diff --git a/.golangci.yml b/.golangci.yml
index 79421db8..42a8f039 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-10-30T12:55:25Z by kres 6d3cad4.
+# Generated on 2024-11-21T22:07:50Z by kres a8af16d.
 
 # options for analysis running
 run:
@@ -127,7 +127,6 @@ linters:
     - gochecknoglobals
     - gochecknoinits
     - godox
-    - gomnd
     - gomoddirectives
     - gosec
     - inamedparam
diff --git a/Dockerfile b/Dockerfile
index ff6ecbe2..4f74aaec 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,8 +1,8 @@
-# syntax = docker/dockerfile-upstream:1.11.0-labs
+# syntax = docker/dockerfile-upstream:1.11.1-labs
 
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-11-05T11:24:27Z by kres 5fa0b38-dirty.
+# Generated on 2024-11-21T22:07:50Z by kres a8af16d.
 
 ARG JS_TOOLCHAIN
 ARG TOOLCHAIN
diff --git a/Makefile b/Makefile
index 4b5cac1a..fc26398d 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-11-05T11:24:27Z by kres 5fa0b38-dirty.
+# Generated on 2024-11-21T22:34:08Z by kres b3b0da76.
 
 # common variables
 
@@ -24,11 +24,11 @@ PROTOBUF_GO_VERSION ?= 1.35.1
 GRPC_GO_VERSION ?= 1.5.1
 GRPC_GATEWAY_VERSION ?= 2.23.0
 VTPROTOBUF_VERSION ?= 0.6.0
-GOIMPORTS_VERSION ?= 0.26.0
+GOIMPORTS_VERSION ?= 0.27.0
 DEEPCOPY_VERSION ?= v0.5.6
-GOLANGCILINT_VERSION ?= v1.61.0
+GOLANGCILINT_VERSION ?= v1.62.0
 GOFUMPT_VERSION ?= v0.7.0
-GO_VERSION ?= 1.23.2
+GO_VERSION ?= 1.23.3
 GO_BUILDFLAGS ?=
 GO_LDFLAGS ?=
 CGO_ENABLED ?= 0
@@ -43,11 +43,13 @@ PLATFORM ?= linux/amd64
 PROGRESS ?= auto
 PUSH ?= false
 CI_ARGS ?=
+BUILDKIT_MULTI_PLATFORM ?= 1
 COMMON_ARGS = --file=Dockerfile
 COMMON_ARGS += --provenance=false
 COMMON_ARGS += --progress=$(PROGRESS)
 COMMON_ARGS += --platform=$(PLATFORM)
 COMMON_ARGS += --push=$(PUSH)
+COMMON_ARGS += --build-arg=BUILDKIT_MULTI_PLATFORM=$(BUILDKIT_MULTI_PLATFORM)
 COMMON_ARGS += --build-arg=ARTIFACTS="$(ARTIFACTS)"
 COMMON_ARGS += --build-arg=SHA="$(SHA)"
 COMMON_ARGS += --build-arg=TAG="$(TAG)"
@@ -155,9 +157,18 @@ target-%:  ## Builds the specified target defined in the Dockerfile. The build r
 
 local-%:  ## Builds the specified target defined in the Dockerfile using the local output type. The build result will be output to the specified local destination.
 	@$(MAKE) target-$* TARGET_ARGS="--output=type=local,dest=$(DEST) $(TARGET_ARGS)"
+	@PLATFORM=$(PLATFORM) DEST=$(DEST) bash -c '\
+	  for platform in $$(tr "," "\n" <<< "$$PLATFORM"); do \
+	    echo $$platform; \
+	    directory="$${platform//\//_}"; \
+	    if [[ -d "$$DEST/$$directory" ]]; then \
+	      mv "$$DEST/$$directory/"* $$DEST; \
+	      rmdir "$$DEST/$$directory/"; \
+	    fi; \
+	  done'
 
 generate-frontend:  ## Generate .proto definitions.
-	@$(MAKE) local-$@ DEST=./
+	@$(MAKE) local-$@ DEST=./ BUILDKIT_MULTI_PLATFORM=0
 
 .PHONY: js
 js:  ## Prepare js base toolchain.
@@ -178,7 +189,7 @@ $(ARTIFACTS)/frontend-js:
 frontend: $(ARTIFACTS)/frontend-js  ## Builds js release for frontend.
 
 generate:  ## Generate .proto definitions.
-	@$(MAKE) local-$@ DEST=./
+	@$(MAKE) local-$@ DEST=./ BUILDKIT_MULTI_PLATFORM=0
 
 lint-golangci-lint-client:  ## Runs golangci-lint linter.
 	@$(MAKE) target-$@
diff --git a/client/.golangci.yml b/client/.golangci.yml
index 86277942..42a8f039 100644
--- a/client/.golangci.yml
+++ b/client/.golangci.yml
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-06-19T21:17:41Z by kres 4c9f215.
+# Generated on 2024-11-21T22:07:50Z by kres a8af16d.
 
