg/system/integration_test.go
@@ -83,7 +83,7 @@ func TestRestartService(t *testing.T) {
 
 	services.Load(TestService{})
 
-	for i := 0; i < 100; i++ {
+	for range 100 {
 		require.NoError(t, services.Start("test-service"))
 
 		require.NoError(t, system.WaitForServiceWithInstance(services, system.StateEventUp, "test-service").Wait(ctx))
diff --git a/internal/app/machined/pkg/system/runner/containerd/containerd_test.go b/internal/app/machined/pkg/system/runner/containerd/containerd_test.go
index 1d1aa3dd6..297ee5e3d 100644
--- a/internal/app/machined/pkg/system/runner/containerd/containerd_test.go
+++ b/internal/app/machined/pkg/system/runner/containerd/containerd_test.go
@@ -197,7 +197,7 @@ func (suite *ContainerdSuite) TestRunTwice() {
 
 	// running same container twice should be fine
 	// (checks that containerd state is cleaned up properly)
-	for i := 0; i < 2; i++ {
+	for i := range 2 {
 		suite.Assert().NoError(r.Run(MockEventSink))
 		// calling stop when Run has finished is no-op
 		suite.Assert().NoError(r.Stop())
@@ -310,7 +310,7 @@ func (suite *ContainerdSuite) TestStopFailingAndRestarting() {
 		done <- r.Run(MockEventSink)
 	}()
 
-	for i := 0; i < 10; i++ {
+	for range 10 {
 		time.Sleep(500 * time.Millisecond)
 
 		if bytes.Contains(suite.getLogContents(suite.containerID+".log"), []byte("fail\n")) {
@@ -330,7 +330,7 @@ func (suite *ContainerdSuite) TestStopFailingAndRestarting() {
 	suite.Assert().NoError(err)
 	suite.Assert().NoError(f.Close())
 
-	for i := 0; i < 10; i++ {
+	for range 10 {
 		time.Sleep(500 * time.Millisecond)
 
 		if bytes.Contains(suite.getLogContents(suite.containerID+".log"), []byte("ok\n")) {
diff --git a/internal/app/machined/pkg/system/runner/process/process_test.go b/internal/app/machined/pkg/system/runner/process/process_test.go
index f8f18980e..5394647c2 100644
--- a/internal/app/machined/pkg/system/runner/process/process_test.go
+++ b/internal/app/machined/pkg/system/runner/process/process_test.go
@@ -129,7 +129,7 @@ func (suite *ProcessSuite) TestRunRestartFailed() {
 		return logContents
 	}
 
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(100 * time.Millisecond)
 
 		if len(fetchLog()) > 20 {
diff --git a/internal/app/machined/pkg/system/services/etcd.go b/internal/app/machined/pkg/system/services/etcd.go
index 3888cf543..adf943759 100644
--- a/internal/app/machined/pkg/system/services/etcd.go
+++ b/internal/app/machined/pkg/system/services/etcd.go
@@ -598,7 +598,7 @@ func promoteMember(ctx context.Context, r runtime.Runtime, memberID uint64) erro
 		}
 
 		// try to iterate all available endpoints in the time available for an attempt
-		for i := 0; i < len(endpoints); i++ {
+		for range len(endpoints) {
 			select {
 			case <-ctx.Done():
 				return retry.ExpectedError(ctx.Err())
diff --git a/internal/app/poweroff/poweroff_test.go b/internal/app/poweroff/poweroff_test.go
index 5cc906cfe..86e5b6e7f 100644
--- a/internal/app/poweroff/poweroff_test.go
+++ b/internal/app/poweroff/poweroff_test.go
@@ -91,8 +91,6 @@ func TestParseArgs(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
-
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/internal/app/trustd/internal/reg/reg_test.go b/internal/app/trustd/internal/reg/reg_test.go
index d3c97a5ff..d06b1f1c5 100644
--- a/internal/app/trustd/internal/reg/reg_test.go
+++ b/internal/app/trustd/internal/reg/reg_test.go
@@ -74,8 +74,6 @@ func TestCertificate(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
-
 		t.Run(tt.name, func(t *testing.T) {
 			serverCSR, serverCert, err := x509.NewEd25519CSRAndIdentity(tt.csrSetters...)
 			require.NoError(t, err)
diff --git a/internal/integration/api/apid.go b/internal/integration/api/apid.go
index 974430570..1ad88b43a 100644
--- a/internal/integration/api/apid.go
+++ b/internal/integration/api/apid.go
@@ -59,8 +59,6 @@ func (suite *ApidSuite) TestControlPlaneRouting() {
 	nodes := suite.DiscoverNodeInternalIPs(suite.ctx)
 
 	for _, endpoint := range endpoints {
-		endpoint := endpoint
-
 		suite.Run(endpoint, func() {
 			cli, err := client.New(suite.ctx,
 				client.WithConfig(suite.Talosconfig),
@@ -112,8 +110,6 @@ func (suite *ApidSuite) TestWorkerNoRouting() {
 	}
 
 	for _, endpoint := range endpoints {
-		endpoint := endpoint
-
 		suite.Run(endpoint, func() {
 			cli, err := client.New(suite.ctx,
 				client.WithConfig(suite.Talosconfig),
diff --git a/internal/integration/api/apply-config.go b/internal/integration/api/apply-config.go
index 33b52ac8c..49140e131 100644
--- a/internal/integration/api/apply-config.go
+++ b/internal/integration/api/apply-config.go
@@ -483,7 +483,7 @@ func (suite *ApplyConfigSuite) TestApplyTry() {
 
 	suite.Assert().Truef(lookupDummyInterface(), "dummy interface wasn't found")
 
-	for i := 0; i < 100; i++ {
+	for range 100 {
 		provider, err = getMachineConfig(nodeCtx)
 		suite.Assert().Nilf(err, "failed to read existing config from node %q: %s", node, err)
 
diff --git a/internal/integration/api/discovery.go b/internal/integration/api/discovery.go
index 9e080ede4..91554d959 100644
--- a/internal/integration/api/discovery.go
+++ b/internal/integration/api/discovery.go
@@ -198,7 +198,7 @@ func (suite *DiscoverySuite) TestRegistries() {
 
 		var rawAffiliates []*cluster.Affiliate
 
-		for i := 0; i < 30; i++ {
+		for range 30 {
 			rawAffiliates = suite.getAffiliates(nodeCtx, cluster.RawNamespaceName)
 
 			if len(rawAffiliates) == expectedRawAffiliates {
diff --git a/internal/integration/api/etcd-recover.go b/internal/integration/api/etcd-recover.go
index 27741138d..14c5203cf 100644
--- a/internal/integration/api/etcd-recover.go
+++ b/internal/integration/api/etcd-recover.go
@@ -99,8 +99,6 @@ func (suite *EtcdRecoverSuite) TestSnapshotRecover() {
 	errCh := make(chan error)
 
 	for _, node := range controlPlaneNodes {
-		node := node
-
 		go func() {
 			errCh <- func() error {
 				nodeCtx := client.WithNodes(suite.ctx, node)
diff --git a/internal/integration/api/firewall.go b/internal/integration/api/firewall.go
index 60132fce7..fb59252c2 100644
--- a/internal/integration/api/firewall.go
+++ b/internal/integration/api/firewall.go
@@ -74,8 +74,6 @@ func (suite *FirewallSuite) TestKubeletAccess() {
 	}
 
