diff --git a/cmd/headscale/cli/mockoidc.go b/cmd/headscale/cli/mockoidc.go
index e7c42dc6..d5da5852 100644
--- a/cmd/headscale/cli/mockoidc.go
+++ b/cmd/headscale/cli/mockoidc.go
@@ -2,7 +2,6 @@ package cli
 
 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"net"
 	"net/http"
@@ -20,6 +19,7 @@ const (
 	errMockOidcClientIDNotDefined     = Error("MOCKOIDC_CLIENT_ID not defined")
 	errMockOidcClientSecretNotDefined = Error("MOCKOIDC_CLIENT_SECRET not defined")
 	errMockOidcPortNotDefined         = Error("MOCKOIDC_PORT not defined")
+	errMockOidcUsersNotDefined        = Error("MOCKOIDC_USERS not defined")
 	refreshTTL                        = 60 * time.Minute
 )
 
@@ -75,7 +75,7 @@ func mockOIDC() error {
 
 	userStr := os.Getenv("MOCKOIDC_USERS")
 	if userStr == "" {
-		return errors.New("MOCKOIDC_USERS not defined")
+		return errMockOidcUsersNotDefined
 	}
 
 	var users []mockoidc.MockUser
diff --git a/cmd/headscale/cli/users.go b/cmd/headscale/cli/users.go
index 7668bac8..9f65aaca 100644
--- a/cmd/headscale/cli/users.go
+++ b/cmd/headscale/cli/users.go
@@ -15,6 +15,12 @@ import (
 	"google.golang.org/grpc/status"
 )
 
+// CLI user errors.
+var (
+	errFlagRequired       = errors.New("--name or --identifier flag is required")
+	errMultipleUsersMatch = errors.New("multiple users match query, specify an ID")
+)
+
 func usernameAndIDFlag(cmd *cobra.Command) {
 	cmd.Flags().Int64P("identifier", "i", -1, "User identifier (ID)")
 	cmd.Flags().StringP("name", "n", "", "Username")
@@ -27,10 +33,9 @@ func usernameAndIDFromFlag(cmd *cobra.Command) (uint64, string) {
 
 	identifier, _ := cmd.Flags().GetInt64("identifier")
 	if username == "" && identifier < 0 {
-		err := errors.New("--name or --identifier flag is required")
 		ErrorOutput(
-			err,
-			"Cannot rename user: "+status.Convert(err).Message(),
+			errFlagRequired,
+			"Cannot rename user: "+status.Convert(errFlagRequired).Message(),
 			"",
 		)
 	}
@@ -151,7 +156,7 @@ var destroyUserCmd = &cobra.Command{
 		}
 
 		if len(users.GetUsers()) != 1 {
-			err := errors.New("multiple users match query, specify an ID")
+			err := errMultipleUsersMatch
 			ErrorOutput(
 				err,
 				"Error: "+status.Convert(err).Message(),
@@ -279,7 +284,7 @@ var renameUserCmd = &cobra.Command{
 		}
 
 		if len(users.GetUsers()) != 1 {
-			err := errors.New("multiple users match query, specify an ID")
+			err := errMultipleUsersMatch
 			ErrorOutput(
 				err,
 				"Error: "+status.Convert(err).Message(),
diff --git a/cmd/hi/docker.go b/cmd/hi/docker.go
index 388f46e8..dc65ec3d 100644
--- a/cmd/hi/docker.go
+++ b/cmd/hi/docker.go
@@ -28,6 +28,7 @@ var (
 	ErrTestFailed              = errors.New("test failed")
 	ErrUnexpectedContainerWait = errors.New("unexpected end of container wait")
 	ErrNoDockerContext         = errors.New("no docker context found")
+	ErrMemoryLimitViolations   = errors.New("container(s) exceeded memory limits")
 )
 
 // runTestContainer executes integration tests in a Docker container.
@@ -155,7 +156,7 @@ func runTestContainer(ctx context.Context, config *RunConfig) error {
 					violation.ContainerName, violation.MaxMemoryMB, violation.LimitMB)
 			}
 
-			return fmt.Errorf("test failed: %d container(s) exceeded memory limits", len(violations))
+			return fmt.Errorf("test failed: %d %w", len(violations), ErrMemoryLimitViolations)
 		}
 	}
 
diff --git a/cmd/hi/stats.go b/cmd/hi/stats.go
index 84ceee2b..191bbdd0 100644
--- a/cmd/hi/stats.go
+++ b/cmd/hi/stats.go
@@ -18,6 +18,9 @@ import (
 	"github.com/docker/docker/client"
 )
 