 # options for analysis running
 run:
@@ -127,7 +127,6 @@ linters:
     - gochecknoglobals
     - gochecknoinits
     - godox
-    - gomnd
     - gomoddirectives
     - gosec
     - inamedparam
diff --git a/client/go.mod b/client/go.mod
index 9edc227c..6b2beca4 100644
--- a/client/go.mod
+++ b/client/go.mod
@@ -1,6 +1,6 @@
 module github.com/siderolabs/omni/client
 
-go 1.23.0
+go 1.23.3
 
 replace (
 	// forked go-yaml that introduces RawYAML interface, which can be used to populate YAML fields using bytes
diff --git a/client/pkg/infra/controllers/provision.go b/client/pkg/infra/controllers/provision.go
index f5beee5c..7853fa0c 100644
--- a/client/pkg/infra/controllers/provision.go
+++ b/client/pkg/infra/controllers/provision.go
@@ -241,7 +241,7 @@ func (ctrl *ProvisionController[T]) reconcileRunning(ctx context.Context, r cont
 		machineRequestStatus.TypedSpec().Value.Error = ""
 		machineRequestStatus.TypedSpec().Value.Stage = specs.MachineRequestStatusSpec_PROVISIONING
 
-		if err = safe.WriterModify(ctx, r, res.(T), func(st T) error { //nolint:forcetypeassert
+		if err = safe.WriterModify(ctx, r, res.(T), func(st T) error { //nolint:forcetypeassert,errcheck
 			err = step.Run(ctx, logger, provision.NewContext(
 				machineRequest,
 				machineRequestStatus,
diff --git a/client/pkg/template/internal/models/machineset.go b/client/pkg/template/internal/models/machineset.go
index 1413fdfe..7244361a 100644
--- a/client/pkg/template/internal/models/machineset.go
+++ b/client/pkg/template/internal/models/machineset.go
@@ -66,6 +66,8 @@ type MachineClassConfig struct {
 }
 
 // Size extends protobuf generated allocation type enum to parse string constants.
+//
+//nolint:recvcheck
 type Size struct {
 	Value          uint32
 	AllocationType specs.MachineSetSpec_MachineAllocation_Type
@@ -112,6 +114,8 @@ func (c Size) MarshalYAML() (any, error) {
 }
 
 // UpdateStrategyType extends protobuf generated update strategy enum to parse string constants.
+//
+//nolint:recvcheck
 type UpdateStrategyType uint32
 
 // UnmarshalYAML implements yaml.Unmarshaler.
diff --git a/cmd/integration-test/pkg/tests/common.go b/cmd/integration-test/pkg/tests/common.go
index 2542f64f..f80a5adb 100644
--- a/cmd/integration-test/pkg/tests/common.go
+++ b/cmd/integration-test/pkg/tests/common.go
@@ -37,7 +37,7 @@ func resourceDetails(res resource.Resource) string {
 	}
 
 	if res.Metadata().Type() == omni.MachineStatusType {
-		network := res.Spec().(*omni.MachineStatusSpec).Value.Network //nolint:forcetypeassert
+		network := res.Spec().(*omni.MachineStatusSpec).Value.Network //nolint:forcetypeassert,errcheck
 		if network != nil {
 			parts = append(parts, fmt.Sprintf("hostname: %s", network.Hostname))
 		}
diff --git a/go.mod b/go.mod
index a5cab111..fe1d7fd1 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/siderolabs/omni
 
-go 1.23.2
+go 1.23.3
 
 replace (
 	// use nested module
diff --git a/go.work b/go.work
index c19e773b..92138f4e 100644
--- a/go.work
+++ b/go.work
@@ -1,4 +1,4 @@
-go 1.23.2
+go 1.23.3
 
 use (
 	.
diff --git a/internal/backend/grpc/management.go b/internal/backend/grpc/management.go
index a83e7f94..69e91294 100644
--- a/internal/backend/grpc/management.go
+++ b/internal/backend/grpc/management.go
@@ -59,6 +59,14 @@ import (
 	"github.com/siderolabs/omni/internal/pkg/xcontext"
 )
 