 	for _, node := range allNodes {
-		node := node
-
 		eg.Go(func() error {
 			attemptCtx, cancel := context.WithTimeout(ctx, time.Second)
 			defer cancel()
diff --git a/internal/integration/api/logs.go b/internal/integration/api/logs.go
index 92a63f503..d26b14ee1 100644
--- a/internal/integration/api/logs.go
+++ b/internal/integration/api/logs.go
@@ -86,7 +86,7 @@ func (suite *LogsSuite) TestServicesHaveLogs() {
 func (suite *LogsSuite) TestTail() {
 	// invoke machined enough times to generate
 	// some logs
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		_, err := suite.Client.Version(suite.nodeCtx)
 		suite.Require().NoError(err)
 	}
@@ -160,7 +160,7 @@ func (suite *LogsSuite) testStreaming(tailLines int32) {
 	if tailLines >= 0 {
 		// invoke machined enough times to generate
 		// some logs
-		for i := int32(0); i < tailLines; i++ {
+		for range tailLines {
 			_, err := suite.Client.Stats(
 				suite.nodeCtx,
 				constants.SystemContainerdNamespace,
diff --git a/internal/integration/api/reset.go b/internal/integration/api/reset.go
index 30b6ad513..67ba67f48 100644
--- a/internal/integration/api/reset.go
+++ b/internal/integration/api/reset.go
@@ -256,7 +256,7 @@ func (suite *ResetSuite) TestResetDuringBoot() {
 
 	suite.T().Log("Resetting node", node)
 
-	for i := 0; i < 2; i++ {
+	for range 2 {
 		bootID := suite.ReadBootIDWithRetry(nodeCtx, time.Minute*5)
 
 		err := retry.Constant(5*time.Minute, retry.WithUnits(time.Millisecond*1000)).Retry(
diff --git a/internal/integration/api/resources.go b/internal/integration/api/resources.go
index 331d212bf..7cb6723f8 100644
--- a/internal/integration/api/resources.go
+++ b/internal/integration/api/resources.go
@@ -74,8 +74,6 @@ func (suite *ResourcesSuite) TestListResources() {
 	eg, egCtx := errgroup.WithContext(ctx)
 
 	for _, resourceType := range resourceTypes {
-		resourceType := resourceType
-
 		eg.Go(func() error {
 			for _, namespace := range namespaces {
 				_, err := suite.Client.COSI.List(egCtx, resource.NewMetadata(namespace, resourceType, "", resource.VersionUndefined))
diff --git a/internal/integration/base/api.go b/internal/integration/base/api.go
index d39072f17..da33c79c3 100644
--- a/internal/integration/base/api.go
+++ b/internal/integration/base/api.go
@@ -392,7 +392,7 @@ func (apiSuite *APISuite) ClearConnectionRefused(ctx context.Context, nodes ...s
 	}
 
 	apiSuite.Require().NoError(retry.Constant(backoff.DefaultConfig.MaxDelay, retry.WithUnits(time.Second)).Retry(func() error {
-		for i := 0; i < numMasterNodes; i++ {
+		for range numMasterNodes {
 			_, err := apiSuite.Client.Version(client.WithNodes(ctx, nodes...))
 			if err == nil {
 				continue
diff --git a/internal/integration/cli/config.go b/internal/integration/cli/config.go
index 12363216a..c71a9da52 100644
--- a/internal/integration/cli/config.go
+++ b/internal/integration/cli/config.go
@@ -171,7 +171,6 @@ func (suite *TalosconfigSuite) TestNew() {
 			opts: []base.RunOption{base.StdoutShouldMatch(regexp.MustCompile(`hosts`))},
 		},
 	} {
-		tt := tt
 		name := strings.Join(tt.args, "_")
 		suite.Run(name, func() {
 			suite.T().Parallel()
@@ -229,7 +228,6 @@ func (suite *TalosconfigSuite) TestNew() {
 			},
 		},
 	} {
-		tt := tt
 		name := strings.Join(tt.args, "_")
 		suite.Run(name, func() {
 			suite.T().Parallel()
@@ -266,7 +264,6 @@ func (suite *TalosconfigSuite) TestNew() {
 			},
 		},
 	} {
-		tt := tt
 		name := strings.Join(tt.args, "_")
 		suite.Run(name, func() {
 			suite.T().Parallel()
@@ -313,7 +310,6 @@ func (suite *TalosconfigSuite) TestNew() {
 			},
 		},
 	} {
-		tt := tt
 		name := strings.Join(tt.args, "_")
 		suite.Run(name, func() {
 			suite.T().Parallel()
diff --git a/internal/integration/cli/gen.go b/internal/integration/cli/gen.go
index 8a1efe23b..e999b0763 100644
--- a/internal/integration/cli/gen.go
+++ b/internal/integration/cli/gen.go
@@ -183,8 +183,6 @@ func (suite *GenSuite) testGenConfigPatch(patch []byte) {
 			},
 		},
 	} {
-		tt := tt
-
 		suite.Run(tt.flag, func() {
 			suite.RunCLI([]string{"gen", "config", "--force", "foo", "https://192.168.0.1:6443", "--" + tt.flag, string(patch)},
 				base.StdoutEmpty(),
diff --git a/internal/integration/cli/list.go b/internal/integration/cli/list.go
index 655fce1b8..fd8c3a646 100644
--- a/internal/integration/cli/list.go
+++ b/internal/integration/cli/list.go
@@ -95,7 +95,6 @@ func (suite *ListSuite) TestDepth() {
 
 		{separators: 5, flags: []string{"--recurse=true"}},
 	} {
-		test := test
 		suite.Run(strings.Join(test.flags, ","), func() {
 			suite.T().Parallel()
 			runAndCheck(suite.T(), test.separators, test.flags...)
diff --git a/internal/integration/cli/logs.go b/internal/integration/cli/logs.go
index 8eb82689d..2a474a3b6 100644
--- a/internal/integration/cli/logs.go
+++ b/internal/integration/cli/logs.go
@@ -34,7 +34,7 @@ func (suite *LogsSuite) TestTailLogs() {
 	node := suite.RandomDiscoveredNodeInternalIP()
 
 	// run some machined API calls to produce enough log lines
-	for i := 0; i < 10; i++ {
+	for range 10 {
 		suite.RunCLI([]string{"-n", node, "version"})
 	}
 
diff --git a/internal/integration/cli/validate.go b/internal/integration/cli/validate.go
index a5da66041..77ed19a9c 100644
--- a/internal/integration/cli/validate.go
+++ b/internal/integration/cli/validate.go
@@ -52,11 +52,7 @@ func (suite *ValidateSuite) TestValidate() {
 	)
 
 	for _, configFile := range []string{"controlplane.yaml", "worker.yaml"} {
-		configFile := configFile
-
 		for _, mode := range []string{"cloud", "container"} {
-			mode := mode
-
 			suite.Run(fmt.Sprintf("%s-%s", configFile, mode), func() {
 				suite.RunCLI([]string{"validate", "-m", mode, "-c", configFile, "--strict"})
 			})
diff --git a/internal/integration/provision/provision.go b/internal/integration/provision/provision.go
index 5230399da..d28264120 100644
--- a/internal/integration/provision/provision.go
+++ b/internal/integration/provision/provision.go
@@ -179,7 +179,7 @@ func (suite *BaseSuite) waitForClusterHealth() {
 		runs = 3
 	}
 
-	for run := 0; run < runs; run++ {
+	for run := range runs {
 		if run > 0 {
 			time.Sleep(15 * time.Second)
 		}
@@ -570,7 +570,7 @@ func (suite *BaseSuite) setupCluster(options clusterOptions) {
 	)
 	suite.Require().NoError(err)
 
