diff --git a/.golangci.yaml b/.golangci.yaml
index 4ccaefc9a9..b2001541ea 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -36,13 +36,8 @@ linters:
         # Reasonable rule, but not sure what to replace with in
         # many locations, so disabling for now
         - exitAfterDefer
-        # The following 3 rules are disabled from the perfomance tag
-        # enabled further down. The first two are reasonable, but not
-        # super important. appendCombine is really nice though! And
-        # should be enabled. Just many places to fix..
+        # This is disabled from the perfomance tag  enabled further down.
         - hugeParam
-        - preferFprint
-        - appendCombine
       enabled-tags:
         - performance
       settings:
@@ -53,6 +48,9 @@ linters:
           # switch)... just too many violations right now
           minThreshold: 10
     govet:
+      disable:
+        # enable later and fix
+        - buildtag
       enable:
         - deepequalerrors
         - nilness
diff --git a/Makefile b/Makefile
index 4e239a1e99..993be5ece0 100644
--- a/Makefile
+++ b/Makefile
@@ -24,7 +24,7 @@ ifeq ($(WASM_ENABLED),1)
 GO_TAGS = -tags=opa_wasm
 endif
 
-GOLANGCI_LINT_VERSION := v2.4.0
+GOLANGCI_LINT_VERSION := v2.6.2
 YAML_LINT_VERSION := 0.29.0
 YAML_LINT_FORMAT ?= auto
 
diff --git a/ast/visit.go b/ast/visit.go
index f4f2459ecc..f785b8c104 100644
--- a/ast/visit.go
+++ b/ast/visit.go
@@ -10,16 +10,19 @@ import v1 "github.com/open-policy-agent/opa/v1/ast"
 // can return a Visitor w which will be used to visit the children of the AST
 // element v. If the Visit function returns nil, the children will not be
 // visited.
+//
 // Deprecated: use GenericVisitor or another visitor implementation
 type Visitor = v1.Visitor
 
 // BeforeAndAfterVisitor wraps Visitor to provide hooks for being called before
 // and after the AST has been visited.
+//
 // Deprecated: use GenericVisitor or another visitor implementation
 type BeforeAndAfterVisitor = v1.BeforeAndAfterVisitor
 
 // Walk iterates the AST by calling the Visit function on the Visitor
 // v for x before recursing.
+//
 // Deprecated: use GenericVisitor.Walk
 func Walk(v Visitor, x any) {
 	v1.Walk(v, x)
@@ -27,6 +30,7 @@ func Walk(v Visitor, x any) {
 
 // WalkBeforeAndAfter iterates the AST by calling the Visit function on the
 // Visitor v for x before recursing.
+//
 // Deprecated: use GenericVisitor.Walk
 func WalkBeforeAndAfter(v BeforeAndAfterVisitor, x any) {
 	v1.WalkBeforeAndAfter(v, x)
diff --git a/bundle/store.go b/bundle/store.go
index 9659d67bde..85b8515eb2 100644
--- a/bundle/store.go
+++ b/bundle/store.go
@@ -100,24 +100,28 @@ func Deactivate(opts *DeactivateOpts) error {
 }
 
 // LegacyWriteManifestToStore will write the bundle manifest to the older single (unnamed) bundle manifest location.
+//
 // Deprecated: Use WriteManifestToStore and named bundles instead.
 func LegacyWriteManifestToStore(ctx context.Context, store storage.Store, txn storage.Transaction, manifest Manifest) error {
 	return v1.LegacyWriteManifestToStore(ctx, store, txn, manifest)
 }
 
 // LegacyEraseManifestFromStore will erase the bundle manifest from the older single (unnamed) bundle manifest location.
+//
 // Deprecated: Use WriteManifestToStore and named bundles instead.
 func LegacyEraseManifestFromStore(ctx context.Context, store storage.Store, txn storage.Transaction) error {
 	return v1.LegacyEraseManifestFromStore(ctx, store, txn)
 }
 