+type talosRuntime interface {
+	GetClient(ctx context.Context, clusterName string) (*talos.Client, error)
+}
+
+type kubernetesRuntime interface {
+	GetKubeconfig(ctx context.Context, cluster *commonOmni.Context) (*rest.Config, error)
+}
+
 // JWTSigningKeyProvider is an interface for a JWT signing key provider.
 type JWTSigningKeyProvider interface {
 	SigningKey(ctx context.Context) (op.SigningKey, error)
@@ -411,11 +419,7 @@ func (s *managementServer) KubernetesUpgradePreChecks(ctx context.Context, req *
 		return nil, status.Errorf(codes.InvalidArgument, "unsupported upgrade path: %s", path)
 	}
 
-	type kubeConfigGetter interface {
-		GetKubeconfig(ctx context.Context, cluster *commonOmni.Context) (*rest.Config, error)
-	}
-
-	k8sRuntime, err := runtime.LookupInterface[kubeConfigGetter](kubernetes.Name)
+	k8sRuntime, err := runtime.LookupInterface[kubernetesRuntime](kubernetes.Name)
 	if err != nil {
 		return nil, err
 	}
@@ -425,16 +429,12 @@ func (s *managementServer) KubernetesUpgradePreChecks(ctx context.Context, req *
 		return nil, fmt.Errorf("error getting kubeconfig: %w", err)
 	}
 
-	type talosClientGetter interface {
-		GetClient(ctx context.Context, clusterName string) (*talos.Client, error)
-	}
-
-	talosRuntime, err := runtime.LookupInterface[talosClientGetter](talos.Name)
+	talosRt, err := runtime.LookupInterface[talosRuntime](talos.Name)
 	if err != nil {
 		return nil, err
 	}
 
-	talosClient, err := talosRuntime.GetClient(ctx, requestContext.Name)
+	talosClient, err := talosRt.GetClient(ctx, requestContext.Name)
 	if err != nil {
 		return nil, fmt.Errorf("error getting talos client: %w", err)
 	}
@@ -504,30 +504,22 @@ func (s *managementServer) KubernetesSyncManifests(req *management.KubernetesSyn
 		return status.Error(codes.InvalidArgument, "unable to extract request context")
 	}
 
-	type kubernetesConfigurator interface {
-		GetKubeconfig(ctx context.Context, context *commonOmni.Context) (*rest.Config, error)
-	}
-
-	kubernetesRuntime, err := runtime.LookupInterface[kubernetesConfigurator](kubernetes.Name)
+	k8sRuntime, err := runtime.LookupInterface[kubernetesRuntime](kubernetes.Name)
 	if err != nil {
 		return err
 	}
 
-	cfg, err := kubernetesRuntime.GetKubeconfig(ctx, requestContext)
+	cfg, err := k8sRuntime.GetKubeconfig(ctx, requestContext)
 	if err != nil {
 		return fmt.Errorf("failed to get kubeconfig: %w", err)
 	}
 
-	type talosClientProvider interface {
-		GetClient(ctx context.Context, clusterName string) (*talos.Client, error)
-	}
-
-	talosRuntime, err := runtime.LookupInterface[talosClientProvider](talos.Name)
+	talosRt, err := runtime.LookupInterface[talosRuntime](talos.Name)
 	if err != nil {
 		return err
 	}
 
-	talosClient, err := talosRuntime.GetClient(ctx, requestContext.Name)
+	talosClient, err := talosRt.GetClient(ctx, requestContext.Name)
 	if err != nil {
 		return fmt.Errorf("failed to get talos client: %w", err)
 	}
diff --git a/internal/backend/k8sproxy/multiplex.go b/internal/backend/k8sproxy/multiplex.go
index 12b7f7cd..b6932445 100644
--- a/internal/backend/k8sproxy/multiplex.go
+++ b/internal/backend/k8sproxy/multiplex.go
@@ -181,7 +181,7 @@ func (m *multiplexer) getClusterConnector(ctx context.Context, clusterName strin
 			return nil, res.Err
 		}
 