-	for i := 0; i < options.ControlplaneNodes; i++ {
+	for i := range options.ControlplaneNodes {
 		request.Nodes = append(
 			request.Nodes,
 			provision.NodeRequest{
diff --git a/internal/pkg/containers/image/resolver_test.go b/internal/pkg/containers/image/resolver_test.go
index d3b682c54..66544c2e4 100644
--- a/internal/pkg/containers/image/resolver_test.go
+++ b/internal/pkg/containers/image/resolver_test.go
@@ -157,12 +157,8 @@ func (suite *ResolverSuite) TestRegistryEndpoints() {
 			},
 		},
 	} {
-		tt := tt
-
 		suite.Run(tt.name, func() {
 			for _, req := range tt.requests {
-				req := req
-
 				suite.Run(req.host, func() {
 					endpoints, overridePath, err := image.RegistryEndpoints(tt.config, req.host)
 
diff --git a/internal/pkg/cri/pods.go b/internal/pkg/cri/pods.go
index 398f09f64..4aa81614b 100644
--- a/internal/pkg/cri/pods.go
+++ b/internal/pkg/cri/pods.go
@@ -108,8 +108,6 @@ func (c *Client) StopAndRemovePodSandboxes(ctx context.Context, stopAction StopA
 	var g errgroup.Group
 
 	for _, pod := range pods {
-		pod := pod // https://golang.org/doc/faq#closures_and_goroutines
-
 		g.Go(func() error {
 			status, _, e := c.PodSandboxStatus(ctx, pod.GetId())
 			if e != nil {
@@ -177,8 +175,6 @@ func stopAndRemove(ctx context.Context, stopAction StopAction, client *Client, p
 	var g errgroup.Group
 
 	for _, container := range containers {
-		container := container // https://golang.org/doc/faq#closures_and_goroutines
-
 		g.Go(func() error {
 			// TODO(andrewrynhard): Can we set the timeout dynamically?
 			if container.State == runtimeapi.ContainerState_CONTAINER_RUNNING || container.State == runtimeapi.ContainerState_CONTAINER_UNKNOWN {
diff --git a/internal/pkg/dashboard/components/termui.go b/internal/pkg/dashboard/components/termui.go
index a35077a7e..9ce545c8f 100644
--- a/internal/pkg/dashboard/components/termui.go
+++ b/internal/pkg/dashboard/components/termui.go
@@ -39,8 +39,8 @@ func (w *TermUIWrapper) Draw(screen tcell.Screen) {
 	buf := termui.NewBuffer(w.termUIDrawable.GetRect())
 	w.termUIDrawable.Draw(buf)
 
-	for i := 0; i < width; i++ {
-		for j := 0; j < height; j++ {
+	for i := range width {
+		for j := range height {
 			cell := buf.GetCell(image.Point{X: i, Y: j})
 
 			style := w.convertStyle(cell.Style)
diff --git a/internal/pkg/dashboard/dashboard.go b/internal/pkg/dashboard/dashboard.go
index 94d776d20..13af827cf 100644
--- a/internal/pkg/dashboard/dashboard.go
+++ b/internal/pkg/dashboard/dashboard.go
@@ -469,9 +469,8 @@ func (d *Dashboard) processLog(node, line string) {
 
 func (d *Dashboard) selectScreen(screen Screen) {
 	for _, info := range d.screenConfigs {
-		info := info
 		if info.screen == screen {
-			d.selectedScreenConfig = &info
+			d.selectedScreenConfig = &info //nolint:exportloopref
 
 			d.mainGrid.AddItem(info.primitive, 1, 0, 1, 1, 0, 0, false)
 
diff --git a/internal/pkg/dashboard/resourcedata/resourcedata.go b/internal/pkg/dashboard/resourcedata/resourcedata.go
index 64d3ff40f..6075b7048 100644
--- a/internal/pkg/dashboard/resourcedata/resourcedata.go
+++ b/internal/pkg/dashboard/resourcedata/resourcedata.go
@@ -72,8 +72,6 @@ func (source *Source) run(ctx context.Context) {
 
 	nodes := source.nodes(ctx)
 	for _, node := range nodes {
-		node := node
-
 		source.eg.Go(func() error {
 			source.runResourceWatchWithRetries(ctx, node)
 
diff --git a/internal/pkg/discovery/registry/kubernetes_test.go b/internal/pkg/discovery/registry/kubernetes_test.go
index 3f37cd3de..765601dbe 100644
--- a/internal/pkg/discovery/registry/kubernetes_test.go
+++ b/internal/pkg/discovery/registry/kubernetes_test.go
@@ -84,8 +84,6 @@ func TestAnnotationsFromAffiliate(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
-
 		t.Run(tt.name, func(t *testing.T) {
 			affiliate := cluster.NewAffiliate(cluster.NamespaceName, tt.affiliate.NodeID)
 			*affiliate.TypedSpec() = tt.affiliate
@@ -197,8 +195,6 @@ func TestAffiliateFromNode(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
-
 		t.Run(tt.name, func(t *testing.T) {
 			assert.Equal(t, tt.expected, registry.AffiliateFromNode(&tt.node))
 		})
diff --git a/internal/pkg/dns/dns_test.go b/internal/pkg/dns/dns_test.go
index afbbd11ff..547405703 100644
--- a/internal/pkg/dns/dns_test.go
+++ b/internal/pkg/dns/dns_test.go
@@ -163,7 +163,7 @@ func TestRunnerStopsBeforeRun(t *testing.T) {
 	// Ensure that we correctly handle an error inside [dns.Runner.Run].
 	l := zap.NewNop()
 
-	for i := 0; i < 1000; i++ {
+	for range 1000 {
 		runner := dns.NewRunner(&runnerStopper{}, l)
 
 		ctx := ctxutil.MonitorFn(context.Background(), runner.Run)
@@ -172,7 +172,7 @@ func TestRunnerStopsBeforeRun(t *testing.T) {
 		<-ctx.Done()
 	}
 
-	for i := 0; i < 1000; i++ {
+	for range 1000 {
 		runner := dns.NewRunner(&runnerStopper{}, l)
 
 		runner.Stop()
diff --git a/internal/pkg/environment/environment_test.go b/internal/pkg/environment/environment_test.go
index 35500f814..bae151ce1 100644
--- a/internal/pkg/environment/environment_test.go
+++ b/internal/pkg/environment/environment_test.go
@@ -59,8 +59,6 @@ func TestGet(t *testing.T) {
 			},
 		},
 	} {
-		test := test
-
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/internal/pkg/etcd/endpoints.go b/internal/pkg/etcd/endpoints.go
index 745e31148..da2f56449 100644
--- a/internal/pkg/etcd/endpoints.go
+++ b/internal/pkg/etcd/endpoints.go
@@ -42,7 +42,7 @@ func GetEndpoints(ctx context.Context, resources state.State) ([]string, error)
 	endpoints := endpointAddrs.Strings()
 