 // LegacyReadRevisionFromStore will read the bundle manifest revision from the older single (unnamed) bundle manifest location.
+//
 // Deprecated: Use ReadBundleRevisionFromStore and named bundles instead.
 func LegacyReadRevisionFromStore(ctx context.Context, store storage.Store, txn storage.Transaction) (string, error) {
 	return v1.LegacyReadRevisionFromStore(ctx, store, txn)
 }
 
 // ActivateLegacy calls Activate for the bundles but will also write their manifest to the older unnamed store location.
+//
 // Deprecated: Use Activate with named bundles instead.
 func ActivateLegacy(opts *ActivateOpts) error {
 	return v1.ActivateLegacy(opts)
diff --git a/internal/compiler/wasm/wasm.go b/internal/compiler/wasm/wasm.go
index 25cbc13b47..81dcac92b8 100644
--- a/internal/compiler/wasm/wasm.go
+++ b/internal/compiler/wasm/wasm.go
@@ -32,7 +32,7 @@ const (
 	opaWasmABIMinorVersionVar = "opa_wasm_abi_minor_version"
 )
 
-// nolint: deadcode,varcheck
+// nolint: varcheck
 const (
 	opaTypeNull int32 = iota + 1
 	opaTypeBoolean
@@ -414,7 +414,7 @@ func (c *Compiler) initModule() error {
 				},
 			},
 		},
-		Init: bytes.Repeat([]byte{0}, int(heapBase-offset)),
+		Init: make([]byte, int(heapBase-offset)),
 	})
 