-		return res.Val.(*clusterConnector), nil //nolint:forcetypeassert
+		return res.Val.(*clusterConnector), nil //nolint:forcetypeassert,errcheck
 	}
 }
 
diff --git a/internal/backend/oidc/internal/storage/keys/storage_test.go b/internal/backend/oidc/internal/storage/keys/storage_test.go
index 2637d9f5..152ba690 100644
--- a/internal/backend/oidc/internal/storage/keys/storage_test.go
+++ b/internal/backend/oidc/internal/storage/keys/storage_test.go
@@ -78,7 +78,7 @@ func TestStorage(t *testing.T) {
 
 	assert.Len(t, keySet, 1)
 	assert.Equal(t, keySet[0].ID(), signingKey.ID())
-	assert.Equal(t, *keySet[0].Key().(*rsa.PublicKey), privateKey.PublicKey) //nolint:forcetypeassert
+	assert.Equal(t, *keySet[0].Key().(*rsa.PublicKey), privateKey.PublicKey) //nolint:forcetypeassert,errcheck
 
 	expectedPublicKeyIDs := []string{signingKey.ID()}
 
diff --git a/internal/backend/runtime/kubernetes/kubernetes.go b/internal/backend/runtime/kubernetes/kubernetes.go
index 13ac3c51..bbe679f2 100644
--- a/internal/backend/runtime/kubernetes/kubernetes.go
+++ b/internal/backend/runtime/kubernetes/kubernetes.go
@@ -418,7 +418,7 @@ func (r *Runtime) getOrCreateClient(ctx context.Context, opts *runtime.QueryOpti
 			return nil, res.Err
 		}
 
-		return res.Val.(*Client), nil //nolint:forcetypeassert // we know the type
+		return res.Val.(*Client), nil //nolint:forcetypeassert,errcheck // we know the type
 	}
 }
 
diff --git a/internal/backend/runtime/omni/audit/audit_test.go b/internal/backend/runtime/omni/audit/audit_test.go
index 9490b299..098b3db3 100644
--- a/internal/backend/runtime/omni/audit/audit_test.go
+++ b/internal/backend/runtime/omni/audit/audit_test.go
@@ -101,7 +101,7 @@ func TestAudit(t *testing.T) {
 			subFS: fsSub(t, logDir, "log"),
 			File:  "2012-01-01.jsonlog",
 		},
-		os.DirFS(tempDir).(subFS), //nolint:forcetypeassert
+		os.DirFS(tempDir).(subFS), //nolint:forcetypeassert,errcheck
 		cmpIgnoreTime,
 	)
 }
diff --git a/internal/backend/runtime/omni/audit/log_file.go b/internal/backend/runtime/omni/audit/log_file.go
index b7c3a5ae..d9d0ca3c 100644
--- a/internal/backend/runtime/omni/audit/log_file.go
+++ b/internal/backend/runtime/omni/audit/log_file.go
@@ -117,7 +117,7 @@ func (l *LogFile) RemoveFiles(start, end time.Time) error {
 		return fmt.Errorf("end time is before start time")
 	}
 
-	dirFiles, err := getDirFiles(os.DirFS(l.dir).(fs.ReadDirFS))
+	dirFiles, err := getDirFiles(os.DirFS(l.dir).(fs.ReadDirFS)) //nolint:errcheck
 	if err != nil {
 		return err
 	}
@@ -148,7 +148,7 @@ func (l *LogFile) ReadAuditLog(start, end time.Time) (io.ReadCloser, error) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 
-	dirFiles, err := getDirFiles(os.DirFS(l.dir).(fs.ReadDirFS))
+	dirFiles, err := getDirFiles(os.DirFS(l.dir).(fs.ReadDirFS)) //nolint:errcheck
 	if err != nil {
 		return nil, fmt.Errorf("failed to read audit log directory: %w", err)
 	}
diff --git a/internal/backend/runtime/omni/audit/log_file_test.go b/internal/backend/runtime/omni/audit/log_file_test.go
index 1a8c7679..14c2b336 100644
--- a/internal/backend/runtime/omni/audit/log_file_test.go
+++ b/internal/backend/runtime/omni/audit/log_file_test.go
@@ -48,7 +48,7 @@ func TestLogFile_CurrentDay(t *testing.T) {
 	equalDirs(
 		t,
 		fsSub(t, currentDay, "currentday"),
-		os.DirFS(dir).(subFS), //nolint:forcetypeassert
+		os.DirFS(dir).(subFS), //nolint:forcetypeassert,errcheck
 		defaultCmp,
 	)
 }
@@ -78,7 +78,7 @@ func TestLogFile_CurrentAndNewDay(t *testing.T) {
 	equalDirs(
 		t,
 		fsSub(t, nextDay, "nextday"),
-		os.DirFS(dir).(subFS), //nolint:forcetypeassert
+		os.DirFS(dir).(subFS), //nolint:forcetypeassert,errcheck
 		defaultCmp,
 	)
 }
@@ -119,7 +119,7 @@ func TestLogFile_CurrentDayConcurrent(t *testing.T) {
 		t,
 		fsSub(t, concurrent, "concurrent"),
 		&sortedFileFS{
-			subFS: os.DirFS(dir).(subFS), //nolint:forcetypeassert
+			subFS: os.DirFS(dir).(subFS), //nolint:forcetypeassert,errcheck
 		},
 		defaultCmp,
 	)
@@ -137,7 +137,7 @@ type subFS interface {
 }
 