 	// Etcd expects host:port format.
-	for i := 0; i < len(endpoints); i++ {
+	for i := range len(endpoints) {
 		endpoints[i] = nethelpers.JoinHostPort(endpoints[i], constants.EtcdClientPort)
 	}
 
diff --git a/internal/pkg/extensions/extensions_test.go b/internal/pkg/extensions/extensions_test.go
index df4583465..50468abc7 100644
--- a/internal/pkg/extensions/extensions_test.go
+++ b/internal/pkg/extensions/extensions_test.go
@@ -81,8 +81,6 @@ func TestValidateFailures(t *testing.T) {
 			validateError: "path \"/boot/vmlinuz\" is not allowed in extensions",
 		},
 	} {
-		tt := tt
-
 		t.Run(tt.name, func(t *testing.T) {
 			ext, err := extensions.Load(filepath.Join("testdata/bad", tt.name))
 
diff --git a/internal/pkg/extensions/validate.go b/internal/pkg/extensions/validate.go
index ed5e56966..a9097b87d 100644
--- a/internal/pkg/extensions/validate.go
+++ b/internal/pkg/extensions/validate.go
@@ -50,7 +50,7 @@ func (ext *Extension) validateConstraints() error {
 
 // trim removes 'v' symbol anywhere in string if it's located before the number.
 func trim(constraint string) string {
-	for i := 0; i < len(constraint); i++ {
+	for i := 0; i < len(constraint); i++ { //nolint:intrange
 		if constraint[i] == 'v' && i+1 < len(constraint) && constraint[i+1] >= '0' && constraint[i+1] <= '9' {
 			constraint = constraint[:i] + constraint[i+1:]
 		}
diff --git a/internal/pkg/logind/broker.go b/internal/pkg/logind/broker.go
index 1f7e1ac1e..cdda60480 100644
--- a/internal/pkg/logind/broker.go
+++ b/internal/pkg/logind/broker.go
@@ -169,7 +169,7 @@ func handleConn(ctx context.Context, conn *net.UnixConn, mu *sync.Mutex, ours, t
 		// find the other side of the connection
 		var w net.Conn
 
-		for i := 0; i < 10; i++ {
+		for range 10 {
 			mu.Lock()
 			w = *theirs
 			mu.Unlock()
diff --git a/internal/pkg/meta/internal/adv/syslinux/syslinux_test.go b/internal/pkg/meta/internal/adv/syslinux/syslinux_test.go
index 19754b3e2..93d77af92 100644
--- a/internal/pkg/meta/internal/adv/syslinux/syslinux_test.go
+++ b/internal/pkg/meta/internal/adv/syslinux/syslinux_test.go
@@ -357,7 +357,7 @@ func TestADV_overwrite(t *testing.T) {
 		t.Errorf("NewADV() failed: %s", err)
 	}
 
-	for i := 0; i < 1024; i++ {
+	for range 1024 {
 		if !a.SetTag(1, "yes") {
 			t.Errorf("SetTag() failed")
 		}
diff --git a/internal/pkg/miniprocfs/processes_test.go b/internal/pkg/miniprocfs/processes_test.go
index ca07c874c..a54224abc 100644
--- a/internal/pkg/miniprocfs/processes_test.go
+++ b/internal/pkg/miniprocfs/processes_test.go
@@ -87,8 +87,8 @@ func TestMock(t *testing.T) {
 func BenchmarkPrometheusProcfs(b *testing.B) {
 	b.ReportAllocs()
 
-	for i := 0; i < b.N; i++ {
-		resp := []*machine.ProcessInfo{}
+	for range b.N {
+		var resp []*machine.ProcessInfo
 
 		procs, err := procfs.AllProcs()
 		require.NoError(b, err)
@@ -135,8 +135,8 @@ func BenchmarkPrometheusProcfs(b *testing.B) {
 func BenchmarkProcesses(b *testing.B) {
 	b.ReportAllocs()
 
-	for i := 0; i < b.N; i++ {
-		resp := []*machine.ProcessInfo{}
+	for range b.N {
+		var resp []*machine.ProcessInfo
 
 		processes, err := miniprocfs.NewProcesses()
 		require.NoError(b, err)
diff --git a/internal/pkg/mount/all.go b/internal/pkg/mount/all.go
index 29cde9afa..e006c19e5 100644
--- a/internal/pkg/mount/all.go
+++ b/internal/pkg/mount/all.go
@@ -41,7 +41,7 @@ func UnmountAll() error {
 	ticker := time.NewTicker(time.Second)
 	defer ticker.Stop()
 
-	for i := 0; i < timeout; i++ {
+	for range timeout {
 		mounts, err := readMountInfo()
 		if err != nil {
 			return err
diff --git a/internal/pkg/ntp/ntp_test.go b/internal/pkg/ntp/ntp_test.go
index 6d5d47957..bc2730054 100644
--- a/internal/pkg/ntp/ntp_test.go
+++ b/internal/pkg/ntp/ntp_test.go
@@ -380,7 +380,7 @@ func (suite *NTPSuite) TestSyncIterateTimeservers() {
 	wg.Wait()
 
 	// should always sync with 127.0.0.3, and never switch to 127.0.0.4
-	for i := 0; i < 3; i++ {
+	for i := range 3 {
 		suite.Assert().Equal(time.Millisecond, suite.clockAdjustments[i])
 	}
 }
diff --git a/internal/pkg/secureboot/tpm2/pcr_test.go b/internal/pkg/secureboot/tpm2/pcr_test.go
index 115347b24..f94d8e70d 100644
--- a/internal/pkg/secureboot/tpm2/pcr_test.go
+++ b/internal/pkg/secureboot/tpm2/pcr_test.go
@@ -36,8 +36,6 @@ func TestGetSelection(t *testing.T) {
 			expected: []byte{0, 0, 0xe0},
 		},
 	} {
-		tt := tt
-
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/internal/pkg/tui/components/formlabel.go b/internal/pkg/tui/components/formlabel.go
index 43698b179..13055132a 100644
--- a/internal/pkg/tui/components/formlabel.go
+++ b/internal/pkg/tui/components/formlabel.go
@@ -31,9 +31,10 @@ func (b *FormLabel) SetFormAttributes(labelWidth int, labelColor, bgColor, field
 	b.SetBackgroundColor(bgColor)
 	s := strings.TrimSpace(b.GetText(false))
 
-	for i := 0; i < labelWidth; i++ {
+	for range labelWidth {
 		s = " " + s
 	}
+
 	b.SetText(s)
 
 	return b
diff --git a/internal/pkg/tui/components/table.go b/internal/pkg/tui/components/table.go
index be967f4ca..659015617 100644
--- a/internal/pkg/tui/components/table.go
+++ b/internal/pkg/tui/components/table.go
@@ -163,7 +163,7 @@ func (t *Table) SelectRow(row int) bool {
 // HoverRow highlights the row in the table.
 func (t *Table) HoverRow(row int) bool {
 	updateRowStyle := func(r int, foregroundColor, backgroundColor tcell.Color) {
-		for i := 0; i < t.GetColumnCount(); i++ {
+		for i := range t.GetColumnCount() {
 			t.GetCell(r, i).SetBackgroundColor(backgroundColor).SetTextColor(foregroundColor)
 		}
 	}
diff --git a/internal/pkg/tui/installer/state.go b/internal/pkg/tui/installer/state.go
index b9e49058e..3db83a7fb 100644
--- a/internal/pkg/tui/installer/state.go
+++ b/internal/pkg/tui/installer/state.go
@@ -123,8 +123,6 @@ func NewState(ctx context.Context, installer *Installer, conn *Connection) (*Sta
 	opts.MachineConfig.NetworkConfig.Interfaces = []*machineapi.NetworkDeviceConfig{}
 
 	for _, link := range links {
-		link := link
-
 		status := ""
 