 	return nil
@@ -1058,9 +1058,11 @@ func (c *Compiler) compileBlock(block *ir.Block) ([]instruction.Instruction, err
 				},
 			})
 		case *ir.AssignIntStmt:
-			instrs = append(instrs, instruction.GetLocal{Index: c.local(stmt.Target)})
-			instrs = append(instrs, instruction.I64Const{Value: stmt.Value})
-			instrs = append(instrs, instruction.Call{Index: c.function(opaValueNumberSetInt)})
+			instrs = append(instrs,
+				instruction.GetLocal{Index: c.local(stmt.Target)},
+				instruction.I64Const{Value: stmt.Value},
+				instruction.Call{Index: c.function(opaValueNumberSetInt)},
+			)
 		case *ir.ScanStmt:
 			if err := c.compileScan(stmt, &instrs); err != nil {
 				return nil, err
@@ -1073,12 +1075,14 @@ func (c *Compiler) compileBlock(block *ir.Block) ([]instruction.Instruction, err
 			}
 		case *ir.DotStmt:
 			if loc, ok := stmt.Source.Value.(ir.Local); ok {
-				instrs = append(instrs, instruction.GetLocal{Index: c.local(loc)})
-				instrs = append(instrs, c.instrRead(stmt.Key))
-				instrs = append(instrs, instruction.Call{Index: c.function(opaValueGet)})
-				instrs = append(instrs, instruction.TeeLocal{Index: c.local(stmt.Target)})
-				instrs = append(instrs, instruction.I32Eqz{})
-				instrs = append(instrs, instruction.BrIf{Index: 0})
+				instrs = append(instrs,
+					instruction.GetLocal{Index: c.local(loc)},
+					c.instrRead(stmt.Key),
+					instruction.Call{Index: c.function(opaValueGet)},
+					instruction.TeeLocal{Index: c.local(stmt.Target)},
+					instruction.I32Eqz{},
+					instruction.BrIf{Index: 0},
+				)
 			} else {
 				// Booleans and string sources would lead to the BrIf (since opa_value_get
 				// on them returns 0), so let's skip trying that.
@@ -1086,97 +1090,131 @@ func (c *Compiler) compileBlock(block *ir.Block) ([]instruction.Instruction, err
 				break
 			}
 		case *ir.LenStmt:
-			instrs = append(instrs, c.instrRead(stmt.Source))
-			instrs = append(instrs, instruction.Call{Index: c.function(opaValueLength)})
-			instrs = append(instrs, instruction.Call{Index: c.function(opaNumberSize)})
-			instrs = append(instrs, instruction.SetLocal{Index: c.local(stmt.Target)})
+			instrs = append(instrs,
+				c.instrRead(stmt.Source),
+				instruction.Call{Index: c.function(opaValueLength)},
+				instruction.Call{Index: c.function(opaNumberSize)},
+				instruction.SetLocal{Index: c.local(stmt.Target)},
+			)
 		case *ir.EqualStmt:
-			instrs = append(instrs, c.instrRead(stmt.A))
-			instrs = append(instrs, c.instrRead(stmt.B))
-			instrs = append(instrs, instruction.Call{Index: c.function(opaValueCompare)})
-			instrs = append(instrs, instruction.BrIf{Index: 0})
+			instrs = append(instrs,
+				c.instrRead(stmt.A),
+				c.instrRead(stmt.B),
+				instruction.Call{Index: c.function(opaValueCompare)},
+				instruction.BrIf{Index: 0},
+			)
 		case *ir.NotEqualStmt:
-			instrs = append(instrs, c.instrRead(stmt.A))
-			instrs = append(instrs, c.instrRead(stmt.B))
-			instrs = append(instrs, instruction.Call{Index: c.function(opaValueCompare)})
-			instrs = append(instrs, instruction.I32Eqz{})
-			instrs = append(instrs, instruction.BrIf{Index: 0})
+			instrs = append(instrs,
+				c.instrRead(stmt.A),
+				c.instrRead(stmt.B),
+				instruction.Call{Index: c.function(opaValueCompare)},
+				instruction.I32Eqz{},
+				instruction.BrIf{Index: 0},
+			)
 		case *ir.MakeNullStmt:
-			instrs = append(instrs, instruction.Call{Index: c.function(opaNull)})
-			instrs = append(instrs, instruction.SetLocal{Index: c.local(stmt.Target)})
+			instrs = append(instrs,
+				instruction.Call{Index: c.function(opaNull)},
+				instruction.SetLocal{Index: c.local(stmt.Target)},
+			)
 		case *ir.MakeNumberIntStmt:
-			instrs = append(instrs, instruction.I64Const{Value: stmt.Value})
-			instrs = append(instrs, instruction.Call{Index: c.function(opaNumberInt)})
-			instrs = append(instrs, instruction.SetLocal{Index: c.local(stmt.Target)})
+			instrs = append(instrs,
+				instruction.I64Const{Value: stmt.Value},
+				instruction.Call{Index: c.function(opaNumberInt)},
+				instruction.SetLocal{Index: c.local(stmt.Target)},
+			)
 		case *ir.MakeNumberRefStmt:
-			instrs = append(instrs, instruction.I32Const{Value: c.stringAddr(stmt.Index)})
-			instrs = append(instrs, instruction.I32Const{Value: int32(len(c.policy.Static.Strings[stmt.Index].Value))})
-			instrs = append(instrs, instruction.Call{Index: c.function(opaNumberRef)})
-			instrs = append(instrs, instruction.SetLocal{Index: c.local(stmt.Target)})
+			instrs = append(instrs,
+				instruction.I32Const{Value: c.stringAddr(stmt.Index)},
+				instruction.I32Const{Value: int32(len(c.policy.Static.Strings[stmt.Index].Value))},
+				instruction.Call{Index: c.function(opaNumberRef)},
+				instruction.SetLocal{Index: c.local(stmt.Target)},
+			)
 		case *ir.MakeArrayStmt:
-			instrs = append(instrs, instruction.I32Const{Value: stmt.Capacity})
-			instrs = append(instrs, instruction.Call{Index: c.function(opaArrayWithCap)})
-			instrs = append(instrs, instruction.SetLocal{Index: c.local(stmt.Target)})
+			instrs = append(instrs,
+				instruction.I32Const{Value: stmt.Capacity},
+				instruction.Call{Index: c.function(opaArrayWithCap)},
+				instruction.SetLocal{Index: c.local(stmt.Target)},
+			)
 		case *ir.MakeObjectStmt:
-			instrs = append(instrs, instruction.Call{Index: c.function(opaObject)})
-			instrs = append(instrs, instruction.SetLocal{Index: c.local(stmt.Target)})
+			instrs = append(instrs,
+				instruction.Call{Index: c.function(opaObject)},
+				instruction.SetLocal{Index: c.local(stmt.Target)},
+			)
 		case *ir.MakeSetStmt:
-			instrs = append(instrs, instruction.Call{Index: c.function(opaSet)})
-			instrs = append(instrs, instruction.SetLocal{Index: c.local(stmt.Target)})
+			instrs = append(instrs,