 func fsSub(t *testing.T, subFs subFS, folder string) subFS {
-	return must.Value(fs.Sub(subFs, filepath.Join("testdata", folder)))(t).(subFS) //nolint:forcetypeassert
+	return must.Value(fs.Sub(subFs, filepath.Join("testdata", folder)))(t).(subFS) //nolint:forcetypeassert,errcheck
 }
 
 func equalDirs(t *testing.T, expected, actual subFS, cmpFn func(t *testing.T, expected, actual string)) {
diff --git a/internal/backend/runtime/omni/audit/walk_test.go b/internal/backend/runtime/omni/audit/walk_test.go
index da0e34a1..0294a867 100644
--- a/internal/backend/runtime/omni/audit/walk_test.go
+++ b/internal/backend/runtime/omni/audit/walk_test.go
@@ -59,7 +59,7 @@ func TestFindOldFiles(t *testing.T) {
 	now := time.Date(2012, 1, 30, 0, 0, 0, 1, time.Local)
 	thirtyDays := audit.TruncateToDate(now.AddDate(0, 0, -30))
 
-	dirFiles := must.Value(audit.GetDirFiles(must.Value(mapFS.Sub("logdir"))(t).(fs.ReadDirFS)))(t) //nolint:forcetypeassert
+	dirFiles := must.Value(audit.GetDirFiles(must.Value(mapFS.Sub("logdir"))(t).(fs.ReadDirFS)))(t) //nolint:forcetypeassert,errcheck
 	logFiles := audit.FilterLogFiles(dirFiles)
 	olderFiles := audit.FilterByTime(logFiles, time.Unix(0, 0), thirtyDays)
 
diff --git a/internal/backend/runtime/omni/controllers/omni/kubernetes_node_audit.go b/internal/backend/runtime/omni/controllers/omni/kubernetes_node_audit.go
index 11baf201..d19e97fd 100644
--- a/internal/backend/runtime/omni/controllers/omni/kubernetes_node_audit.go
+++ b/internal/backend/runtime/omni/controllers/omni/kubernetes_node_audit.go
@@ -285,11 +285,7 @@ func (auditor *nodeAuditor) unmarkNodesAsInvalid(cluster string, nodes []string)
 }
 
 func getKubernetesClient(ctx context.Context, cluster string) (KubernetesClient, error) {
-	type kubeRuntime interface {
-		GetClient(ctx context.Context, cluster string) (*kubernetes.Client, error)
-	}
-
-	k8s, err := runtime.LookupInterface[kubeRuntime](kubernetes.Name)
+	k8s, err := runtime.LookupInterface[kubernetesRuntime](kubernetes.Name)
 	if err != nil {
 		return nil, err
 	}
diff --git a/internal/backend/runtime/omni/controllers/omni/kubernetes_status.go b/internal/backend/runtime/omni/controllers/omni/kubernetes_status.go
index 584317dc..939f491c 100644
--- a/internal/backend/runtime/omni/controllers/omni/kubernetes_status.go
+++ b/internal/backend/runtime/omni/controllers/omni/kubernetes_status.go
@@ -523,11 +523,7 @@ var controlplanePodSelector = func() labels.Selector {
 }()
 
 func (ctrl *KubernetesStatusController) startWatcher(ctx context.Context, logger *zap.Logger, cluster string, notifyCh chan<- kubernetesWatcherNotify) error {
-	type kubernetesClient interface {
-		GetClient(ctx context.Context, cluster string) (*kubernetes.Client, error)
-	}
-
-	r, err := runtime.LookupInterface[kubernetesClient](kubernetes.Name)
+	r, err := runtime.LookupInterface[kubernetesRuntime](kubernetes.Name)
 	if err != nil {
 		return err
 	}
@@ -816,8 +812,8 @@ func IsExposedServiceEvent(k8sObject, oldK8sObject any, logger *zap.Logger) bool
 		return false
 	}
 