 		if !link.Physical {
diff --git a/pkg/archiver/walker_test.go b/pkg/archiver/walker_test.go
index d44cffacf..1e515c35f 100644
--- a/pkg/archiver/walker_test.go
+++ b/pkg/archiver/walker_test.go
@@ -97,7 +97,6 @@ func (suite *WalkerSuite) TestIterationMaxRecurseDepth() {
 			result:   []string{".", "dev", "dev/random", "etc", "etc/certs", "etc/certs/ca.crt", "etc/hostname", "lib", "lib/dynalib.so", "usr", "usr/bin", "usr/bin/cp", "usr/bin/mv"},
 		},
 	} {
-		test := test
 		suite.Run(strconv.Itoa(test.maxDepth), func() {
 			suite.T().Parallel()
 
diff --git a/pkg/cluster/apply-config.go b/pkg/cluster/apply-config.go
index 990a9172b..be8f2cabd 100644
--- a/pkg/cluster/apply-config.go
+++ b/pkg/cluster/apply-config.go
@@ -26,17 +26,15 @@ type ApplyConfigClient struct {
 // ApplyConfig on the node via the API using insecure mode.
 func (s *APIBootstrapper) ApplyConfig(ctx context.Context, nodes []provision.NodeRequest, out io.Writer) error {
 	for _, node := range nodes {
-		n := node
-
 		configureNode := func() error {
 			c, err := client.New(ctx, client.WithTLSConfig(&tls.Config{
 				InsecureSkipVerify: true,
-			}), client.WithEndpoints(n.IPs[0].String()))
+			}), client.WithEndpoints(node.IPs[0].String()))
 			if err != nil {
 				return err
 			}
 
-			cfgBytes, err := n.Config.Bytes()
+			cfgBytes, err := node.Config.Bytes()
 			if err != nil {
 				return err
 			}
diff --git a/pkg/cluster/sonobuoy/sonobuoy.go b/pkg/cluster/sonobuoy/sonobuoy.go
index 705f0ab6b..efaf95ea3 100644
--- a/pkg/cluster/sonobuoy/sonobuoy.go
+++ b/pkg/cluster/sonobuoy/sonobuoy.go
@@ -85,8 +85,6 @@ func FastConformance(ctx context.Context, cluster cluster.K8sProvider) error {
 	}
 
 	for _, options := range optionsList {
-		options := options
-
 		if err := Run(ctx, cluster, &options); err != nil {
 			return err
 		}
diff --git a/pkg/download/download_test.go b/pkg/download/download_test.go
index 0c0064c35..bf53064d4 100644
--- a/pkg/download/download_test.go
+++ b/pkg/download/download_test.go
@@ -131,8 +131,6 @@ func TestDownload(t *testing.T) {
 			expected: "data",
 		},
 	} {
-		test := test
-
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/pkg/imager/extensions/rebuild.go b/pkg/imager/extensions/rebuild.go
index 90041c813..08b2b82ce 100644
--- a/pkg/imager/extensions/rebuild.go
+++ b/pkg/imager/extensions/rebuild.go
@@ -97,7 +97,7 @@ func (builder *Builder) appendCompressedInitramfs(tempDir string, compressedList
 		errCh <- cmd2.Wait()
 	}()
 
-	for i := 0; i < 2; i++ {
+	for range 2 {
 		if err = <-errCh; err != nil {
 			return err
 		}
diff --git a/pkg/kubeconfig/generate_test.go b/pkg/kubeconfig/generate_test.go
index 34394ae6e..bf3515160 100644
--- a/pkg/kubeconfig/generate_test.go
+++ b/pkg/kubeconfig/generate_test.go
@@ -25,8 +25,6 @@ type GenerateSuite struct {
 
 func (suite *GenerateSuite) TestGenerateAdmin() {
 	for _, rsa := range []bool{true, false} {
-		rsa := rsa
-
 		suite.Run(fmt.Sprintf("RSA=%v", rsa), func() {
 			ca, err := x509.NewSelfSignedCertificateAuthority(x509.RSA(rsa))
 			suite.Require().NoError(err)
diff --git a/pkg/kubernetes/kubernetes.go b/pkg/kubernetes/kubernetes.go
index 6be8f3195..acb411c13 100644
--- a/pkg/kubernetes/kubernetes.go
+++ b/pkg/kubernetes/kubernetes.go
@@ -211,34 +211,32 @@ func (h *Client) Drain(ctx context.Context, node string) error {
 	// Evict each pod.
 
 	for _, pod := range pods.Items {
-		p := pod
-
 		eg.Go(func() error {
-			if _, ok := p.ObjectMeta.Annotations[corev1.MirrorPodAnnotationKey]; ok {
-				log.Printf("skipping mirror pod %s/%s\n", p.GetNamespace(), p.GetName())
+			if _, ok := pod.ObjectMeta.Annotations[corev1.MirrorPodAnnotationKey]; ok {
+				log.Printf("skipping mirror pod %s/%s\n", pod.GetNamespace(), pod.GetName())
 
 				return nil
 			}
 
-			controllerRef := metav1.GetControllerOf(&p)
+			controllerRef := metav1.GetControllerOf(&pod)
 
 			if controllerRef == nil {
-				log.Printf("skipping unmanaged pod %s/%s\n", p.GetNamespace(), p.GetName())
+				log.Printf("skipping unmanaged pod %s/%s\n", pod.GetNamespace(), pod.GetName())
 
 				return nil
 			}
 
 			if controllerRef.Kind == appsv1.SchemeGroupVersion.WithKind("DaemonSet").Kind {
-				log.Printf("skipping DaemonSet pod %s/%s\n", p.GetNamespace(), p.GetName())
+				log.Printf("skipping DaemonSet pod %s/%s\n", pod.GetNamespace(), pod.GetName())
 
 				return nil
 			}
 
-			if !p.DeletionTimestamp.IsZero() {
-				log.Printf("skipping deleted pod %s/%s\n", p.GetNamespace(), p.GetName())
+			if !pod.DeletionTimestamp.IsZero() {
+				log.Printf("skipping deleted pod %s/%s\n", pod.GetNamespace(), pod.GetName())
 			}
 
-			if err := h.evict(ctx, p, int64(60)); err != nil {
+			if err := h.evict(ctx, pod, int64(60)); err != nil {
 				log.Printf("WARNING: failed to evict pod: %v", err)
 			}
 
diff --git a/pkg/machinery/client/config/config.go b/pkg/machinery/client/config/config.go
index 39b7900b3..bbd5f8649 100644
--- a/pkg/machinery/client/config/config.go
+++ b/pkg/machinery/client/config/config.go
@@ -218,7 +218,7 @@ func (c *Config) Merge(cfg *Config) []Rename {
 	renames := []Rename{}
 
 	for name, ctx := range cfg.Contexts {
-		mergedName := name
+		mergedName := name //nolint:copyloopvar
 
 		if _, exists := c.Contexts[mergedName]; exists {
 			for i := 1; ; i++ {
diff --git a/pkg/machinery/client/config/config_test.go b/pkg/machinery/client/config/config_test.go
index 0eb1abd6a..d1f54b8b9 100644
--- a/pkg/machinery/client/config/config_test.go
+++ b/pkg/machinery/client/config/config_test.go
@@ -82,8 +82,6 @@ func TestConfigMerge(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
-
 		t.Run(tt.name, func(t *testing.T) {
 			c := tt.config
 			c.Merge(tt.configToMerge)
diff --git a/pkg/machinery/client/resolver/roundrobin.go b/pkg/machinery/client/resolver/roundrobin.go
index 3a20521aa..d849cfb5c 100644
--- a/pkg/machinery/client/resolver/roundrobin.go
+++ b/pkg/machinery/client/resolver/roundrobin.go
@@ -71,7 +71,7 @@ func (r *roundRobinResolver) start() error {
 	endpoints := strings.Split(r.target.Endpoint(), ",")
 