+				instruction.Call{Index: c.function(opaSet)},
+				instruction.SetLocal{Index: c.local(stmt.Target)},
+			)
 		case *ir.IsArrayStmt:
 			if loc, ok := stmt.Source.Value.(ir.Local); ok {
-				instrs = append(instrs, instruction.GetLocal{Index: c.local(loc)})
-				instrs = append(instrs, instruction.Call{Index: c.function(opaValueType)})
-				instrs = append(instrs, instruction.I32Const{Value: opaTypeArray})
-				instrs = append(instrs, instruction.I32Ne{})
-				instrs = append(instrs, instruction.BrIf{Index: 0})
+				instrs = append(instrs,
+					instruction.GetLocal{Index: c.local(loc)},
+					instruction.Call{Index: c.function(opaValueType)},
+					instruction.I32Const{Value: opaTypeArray},
+					instruction.I32Ne{},
+					instruction.BrIf{Index: 0},
+				)
 			} else {
 				instrs = append(instrs, instruction.Br{Index: 0})
 				break
 			}
 		case *ir.IsObjectStmt:
 			if loc, ok := stmt.Source.Value.(ir.Local); ok {
-				instrs = append(instrs, instruction.GetLocal{Index: c.local(loc)})
-				instrs = append(instrs, instruction.Call{Index: c.function(opaValueType)})
-				instrs = append(instrs, instruction.I32Const{Value: opaTypeObject})
-				instrs = append(instrs, instruction.I32Ne{})
-				instrs = append(instrs, instruction.BrIf{Index: 0})
+				instrs = append(instrs,
+					instruction.GetLocal{Index: c.local(loc)},
+					instruction.Call{Index: c.function(opaValueType)},
+					instruction.I32Const{Value: opaTypeObject},
+					instruction.I32Ne{},
+					instruction.BrIf{Index: 0},
+				)
 			} else {
 				instrs = append(instrs, instruction.Br{Index: 0})
 				break
 			}
 		case *ir.IsSetStmt:
 			if loc, ok := stmt.Source.Value.(ir.Local); ok {
-				instrs = append(instrs, instruction.GetLocal{Index: c.local(loc)})
-				instrs = append(instrs, instruction.Call{Index: c.function(opaValueType)})
-				instrs = append(instrs, instruction.I32Const{Value: opaTypeSet})
-				instrs = append(instrs, instruction.I32Ne{})
-				instrs = append(instrs, instruction.BrIf{Index: 0})
+				instrs = append(instrs,
+					instruction.GetLocal{Index: c.local(loc)},
+					instruction.Call{Index: c.function(opaValueType)},
+					instruction.I32Const{Value: opaTypeSet},
+					instruction.I32Ne{},
+					instruction.BrIf{Index: 0},
+				)
 			} else {
 				instrs = append(instrs, instruction.Br{Index: 0})
 				break
 			}
 		case *ir.IsUndefinedStmt:
-			instrs = append(instrs, instruction.GetLocal{Index: c.local(stmt.Source)})
-			instrs = append(instrs, instruction.I32Const{Value: 0})
-			instrs = append(instrs, instruction.I32Ne{})
-			instrs = append(instrs, instruction.BrIf{Index: 0})
+			instrs = append(instrs,
+				instruction.GetLocal{Index: c.local(stmt.Source)},
+				instruction.I32Const{Value: 0},
+				instruction.I32Ne{},
+				instruction.BrIf{Index: 0},
+			)
 		case *ir.ResetLocalStmt:
-			instrs = append(instrs, instruction.I32Const{Value: 0})
-			instrs = append(instrs, instruction.SetLocal{Index: c.local(stmt.Target)})
+			instrs = append(instrs,
+				instruction.I32Const{Value: 0},
+				instruction.SetLocal{Index: c.local(stmt.Target)},
+			)
 		case *ir.IsDefinedStmt:
-			instrs = append(instrs, instruction.GetLocal{Index: c.local(stmt.Source)})
-			instrs = append(instrs, instruction.I32Eqz{})
-			instrs = append(instrs, instruction.BrIf{Index: 0})
+			instrs = append(instrs,
+				instruction.GetLocal{Index: c.local(stmt.Source)},
+				instruction.I32Eqz{},
+				instruction.BrIf{Index: 0},
+			)
 		case *ir.ArrayAppendStmt:
-			instrs = append(instrs, instruction.GetLocal{Index: c.local(stmt.Array)})
-			instrs = append(instrs, c.instrRead(stmt.Value))
-			instrs = append(instrs, instruction.Call{Index: c.function(opaArrayAppend)})
+			instrs = append(instrs,
+				instruction.GetLocal{Index: c.local(stmt.Array)},
+				c.instrRead(stmt.Value),
+				instruction.Call{Index: c.function(opaArrayAppend)},
+			)
 		case *ir.ObjectInsertStmt:
-			instrs = append(instrs, instruction.GetLocal{Index: c.local(stmt.Object)})
-			instrs = append(instrs, c.instrRead(stmt.Key))
-			instrs = append(instrs, c.instrRead(stmt.Value))
-			instrs = append(instrs, instruction.Call{Index: c.function(opaObjectInsert)})
+			instrs = append(instrs,
+				instruction.GetLocal{Index: c.local(stmt.Object)},
+				c.instrRead(stmt.Key),
+				c.instrRead(stmt.Value),
+				instruction.Call{Index: c.function(opaObjectInsert)},
+			)
 		case *ir.ObjectInsertOnceStmt:
 			tmp := c.genLocal()
 			instrs = append(instrs, instruction.Block{
@@ -1203,14 +1241,18 @@ func (c *Compiler) compileBlock(block *ir.Block) ([]instruction.Instruction, err
 				},
 			})
 		case *ir.ObjectMergeStmt:
-			instrs = append(instrs, instruction.GetLocal{Index: c.local(stmt.A)})
-			instrs = append(instrs, instruction.GetLocal{Index: c.local(stmt.B)})
-			instrs = append(instrs, instruction.Call{Index: c.function(opaValueMerge)})
-			instrs = append(instrs, instruction.SetLocal{Index: c.local(stmt.Target)})
+			instrs = append(instrs,
+				instruction.GetLocal{Index: c.local(stmt.A)},
+				instruction.GetLocal{Index: c.local(stmt.B)},
+				instruction.Call{Index: c.function(opaValueMerge)},
+				instruction.SetLocal{Index: c.local(stmt.Target)},
+			)
 		case *ir.SetAddStmt:
-			instrs = append(instrs, instruction.GetLocal{Index: c.local(stmt.Set)})
-			instrs = append(instrs, c.instrRead(stmt.Value))
-			instrs = append(instrs, instruction.Call{Index: c.function(opaSetAdd)})
+			instrs = append(instrs,
+				instruction.GetLocal{Index: c.local(stmt.Set)},
+				c.instrRead(stmt.Value),
+				instruction.Call{Index: c.function(opaSetAdd)},
+			)
 		default:
 			var buf bytes.Buffer
 			err := ir.Pretty(&buf, stmt)
@@ -1226,8 +1268,7 @@ func (c *Compiler) compileBlock(block *ir.Block) ([]instruction.Instruction, err
 