+// ErrStatsCollectionAlreadyStarted is returned when trying to start stats collection that is already running.
+var ErrStatsCollectionAlreadyStarted = errors.New("stats collection already started")
+
 // ContainerStats represents statistics for a single container.
 type ContainerStats struct {
 	ContainerID   string
@@ -63,7 +66,7 @@ func (sc *StatsCollector) StartCollection(ctx context.Context, runID string, ver
 	defer sc.mutex.Unlock()
 
 	if sc.collectionStarted {
-		return errors.New("stats collection already started")
+		return ErrStatsCollectionAlreadyStarted
 	}
 
 	sc.collectionStarted = true
diff --git a/hscontrol/auth_test.go b/hscontrol/auth_test.go
index e3d75ed6..4c3c9bf7 100644
--- a/hscontrol/auth_test.go
+++ b/hscontrol/auth_test.go
@@ -2718,7 +2718,7 @@ func extractRegistrationIDFromAuthURL(authURL string) (types.RegistrationID, err
 
 	idx := strings.LastIndex(authURL, registerPrefix)
 	if idx == -1 {
-		return "", fmt.Errorf("invalid AuthURL format: %s", authURL)
+		return "", fmt.Errorf("invalid AuthURL format: %s", authURL) //nolint:err113
 	}
 
 	idStr := authURL[idx+len(registerPrefix):]
diff --git a/hscontrol/state/node_store_test.go b/hscontrol/state/node_store_test.go
index 1136cf60..e29857b5 100644
--- a/hscontrol/state/node_store_test.go
+++ b/hscontrol/state/node_store_test.go
@@ -1004,19 +1004,19 @@ func TestNodeStoreRaceConditions(t *testing.T) {
 						n.Hostname = "race-updated"
 					})
 					if !resultNode.Valid() {
-						errors <- fmt.Errorf("UpdateNode failed in goroutine %d, op %d", gid, j)
+						errors <- fmt.Errorf("UpdateNode failed in goroutine %d, op %d", gid, j) //nolint:err113
 					}
 				case 1:
 					retrieved, found := store.GetNode(nodeID)
 					if !found || !retrieved.Valid() {
-						errors <- fmt.Errorf("GetNode failed in goroutine %d, op %d", gid, j)
+						errors <- fmt.Errorf("GetNode failed in goroutine %d, op %d", gid, j) //nolint:err113
 					}
 				case 2:
 					newNode := createConcurrentTestNode(nodeID, "race-put")
 
 					resultNode := store.PutNode(newNode)
 					if !resultNode.Valid() {
-						errors <- fmt.Errorf("PutNode failed in goroutine %d, op %d", gid, j)
+						errors <- fmt.Errorf("PutNode failed in goroutine %d, op %d", gid, j) //nolint:err113
 					}
 				}
 			}
@@ -1116,7 +1116,7 @@ func TestNodeStoreOperationTimeout(t *testing.T) {
 			fmt.Printf("[TestNodeStoreOperationTimeout] %s: PutNode(%d) finished, valid=%v, duration=%v\n", endPut.Format("15:04:05.000"), id, resultNode.Valid(), endPut.Sub(startPut))
 
 			if !resultNode.Valid() {
-				putResults[idx-1] = fmt.Errorf("PutNode failed for node %d", id)
+				putResults[idx-1] = fmt.Errorf("PutNode failed for node %d", id) //nolint:err113
 			}
 		}(i, nodeID)
 	}
@@ -1143,7 +1143,7 @@ func TestNodeStoreOperationTimeout(t *testing.T) {
 			fmt.Printf("[TestNodeStoreOperationTimeout] %s: UpdateNode(%d) finished, valid=%v, ok=%v, duration=%v\n", endUpdate.Format("15:04:05.000"), id, resultNode.Valid(), ok, endUpdate.Sub(startUpdate))
 
 			if !ok || !resultNode.Valid() {
-				updateResults[idx-1] = fmt.Errorf("UpdateNode failed for node %d", id)
+				updateResults[idx-1] = fmt.Errorf("UpdateNode failed for node %d", id) //nolint:err113
 			}
 		}(i, nodeID)
 	}