-	oldAnnotations := oldK8sObject.(*corev1.Service).GetObjectMeta().GetAnnotations() //nolint:forcetypeassert
-	newAnnotations := k8sObject.(*corev1.Service).GetObjectMeta().GetAnnotations()    //nolint:forcetypeassert
+	oldAnnotations := oldK8sObject.(*corev1.Service).GetObjectMeta().GetAnnotations() //nolint:forcetypeassert,errcheck
+	newAnnotations := k8sObject.(*corev1.Service).GetObjectMeta().GetAnnotations()    //nolint:forcetypeassert,errcheck
 
 	for _, key := range []string{ServiceLabelAnnotationKey, ServicePortAnnotationKey, ServiceIconAnnotationKey} {
 		if oldAnnotations[key] != newAnnotations[key] {
diff --git a/internal/backend/runtime/omni/controllers/omni/labels_extractor.go b/internal/backend/runtime/omni/controllers/omni/labels_extractor.go
index 08c63818..6c9888cf 100644
--- a/internal/backend/runtime/omni/controllers/omni/labels_extractor.go
+++ b/internal/backend/runtime/omni/controllers/omni/labels_extractor.go
@@ -39,7 +39,7 @@ func NewLabelsExtractorController[T generic.ResourceWithRD]() *qtransform.QContr
 
 				*res.Metadata() = resource.NewMetadata(rd.DefaultNamespace, rd.Type, labels.Metadata().ID(), resource.VersionUndefined)
 
-				return res.(T) //nolint:forcetypeassert
+				return res.(T) //nolint:forcetypeassert,errcheck
 			},
 			TransformFunc: func(_ context.Context, _ controller.Reader, _ *zap.Logger, res T, labels *system.ResourceLabels[T]) error {
 				*labels.Metadata().Labels() = *res.Metadata().Labels()
diff --git a/internal/backend/runtime/omni/controllers/omni/omni.go b/internal/backend/runtime/omni/controllers/omni/omni.go
index ae82fa03..4e836f08 100644
--- a/internal/backend/runtime/omni/controllers/omni/omni.go
+++ b/internal/backend/runtime/omni/controllers/omni/omni.go
@@ -16,6 +16,8 @@ import (
 	"github.com/cosi-project/runtime/pkg/resource"
 	"github.com/cosi-project/runtime/pkg/state"
 	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/internal/backend/runtime/kubernetes"
 )
 
 type cleanupOptions struct {
@@ -168,3 +170,7 @@ func (c cleanupChecker[Input]) Inputs() []controller.Input {
 func (c cleanupChecker[Input]) Outputs() []controller.Output {
 	return c.next.Outputs()
 }
+
+type kubernetesRuntime interface {
+	GetClient(ctx context.Context, cluster string) (*kubernetes.Client, error)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/schematic_configuration.go b/internal/backend/runtime/omni/controllers/omni/schematic_configuration.go
index e6769032..4ce3ba76 100644
--- a/internal/backend/runtime/omni/controllers/omni/schematic_configuration.go
+++ b/internal/backend/runtime/omni/controllers/omni/schematic_configuration.go
@@ -282,6 +282,7 @@ func updateFinalizers(ctx context.Context, r controller.ReaderWriter, extensions
 	return r.AddFinalizer(ctx, extensions.Metadata(), SchematicConfigurationControllerName)
 }
 
+//nolint:recvcheck
 type machineExtensions struct {
 	machineStatus      *omni.MachineStatus
 	machineExtensions  *omni.MachineExtensions
diff --git a/internal/backend/runtime/omni/validated/errors.go b/internal/backend/runtime/omni/validated/errors.go
index c540b6f7..d871ca6d 100644
--- a/internal/backend/runtime/omni/validated/errors.go
+++ b/internal/backend/runtime/omni/validated/errors.go
@@ -38,6 +38,7 @@ func IsValidationError(err error) bool {
 	return sts.Code() == codes.InvalidArgument && strings.HasPrefix(sts.Message(), errPrefix)
 }
 