 func (c *Compiler) compileScan(scan *ir.ScanStmt, result *[]instruction.Instruction) error {
 	var instrs = *result
-	instrs = append(instrs, instruction.I32Const{Value: 0})
-	instrs = append(instrs, instruction.SetLocal{Index: c.local(scan.Key)})
+	instrs = append(instrs, instruction.I32Const{Value: 0}, instruction.SetLocal{Index: c.local(scan.Key)})
 	body, err := c.compileScanBlock(scan)
 	if err != nil {
 		return err
@@ -1242,23 +1283,21 @@ func (c *Compiler) compileScan(scan *ir.ScanStmt, result *[]instruction.Instruct
 }
 
 func (c *Compiler) compileScanBlock(scan *ir.ScanStmt) ([]instruction.Instruction, error) {
-	var instrs []instruction.Instruction
-
-	// Execute iterator.
-	instrs = append(instrs, instruction.GetLocal{Index: c.local(scan.Source)})
-	instrs = append(instrs, instruction.GetLocal{Index: c.local(scan.Key)})
-	instrs = append(instrs, instruction.Call{Index: c.function(opaValueIter)})
-
-	// Check for emptiness.
-	instrs = append(instrs, instruction.TeeLocal{Index: c.local(scan.Key)})
-	instrs = append(instrs, instruction.I32Eqz{})
-	instrs = append(instrs, instruction.BrIf{Index: 1})
-
-	// Load value.
-	instrs = append(instrs, instruction.GetLocal{Index: c.local(scan.Source)})
-	instrs = append(instrs, instruction.GetLocal{Index: c.local(scan.Key)})
-	instrs = append(instrs, instruction.Call{Index: c.function(opaValueGet)})
-	instrs = append(instrs, instruction.SetLocal{Index: c.local(scan.Value)})
+	instrs := []instruction.Instruction{
+		// Execute iterator.
+		instruction.GetLocal{Index: c.local(scan.Source)},
+		instruction.GetLocal{Index: c.local(scan.Key)},
+		instruction.Call{Index: c.function(opaValueIter)},
+		// Check for emptiness.
+		instruction.TeeLocal{Index: c.local(scan.Key)},
+		instruction.I32Eqz{},
+		instruction.BrIf{Index: 1},
+		// Load value.
+		instruction.GetLocal{Index: c.local(scan.Source)},
+		instruction.GetLocal{Index: c.local(scan.Key)},
+		instruction.Call{Index: c.function(opaValueGet)},
+		instruction.SetLocal{Index: c.local(scan.Value)},
+	}
 
