diff --git a/hscontrol/app.go b/hscontrol/app.go
index 9eb80e5a..822de62b 100644
--- a/hscontrol/app.go
+++ b/hscontrol/app.go
@@ -299,7 +299,7 @@ func (h *Headscale) scheduledTasks(ctx context.Context) {
 		case <-derpTickerChan:
 			log.Info().Msg("fetching DERPMap updates")
 
-			derpMap, err := backoff.Retry(ctx, func() (*tailcfg.DERPMap, error) {
+			derpMap, err := backoff.Retry(ctx, func() (*tailcfg.DERPMap, error) { //nolint:contextcheck
 				derpMap, err := derp.GetDERPMap(h.cfg.DERP)
 				if err != nil {
 					return nil, err
diff --git a/hscontrol/noise.go b/hscontrol/noise.go
index a09d9340..75e65869 100644
--- a/hscontrol/noise.go
+++ b/hscontrol/noise.go
@@ -248,7 +248,7 @@ func (ns *noiseServer) NoiseRegistrationHandler(
 		return
 	}
 
-	registerRequest, registerResponse := func() (*tailcfg.RegisterRequest, *tailcfg.RegisterResponse) {
+	registerRequest, registerResponse := func() (*tailcfg.RegisterRequest, *tailcfg.RegisterResponse) { //nolint:contextcheck
 		var resp *tailcfg.RegisterResponse
 
 		body, err := io.ReadAll(req.Body)
diff --git a/hscontrol/oidc.go b/hscontrol/oidc.go
index 3fef1703..c07694e3 100644
--- a/hscontrol/oidc.go
+++ b/hscontrol/oidc.go
@@ -68,7 +68,7 @@ func NewAuthProviderOIDC(
 ) (*AuthProviderOIDC, error) {
 	var err error
 	// grab oidc config if it hasn't been already
-	oidcProvider, err := oidc.NewProvider(context.Background(), cfg.Issuer)
+	oidcProvider, err := oidc.NewProvider(context.Background(), cfg.Issuer) //nolint:contextcheck
 	if err != nil {
 		return nil, fmt.Errorf("creating OIDC provider from issuer config: %w", err)
 	}
diff --git a/hscontrol/poll.go b/hscontrol/poll.go
index 75b57c3c..d4649581 100644
--- a/hscontrol/poll.go
+++ b/hscontrol/poll.go
@@ -30,7 +30,7 @@ const nodeNameContextKey = contextKey("nodeName")
 type mapSession struct {
 	h      *Headscale
 	req    tailcfg.MapRequest
-	ctx    context.Context
+	ctx    context.Context //nolint:containedctx
 	capVer tailcfg.CapabilityVersion
 
 	cancelChMu deadlock.Mutex
diff --git a/hscontrol/types/users.go b/hscontrol/types/users.go
index 6f9a97e7..12f79b3d 100644
--- a/hscontrol/types/users.go
+++ b/hscontrol/types/users.go
@@ -61,7 +61,7 @@ func (u Users) String() string {
 // At the end of the day, users in Tailscale are some kind of 'bubbles' or users
 // that contain our machines.
 type User struct {
-	gorm.Model
+	gorm.Model //nolint:embeddedstructfieldcheck
 
 	// The index `idx_name_provider_identifier` is to enforce uniqueness
 	// between Name and ProviderIdentifier. This ensures that
diff --git a/integration/cli_test.go b/integration/cli_test.go
index 65d82444..83a48c35 100644
--- a/integration/cli_test.go
+++ b/integration/cli_test.go
@@ -1658,7 +1658,7 @@ func TestPolicyCommand(t *testing.T) {
 		},
 	}
 
-	pBytes, _ := json.Marshal(p)
+	pBytes, _ := json.Marshal(p) //nolint:errchkjson
 
 	policyFilePath := "/etc/headscale/policy.json"
 
@@ -1745,7 +1745,7 @@ func TestPolicyBrokenConfigCommand(t *testing.T) {
 		},
 	}
 
-	pBytes, _ := json.Marshal(p)
+	pBytes, _ := json.Marshal(p) //nolint:errchkjson
 
 	policyFilePath := "/etc/headscale/policy.json"
 
diff --git a/integration/dns_test.go b/integration/dns_test.go
index e937a421..dbbc222a 100644
--- a/integration/dns_test.go
+++ b/integration/dns_test.go
@@ -93,7 +93,7 @@ func TestResolveMagicDNSExtraRecordsPath(t *testing.T) {
 			Value: "6.6.6.6",
 		},
 	}
-	b, _ := json.Marshal(extraRecords)
+	b, _ := json.Marshal(extraRecords) //nolint:errchkjson
 
 	err = scenario.CreateHeadscaleEnv([]tsic.Option{
 		tsic.WithPackages("python3", "curl", "bind-tools"),
@@ -133,7 +133,7 @@ func TestResolveMagicDNSExtraRecordsPath(t *testing.T) {
 	require.NoError(t, err)
 
 	// Write the file directly into place from the docker API.
-	b0, _ := json.Marshal([]tailcfg.DNSRecord{
+	b0, _ := json.Marshal([]tailcfg.DNSRecord{ //nolint:errchkjson
 		{
 			Name:  "docker.myvpn.example.com",
 			Type:  "A",
@@ -155,7 +155,7 @@ func TestResolveMagicDNSExtraRecordsPath(t *testing.T) {
 		Type:  "A",
 		Value: "7.7.7.7",
 	})
-	b2, _ := json.Marshal(extraRecords)
+	b2, _ := json.Marshal(extraRecords) //nolint:errchkjson
 
 	err = hs.WriteFile(erPath+"2", b2)
 	require.NoError(t, err)