+//nolint:errname
 type eValidation struct {
 	error
 }
diff --git a/internal/backend/runtime/omni/virtual/errors.go b/internal/backend/runtime/omni/virtual/errors.go
index 8590528a..2974f38a 100644
--- a/internal/backend/runtime/omni/virtual/errors.go
+++ b/internal/backend/runtime/omni/virtual/errors.go
@@ -13,6 +13,7 @@ import (
 	"google.golang.org/grpc/status"
 )
 
+//nolint:errname
 type eNotFound struct {
 	error
 }
@@ -25,6 +26,7 @@ func errNotFound(r resource.Pointer) error {
 	}
 }
 
+//nolint:errname
 type eUnsupported struct {
 	error
 }
diff --git a/internal/backend/runtime/runtime_test.go b/internal/backend/runtime/runtime_test.go
index 8cf1ae81..28d24c02 100644
--- a/internal/backend/runtime/runtime_test.go
+++ b/internal/backend/runtime/runtime_test.go
@@ -16,6 +16,7 @@ import (
 	"github.com/siderolabs/omni/internal/backend/runtime/kubernetes"
 )
 
+//nolint:iface
 func TestInstall_LookupInterface(t *testing.T) {
 	k8s, err := kubernetes.New(nil)
 	require.NoError(t, err)
diff --git a/internal/pkg/config/auth.go b/internal/pkg/config/auth.go
index 19cd8a90..e057ce5e 100644
--- a/internal/pkg/config/auth.go
+++ b/internal/pkg/config/auth.go
@@ -41,6 +41,8 @@ type SAMLParams struct {
 }
 
 // SAMLLabelRules defines mapping of SAML assertion attributes to Omni identity labels.
+//
+//nolint:recvcheck
 type SAMLLabelRules map[string]string
 
 // String implements pflag.Value.
diff --git a/internal/pkg/ctxstore/ctxstore.go b/internal/pkg/ctxstore/ctxstore.go
index 9a24548f..bb58e1f3 100644
--- a/internal/pkg/ctxstore/ctxstore.go
+++ b/internal/pkg/ctxstore/ctxstore.go
@@ -31,5 +31,5 @@ func Value[T any](ctx context.Context) (T, bool) {
 		return *new(T), false
 	}
 
-	return value.(T), true //nolint:forcetypeassert
+	return value.(T), true //nolint:forcetypeassert,errcheck
 }
diff --git a/internal/pkg/grpcutil/logger.go b/internal/pkg/grpcutil/logger.go
index df18d8f5..b37c5045 100644
--- a/internal/pkg/grpcutil/logger.go
+++ b/internal/pkg/grpcutil/logger.go
@@ -63,7 +63,7 @@ func NewRewriter[T proto.Message](f func(T) (T, bool)) Rewriter {
 			return req, false
 		}
 
-		return f(proto.Clone(typedReq).(T)) //nolint:forcetypeassert
+		return f(proto.Clone(typedReq).(T)) //nolint:forcetypeassert,errcheck
 	}
 }
 
diff --git a/internal/pkg/pool/pool.go b/internal/pkg/pool/pool.go
index b18bf84d..213d817a 100644
--- a/internal/pkg/pool/pool.go
+++ b/internal/pkg/pool/pool.go
@@ -24,7 +24,7 @@ type Pool[T any] struct {
 func (p *Pool[T]) Get() *T {
 	p.once.Do(func() { p.pool.New = func() any { return p.New() } })
 
-	return p.pool.Get().(*T) //nolint:forcetypeassert
+	return p.pool.Get().(*T) //nolint:forcetypeassert,errcheck
 }
 
 // Put returns an instance of the type to the pool.
diff --git a/internal/pkg/xmocks/xmocks.go b/internal/pkg/xmocks/xmocks.go
index 992d17a8..b06e6e69 100644
--- a/internal/pkg/xmocks/xmocks.go
+++ b/internal/pkg/xmocks/xmocks.go
@@ -33,7 +33,7 @@ func Name(method any) string {
 func GetAs[T any](m mock.Arguments, i int) T {
 	res := m.Get(i)
 	if res != nil {
-		return res.(T) //nolint:forcetypeassert
+		return res.(T) //nolint:forcetypeassert,errcheck
 	}
 
 	switch typ := reflect.TypeOf((*T)(nil)).Elem(); typ.Kind() { //nolint:exhaustive