 	// Loop body.
 	nested, err := c.compileBlock(scan.Block)
@@ -1278,8 +1317,7 @@ func (c *Compiler) compileNot(not *ir.NotStmt, result *[]instruction.Instruction
 
 	// generate and initialize condition variable
 	cond := c.genLocal()
-	instrs = append(instrs, instruction.I32Const{Value: 1})
-	instrs = append(instrs, instruction.SetLocal{Index: cond})
+	instrs = append(instrs, instruction.I32Const{Value: 1}, instruction.SetLocal{Index: cond})
 
 	nested, err := c.compileBlock(not.Block)
 	if err != nil {
@@ -1287,14 +1325,15 @@ func (c *Compiler) compileNot(not *ir.NotStmt, result *[]instruction.Instruction
 	}
 
 	// unset condition variable if end of block is reached
-	nested = append(nested, instruction.I32Const{Value: 0})
-	nested = append(nested, instruction.SetLocal{Index: cond})
-	instrs = append(instrs, instruction.Block{Instrs: nested})
-
-	// break out of block if condition variable was unset
-	instrs = append(instrs, instruction.GetLocal{Index: cond})
-	instrs = append(instrs, instruction.I32Eqz{})
-	instrs = append(instrs, instruction.BrIf{Index: 0})
+	instrs = append(instrs, instruction.Block{Instrs: append(nested,
+		instruction.I32Const{Value: 0},
+		instruction.SetLocal{Index: cond},
+	)},
+		// break out of block if condition variable was unset
+		instruction.GetLocal{Index: cond},
+		instruction.I32Eqz{},
+		instruction.BrIf{Index: 0},
+	)
 
 	*result = instrs
 	return nil
@@ -1304,34 +1343,36 @@ func (c *Compiler) compileWithStmt(with *ir.WithStmt, result *[]instruction.Inst
 
 	var instrs = *result
 	save := c.genLocal()
-	instrs = append(instrs, instruction.Call{Index: c.function(opaMemoizePush)})
-	instrs = append(instrs, instruction.GetLocal{Index: c.local(with.Local)})
-	instrs = append(instrs, instruction.SetLocal{Index: save})
+	instrs = append(instrs,
+		instruction.Call{Index: c.function(opaMemoizePush)},
+		instruction.GetLocal{Index: c.local(with.Local)},
+		instruction.SetLocal{Index: save},
+	)
 