 	for _, addr := range endpoints {
-		serverName := addr
+		serverName := addr //nolint:copyloopvar
 
 		host, _, err := net.SplitHostPort(serverName)
 		if err == nil {
diff --git a/pkg/machinery/client/status_test.go b/pkg/machinery/client/status_test.go
index 1fe4702fe..670759437 100644
--- a/pkg/machinery/client/status_test.go
+++ b/pkg/machinery/client/status_test.go
@@ -62,8 +62,6 @@ func TestStatus(t *testing.T) {
 			code:    codes.AlreadyExists,
 		},
 	} {
-		tt := tt
-
 		t.Run(tt.name, func(t *testing.T) {
 			st := client.Status(tt.err)
 			if tt.nilStatus {
diff --git a/pkg/machinery/compatibility/talos_version_test.go b/pkg/machinery/compatibility/talos_version_test.go
index 9b46ec235..3c3d322cf 100644
--- a/pkg/machinery/compatibility/talos_version_test.go
+++ b/pkg/machinery/compatibility/talos_version_test.go
@@ -288,8 +288,6 @@ func TestDisablePredictableNetworkInterfaces(t *testing.T) {
 			expected: false,
 		},
 	} {
-		tt := tt
-
 		t.Run(tt.host, func(t *testing.T) {
 			host, err := compatibility.ParseTalosVersion(&machine.VersionInfo{
 				Tag: tt.host,
diff --git a/pkg/machinery/config/config_schema_test.go b/pkg/machinery/config/config_schema_test.go
index b63e4818b..672c350ab 100644
--- a/pkg/machinery/config/config_schema_test.go
+++ b/pkg/machinery/config/config_schema_test.go
@@ -96,8 +96,6 @@ func TestSchemaValidation(t *testing.T) {
 			expectedErrorContains: "'/ingress/1/except' does not validate with",
 		},
 	} {
-		test := test
-
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/pkg/machinery/config/configloader/configloader_test.go b/pkg/machinery/config/configloader/configloader_test.go
index 39123dbcf..b93b846a3 100644
--- a/pkg/machinery/config/configloader/configloader_test.go
+++ b/pkg/machinery/config/configloader/configloader_test.go
@@ -27,7 +27,7 @@ func callMethods(t testing.TB, obj reflect.Value, chain ...string) {
 
 	typ := obj.Type()
 
-	for i := 0; i < obj.NumMethod(); i++ {
+	for i := range obj.NumMethod() {
 		method := obj.Method(i)
 
 		if method.Type().NumIn() != 0 {
@@ -98,7 +98,6 @@ func TestConfigLoader(t *testing.T) {
 	require.NoError(t, err)
 
 	for _, file := range files {
-		file := file
 		t.Run(file, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/pkg/machinery/config/configloader/internal/decoder/decoder_test.go b/pkg/machinery/config/configloader/internal/decoder/decoder_test.go
index 9c8dd349c..5502b3384 100644
--- a/pkg/machinery/config/configloader/internal/decoder/decoder_test.go
+++ b/pkg/machinery/config/configloader/internal/decoder/decoder_test.go
@@ -305,8 +305,6 @@ config:
 	}
 
 	for _, tt := range tests {
-		tt := tt
-
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -333,8 +331,6 @@ func TestDecoderV1Alpha1Config(t *testing.T) {
 	require.NoError(t, err)
 
 	for _, file := range files {
-		file := file
-
 		t.Run(file, func(t *testing.T) {
 			t.Parallel()
 
@@ -355,7 +351,7 @@ func BenchmarkDecoderV1Alpha1Config(b *testing.B) {
 	contents, err := os.ReadFile("testdata/controlplane.yaml")
 	require.NoError(b, err)
 
-	for i := 0; i < b.N; i++ {
+	for range b.N {
 		d := decoder.NewDecoder()
 		_, err = d.Decode(bytes.NewReader(contents))
 
diff --git a/pkg/machinery/config/configloader/internal/decoder/unknown_keys.go b/pkg/machinery/config/configloader/internal/decoder/unknown_keys.go
index 8f86d54c0..50cfcb7da 100644
--- a/pkg/machinery/config/configloader/internal/decoder/unknown_keys.go
+++ b/pkg/machinery/config/configloader/internal/decoder/unknown_keys.go
@@ -156,7 +156,7 @@ func internalCheckUnknownKeys(typ reflect.Type, spec *yaml.Node) (unknown interf
 			return unknown, fmt.Errorf("unexpected type for yaml sequence: %s", typ)
 		}
 
-		for i := 0; i < len(spec.Content); i++ {
+		for i := range len(spec.Content) {
 			innerUnknown, err := internalCheckUnknownKeys(typ.Elem(), spec.Content[i])
 			if err != nil {
 				return unknown, err
diff --git a/pkg/machinery/config/container/container_test.go b/pkg/machinery/config/container/container_test.go
index e6f228df1..7c66fba10 100644
--- a/pkg/machinery/config/container/container_test.go
+++ b/pkg/machinery/config/container/container_test.go
@@ -180,8 +180,6 @@ func TestValidate(t *testing.T) {
 			expectedError: "2 errors occurred:\n\t* machine instructions are required\n\t* apiUrl is required\n\n",
 		},
 	} {
-		tt := tt
-
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/pkg/machinery/config/contract_test.go b/pkg/machinery/config/contract_test.go
index ab77f5b5f..40af79559 100644
--- a/pkg/machinery/config/contract_test.go
+++ b/pkg/machinery/config/contract_test.go
@@ -33,7 +33,6 @@ func TestContractParseVersion(t *testing.T) {
 		"v0.88":          {0, 88},
 		"v0.8.3-alpha.4": config.TalosVersion0_8,
 	} {
-		v, expected := v, expected
 		t.Run(v, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/pkg/machinery/config/encoder/documentation.go b/pkg/machinery/config/encoder/documentation.go
index 7525d1dcc..dc3fc3314 100644
--- a/pkg/machinery/config/encoder/documentation.go
+++ b/pkg/machinery/config/encoder/documentation.go
@@ -294,7 +294,7 @@ func populateNestedExamples(v reflect.Value, index int) {
 	case reflect.Struct:
 		doc := getDoc(v.Interface())
 
-		for i := 0; i < v.NumField(); i++ {
+		for i := range v.NumField() {
 			field := v.Field(i)
 			if !field.CanInterface() {
 				continue
@@ -315,7 +315,7 @@ func populateNestedExamples(v reflect.Value, index int) {
 			populateNestedExamples(v.MapIndex(key), index)
 		}
 	case reflect.Slice:
-		for i := 0; i < v.Len(); i++ {
+		for i := range v.Len() {
 			populateNestedExamples(v.Index(i), index)
 		}
 	}
diff --git a/pkg/machinery/config/encoder/encoder.go b/pkg/machinery/config/encoder/encoder.go
index c18ea4698..b573e36d0 100644
--- a/pkg/machinery/config/encoder/encoder.go
+++ b/pkg/machinery/config/encoder/encoder.go
@@ -153,9 +153,9 @@ func toYamlNode(in interface{}, options *Options) (*yaml.Node, error) {
 
 		t := v.Type()
 