 	if len(with.Path) == 0 {
-		instrs = append(instrs, c.instrRead(with.Value))
-		instrs = append(instrs, instruction.SetLocal{Index: c.local(with.Local)})
+		instrs = append(instrs, c.instrRead(with.Value), instruction.SetLocal{Index: c.local(with.Local)})
 	} else {
 		instrs = c.compileUpsert(with.Local, with.Path, with.Value, with.Location, instrs)
 	}
 
 	undefined := c.genLocal()
-	instrs = append(instrs, instruction.I32Const{Value: 1})
-	instrs = append(instrs, instruction.SetLocal{Index: undefined})
+	instrs = append(instrs, instruction.I32Const{Value: 1}, instruction.SetLocal{Index: undefined})
 
 	nested, err := c.compileBlock(with.Block)
 	if err != nil {
 		return err
 	}
 
-	nested = append(nested, instruction.I32Const{Value: 0})
-	nested = append(nested, instruction.SetLocal{Index: undefined})
-	instrs = append(instrs, instruction.Block{Instrs: nested})
-	instrs = append(instrs, instruction.GetLocal{Index: save})
-	instrs = append(instrs, instruction.SetLocal{Index: c.local(with.Local)})
-	instrs = append(instrs, instruction.Call{Index: c.function(opaMemoizePop)})
-	instrs = append(instrs, instruction.GetLocal{Index: undefined})
-	instrs = append(instrs, instruction.BrIf{Index: 0})
+	nested = append(nested, instruction.I32Const{Value: 0}, instruction.SetLocal{Index: undefined})
+
+	instrs = append(instrs,
+		instruction.Block{Instrs: nested},
+		instruction.GetLocal{Index: save},
+		instruction.SetLocal{Index: c.local(with.Local)},
+		instruction.Call{Index: c.function(opaMemoizePop)},
+		instruction.GetLocal{Index: undefined},
+		instruction.BrIf{Index: 0},
+	)
 
 	*result = instrs
 
@@ -1339,37 +1380,38 @@ func (c *Compiler) compileWithStmt(with *ir.WithStmt, result *[]instruction.Inst
 }
 
 func (c *Compiler) compileUpsert(local ir.Local, path []int, value ir.Operand, _ ir.Location, instrs []instruction.Instruction) []instruction.Instruction {
-
 	lcopy := c.genLocal() // holds copy of local
-	instrs = append(instrs, instruction.GetLocal{Index: c.local(local)})
-	instrs = append(instrs, instruction.SetLocal{Index: lcopy})
-
-	// Shallow copy the local if defined otherwise initialize to an empty object.
-	instrs = append(instrs, instruction.Block{
-		Instrs: []instruction.Instruction{
-			instruction.Block{Instrs: []instruction.Instruction{
-				instruction.GetLocal{Index: lcopy},
-				instruction.I32Eqz{},
-				instruction.BrIf{Index: 0},
-				instruction.GetLocal{Index: lcopy},
-				instruction.Call{Index: c.function(opaValueShallowCopy)},
+	instrs = append(instrs,
+		instruction.GetLocal{Index: c.local(local)},
+		instruction.SetLocal{Index: lcopy},
+		// Shallow copy the local if defined otherwise initialize to an empty object.
+		instruction.Block{
+			Instrs: []instruction.Instruction{
+				instruction.Block{Instrs: []instruction.Instruction{
+					instruction.GetLocal{Index: lcopy},
+					instruction.I32Eqz{},
+					instruction.BrIf{Index: 0},
+					instruction.GetLocal{Index: lcopy},
+					instruction.Call{Index: c.function(opaValueShallowCopy)},
+					instruction.TeeLocal{Index: lcopy},
+					instruction.SetLocal{Index: c.local(local)},
+					instruction.Br{Index: 1},
+				}},
+				instruction.Call{Index: c.function(opaObject)},
 				instruction.TeeLocal{Index: lcopy},
 				instruction.SetLocal{Index: c.local(local)},
-				instruction.Br{Index: 1},
-			}},
-			instruction.Call{Index: c.function(opaObject)},
-			instruction.TeeLocal{Index: lcopy},
-			instruction.SetLocal{Index: c.local(local)},
-		},
-	})
+			},
+		})
 