-		examples := []string{}
+		var examples []string
 
-		for i := 0; i < v.NumField(); i++ {
+		for i := range v.NumField() {
 			// skip unexported fields
 			if !v.Field(i).CanInterface() {
 				continue
@@ -303,7 +303,7 @@ func toYamlNode(in interface{}, options *Options) (*yaml.Node, error) {
 		node.Kind = yaml.SequenceNode
 		nodes := make([]*yaml.Node, v.Len())
 
-		for i := 0; i < v.Len(); i++ {
+		for i := range v.Len() {
 			element := v.Index(i)
 
 			var err error
@@ -313,7 +313,9 @@ func toYamlNode(in interface{}, options *Options) (*yaml.Node, error) {
 				return nil, err
 			}
 		}
+
 		appendNodes(node, nodes...)
+
 	default:
 		if err := node.Encode(in); err != nil {
 			return nil, err
diff --git a/pkg/machinery/config/encoder/encoder_test.go b/pkg/machinery/config/encoder/encoder_test.go
index b2381a3df..0672d338e 100644
--- a/pkg/machinery/config/encoder/encoder_test.go
+++ b/pkg/machinery/config/encoder/encoder_test.go
@@ -531,7 +531,7 @@ func (suite *EncoderSuite) TestConcurrent() {
 
 	var wg sync.WaitGroup
 
-	for i := 0; i < 10; i++ {
+	for range 10 {
 		wg.Add(1)
 
 		go func() {
diff --git a/pkg/machinery/config/generate/generate_test.go b/pkg/machinery/config/generate/generate_test.go
index b8ed50b5d..2e2c40a9e 100644
--- a/pkg/machinery/config/generate/generate_test.go
+++ b/pkg/machinery/config/generate/generate_test.go
@@ -91,8 +91,6 @@ func TestGenerateSuite(t *testing.T) {
 			genOptions: []generate.Option{generate.WithVersionContract(config.TalosVersion0_8)},
 		},
 	} {
-		tt := tt
-
 		t.Run(tt.label, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/pkg/machinery/config/generate/secrets/generate_test.go b/pkg/machinery/config/generate/secrets/generate_test.go
index 44be802dc..cadc6d7bb 100644
--- a/pkg/machinery/config/generate/secrets/generate_test.go
+++ b/pkg/machinery/config/generate/secrets/generate_test.go
@@ -46,8 +46,6 @@ func TestNewBundle(t *testing.T) {
 			versionContract: config.TalosVersionCurrent,
 		},
 	} {
-		test := test
-
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/pkg/machinery/config/machine/machine_test.go b/pkg/machinery/config/machine/machine_test.go
index 2c8b9f3c5..e1e9f04b3 100644
--- a/pkg/machinery/config/machine/machine_test.go
+++ b/pkg/machinery/config/machine/machine_test.go
@@ -38,7 +38,6 @@ func TestParseType(t *testing.T) {
 	}
 
 	for _, tt := range validTests {
-		tt := tt
 		t.Run(tt.s, func(t *testing.T) {
 			t.Parallel()
 
@@ -56,7 +55,6 @@ func TestParseType(t *testing.T) {
 	for _, s := range []string{
 		"foo",
 	} {
-		s := s
 		t.Run(s, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/pkg/machinery/config/merge/merge.go b/pkg/machinery/config/merge/merge.go
index acd63d4ea..76b517edd 100644
--- a/pkg/machinery/config/merge/merge.go
+++ b/pkg/machinery/config/merge/merge.go
@@ -151,7 +151,7 @@ func merge(vl, vr reflect.Value, replace bool) error {
 			return nil
 		}
 
-		for i := 0; i < tl.NumField(); i++ {
+		for i := range tl.NumField() {
 			var replace bool
 
 			structTag := tl.Field(i).Tag.Get("merge")
diff --git a/pkg/machinery/config/types/network/rule_config_test.go b/pkg/machinery/config/types/network/rule_config_test.go
index 6300dd473..bcb40d674 100644
--- a/pkg/machinery/config/types/network/rule_config_test.go
+++ b/pkg/machinery/config/types/network/rule_config_test.go
@@ -170,8 +170,6 @@ func TestRuleConfigValidate(t *testing.T) {
 			},
 		},
 	} {
-		test := test
-
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/pkg/machinery/config/types/runtime/event_sink_test.go b/pkg/machinery/config/types/runtime/event_sink_test.go
index d0b0b81b2..68b7a8208 100644
--- a/pkg/machinery/config/types/runtime/event_sink_test.go
+++ b/pkg/machinery/config/types/runtime/event_sink_test.go
@@ -67,8 +67,6 @@ func TestEventSinkValidate(t *testing.T) {
 			},
 		},
 	} {
-		test := test
-
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/pkg/machinery/config/types/runtime/kmsg_log_test.go b/pkg/machinery/config/types/runtime/kmsg_log_test.go
index adeecd611..4876faf7e 100644
--- a/pkg/machinery/config/types/runtime/kmsg_log_test.go
+++ b/pkg/machinery/config/types/runtime/kmsg_log_test.go
@@ -117,8 +117,6 @@ func TestKmsgLogValidate(t *testing.T) {
 			},
 		},
 	} {
-		test := test
-
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/pkg/machinery/config/types/siderolink/siderolink_test.go b/pkg/machinery/config/types/siderolink/siderolink_test.go
index c9a532e38..1cf50747a 100644
--- a/pkg/machinery/config/types/siderolink/siderolink_test.go
+++ b/pkg/machinery/config/types/siderolink/siderolink_test.go
@@ -93,8 +93,6 @@ func TestValidate(t *testing.T) {
 			},
 		},
 	} {
-		test := test
-
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/pkg/machinery/config/types/v1alpha1/v1alpha1_stability_test.go b/pkg/machinery/config/types/v1alpha1/v1alpha1_stability_test.go
index 5eb925a36..f593abd21 100644
--- a/pkg/machinery/config/types/v1alpha1/v1alpha1_stability_test.go
+++ b/pkg/machinery/config/types/v1alpha1/v1alpha1_stability_test.go
@@ -48,8 +48,6 @@ func TestConfigEncodingStability(t *testing.T) {
 	require.True(t, currentVersion.LTE(maxContractVersion), "latest version contract is not tested")
 
 	for _, versionContract := range versionContracts {
-		versionContract := versionContract
-
 		t.Run(versionContract.String(), func(t *testing.T) {
 			t.Parallel()
 
diff --git a/pkg/machinery/config/types/v1alpha1/v1alpha1_validation_test.go b/pkg/machinery/config/types/v1alpha1/v1alpha1_validation_test.go
index 18e7dc3c6..b2b7d4e95 100644
--- a/pkg/machinery/config/types/v1alpha1/v1alpha1_validation_test.go
+++ b/pkg/machinery/config/types/v1alpha1/v1alpha1_validation_test.go
@@ -1493,8 +1493,6 @@ func TestValidate(t *testing.T) {
 			expectedError: "3 errors occurred:\n\t* apiserver resource validation failed: unsupported pod resource \"invalid1\"\n\t* controller-manager resource validation failed: unsupported pod resource \"invalid2\"\n\t* scheduler resource validation failed: unsupported pod resource \"invalid3\"\n\n", //nolint:lll
 		},
 	} {
-		test := test
-
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -1607,8 +1605,6 @@ func TestValidateCNI(t *testing.T) {
 			expectedError: "1 error occurred:\n\t* \"urls\" field should be empty for \"none\" CNI\n\n",
 		},
 	} {
-		test := test
-
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/pkg/machinery/extensions/services/services_test.go b/pkg/machinery/extensions/services/services_test.go
index 84fb42627..dade6dfcd 100644
--- a/pkg/machinery/extensions/services/services_test.go
+++ b/pkg/machinery/extensions/services/services_test.go
@@ -107,8 +107,6 @@ func TestValidate(t *testing.T) {
 			expectedError: "4 errors occurred:\n\t* no dependency specified\n\t* path is not absolute: \"./somefile\"\n\t* invalid network dependency: Status(0)\n\t* more than a single dependency is set\n\n",
 		},
 	} {
-		tt := tt
-
 		t.Run(tt.name, func(t *testing.T) {
 			err := tt.spec.Validate()
 			assert.EqualError(t, err, tt.expectedError)
diff --git a/pkg/machinery/meta/meta_test.go b/pkg/machinery/meta/meta_test.go
index c7dbb4ae5..7b303d1f8 100644
--- a/pkg/machinery/meta/meta_test.go
+++ b/pkg/machinery/meta/meta_test.go
@@ -38,8 +38,6 @@ func TestEncodeDecodeValues(t *testing.T) {
 	t.Parallel()
 
 	for _, allowGzip := range []bool{false, true} {
-		allowGzip := allowGzip
-
 		t.Run(fmt.Sprintf("allowGzip=%v", allowGzip), func(t *testing.T) {
 			t.Parallel()
 
@@ -75,8 +73,6 @@ func TestEncodeDecodeValues(t *testing.T) {
 					expectedGzippedSize: 80,
 				},
 			} {
-				test := test
-
 				t.Run(test.name, func(t *testing.T) {
 					t.Parallel()
 
diff --git a/pkg/machinery/nethelpers/vlan_test.go b/pkg/machinery/nethelpers/vlan_test.go
index 4dfcc2a5d..39d00267d 100644
--- a/pkg/machinery/nethelpers/vlan_test.go
+++ b/pkg/machinery/nethelpers/vlan_test.go
@@ -59,8 +59,6 @@ func TestVLANLinkName(t *testing.T) {
 			expected: "enx1ef972f.4095",
 		},
 	} {
-		test := test
-
 		t.Run(fmt.Sprintf("%s.%d", test.base, test.vlanID), func(t *testing.T) {
 			t.Parallel()
 
diff --git a/pkg/machinery/resources/cluster/affiliate_test.go b/pkg/machinery/resources/cluster/affiliate_test.go
index 249f0e01d..011380a08 100644
--- a/pkg/machinery/resources/cluster/affiliate_test.go
+++ b/pkg/machinery/resources/cluster/affiliate_test.go
@@ -99,8 +99,6 @@ func TestAffiliateSpec_Merge(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
-
 		t.Run(tt.name, func(t *testing.T) {
 			spec := tt.a
 			spec.Merge(&tt.b)
diff --git a/pkg/machinery/resources/k8s/endpoint.go b/pkg/machinery/resources/k8s/endpoint.go
index 6cc2ce83f..9fe0c2dcb 100644
--- a/pkg/machinery/resources/k8s/endpoint.go
+++ b/pkg/machinery/resources/k8s/endpoint.go
@@ -71,8 +71,6 @@ type EndpointList []netip.Addr
 // Merge endpoints from multiple Endpoint resources into a single list.
 func (l EndpointList) Merge(endpoint *Endpoint) EndpointList {
 	for _, ip := range endpoint.TypedSpec().Addresses {
-		ip := ip
-
 		idx := sort.Search(len(l), func(i int) bool { return !l[i].Less(ip) })
 
 		if idx < len(l) && l[idx].Compare(ip) == 0 {
diff --git a/pkg/machinery/resources/network/condition_test.go b/pkg/machinery/resources/network/condition_test.go
index ec505216f..136497850 100644
--- a/pkg/machinery/resources/network/condition_test.go
+++ b/pkg/machinery/resources/network/condition_test.go
@@ -59,8 +59,6 @@ func TestCondition(t *testing.T) {
 			Succeeds: true,
 		},
 	} {
-		tt := tt
-
 		t.Run(tt.Name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/pkg/machinery/resources/network/link_test.go b/pkg/machinery/resources/network/link_test.go
index 955d66e11..4bccb4dfc 100644
--- a/pkg/machinery/resources/network/link_test.go
+++ b/pkg/machinery/resources/network/link_test.go
@@ -206,8 +206,6 @@ func TestWireguardSpecMerge(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
-
 		t.Run(tt.name, func(t *testing.T) {
 			spec := tt.spec
 			spec.Merge(tt.other)
diff --git a/pkg/machinery/resources/runtime/condition.go b/pkg/machinery/resources/runtime/condition.go
index 5a0877dd7..cd995aada 100644
--- a/pkg/machinery/resources/runtime/condition.go
+++ b/pkg/machinery/resources/runtime/condition.go
@@ -34,7 +34,6 @@ func (condition *KernelParamsSetCondition) String() string {
 // Wait implements condition interface.
 func (condition *KernelParamsSetCondition) Wait(ctx context.Context) error {
 	for _, prop := range condition.props {
-		prop := prop
 		if _, err := condition.state.WatchFor(
 			ctx,
 			resource.NewMetadata(NamespaceName, KernelParamStatusType, prop.Key, resource.VersionUndefined),
diff --git a/pkg/machinery/resources/runtime/condition_test.go b/pkg/machinery/resources/runtime/condition_test.go
index c1753873d..bfab0ea14 100644
--- a/pkg/machinery/resources/runtime/condition_test.go
+++ b/pkg/machinery/resources/runtime/condition_test.go
@@ -108,8 +108,6 @@ func TestCondition(t *testing.T) {
 			Succeeds: true,
 		},
 	} {
-		tt := tt
-
 		t.Run(tt.Name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/pkg/provision/providers/vm/dhcpd.go b/pkg/provision/providers/vm/dhcpd.go
index 196d65cf1..bb5fd07d9 100644
--- a/pkg/provision/providers/vm/dhcpd.go
+++ b/pkg/provision/providers/vm/dhcpd.go
@@ -229,8 +229,6 @@ func DHCPd(ifName string, ips []net.IP, statePath string) error {
 	var eg errgroup.Group
 
 	for _, ip := range ips {
-		ip := ip
-
 		eg.Go(func() error {
 			if ip.To4() == nil {
 				server, err := server6.NewServer(
diff --git a/pkg/provision/providers/vm/tftpd.go b/pkg/provision/providers/vm/tftpd.go
index 72228b389..4a2de27bb 100644
--- a/pkg/provision/providers/vm/tftpd.go
+++ b/pkg/provision/providers/vm/tftpd.go
@@ -23,8 +23,6 @@ func TFTPd(ips []net.IP, nextHandler string) error {
 	var eg errgroup.Group
 
 	for _, ip := range ips {
-		ip := ip
-
 		eg.Go(func() error {
 			return server.ListenAndServe(net.JoinHostPort(ip.String(), "69"))
 		})
diff --git a/pkg/reporter/reporter.go b/pkg/reporter/reporter.go
index 7fd0f0f68..b8bd438eb 100644
--- a/pkg/reporter/reporter.go
+++ b/pkg/reporter/reporter.go
@@ -114,7 +114,7 @@ func (r *Reporter) Report(update Update) {
 
 	if prevLineTemporary {
 		for _, outputLine := range strings.Split(r.lastLine, "\n") {
-			for i := 0; i < (utf8.RuneCountInString(outputLine)+w-1)/w; i++ {
+			for range (utf8.RuneCountInString(outputLine) + w - 1) / w {
 				fmt.Fprint(r.w, "\033[A\033[K") // cursor up, clear line
 			}
 		}