 	// Initialize the locals that specify the path of the upsert operation.
 	lpath := make(map[int]uint32, len(path))
 
 	for i := range path {
 		lpath[i] = c.genLocal()
-		instrs = append(instrs, instruction.I32Const{Value: c.opaStringAddr(path[i])})
-		instrs = append(instrs, instruction.SetLocal{Index: lpath[i]})
+		instrs = append(instrs,
+			instruction.I32Const{Value: c.opaStringAddr(path[i])},
+			instruction.SetLocal{Index: lpath[i]},
+		)
 	}
 
 	// Generate a block that traverses the path of the upsert operation,
@@ -1379,36 +1421,34 @@ func (c *Compiler) compileUpsert(local ir.Local, path []int, value ir.Operand, _
 	ltemp := c.genLocal()
 
 	for i := range len(path) - 1 {
-
-		// Lookup the next part of the path.
-		inner = append(inner, instruction.GetLocal{Index: lcopy})
-		inner = append(inner, instruction.GetLocal{Index: lpath[i]})
-		inner = append(inner, instruction.Call{Index: c.function(opaValueGet)})
-		inner = append(inner, instruction.SetLocal{Index: ltemp})
-
-		// If the next node is missing, break.
-		inner = append(inner, instruction.GetLocal{Index: ltemp})
-		inner = append(inner, instruction.I32Eqz{})
-		inner = append(inner, instruction.BrIf{Index: uint32(i)})
-
-		// If the next node is not an object, break.
-		inner = append(inner, instruction.GetLocal{Index: ltemp})
-		inner = append(inner, instruction.Call{Index: c.function(opaValueType)})
-		inner = append(inner, instruction.I32Const{Value: opaTypeObject})
-		inner = append(inner, instruction.I32Ne{})
-		inner = append(inner, instruction.BrIf{Index: uint32(i)})
-
-		// Otherwise, shallow copy the next node node and insert into the copy
-		// before continuing.
-		inner = append(inner, instruction.GetLocal{Index: ltemp})
-		inner = append(inner, instruction.Call{Index: c.function(opaValueShallowCopy)})
-		inner = append(inner, instruction.SetLocal{Index: ltemp})
-		inner = append(inner, instruction.GetLocal{Index: lcopy})
-		inner = append(inner, instruction.GetLocal{Index: lpath[i]})
-		inner = append(inner, instruction.GetLocal{Index: ltemp})
-		inner = append(inner, instruction.Call{Index: c.function(opaObjectInsert)})
-		inner = append(inner, instruction.GetLocal{Index: ltemp})
-		inner = append(inner, instruction.SetLocal{Index: lcopy})
+		inner = append(inner,
+			// Lookup the next part of the path.
+			instruction.GetLocal{Index: lcopy},
+			instruction.GetLocal{Index: lpath[i]},
+			instruction.Call{Index: c.function(opaValueGet)},
+			instruction.SetLocal{Index: ltemp},
+			// If the next node is missing, break.
+			instruction.GetLocal{Index: ltemp},
+			instruction.I32Eqz{},
+			instruction.BrIf{Index: uint32(i)},
+			// If the next node is not an object, break.
+			instruction.GetLocal{Index: ltemp},
+			instruction.Call{Index: c.function(opaValueType)},
+			instruction.I32Const{Value: opaTypeObject},
+			instruction.I32Ne{},
+			instruction.BrIf{Index: uint32(i)},
+			// Otherwise, shallow copy the next node node and insert into the copy
+			// before continuing.
+			instruction.GetLocal{Index: ltemp},
+			instruction.Call{Index: c.function(opaValueShallowCopy)},
+			instruction.SetLocal{Index: ltemp},
+			instruction.GetLocal{Index: lcopy},
+			instruction.GetLocal{Index: lpath[i]},
+			instruction.GetLocal{Index: ltemp},
+			instruction.Call{Index: c.function(opaObjectInsert)},
+			instruction.GetLocal{Index: ltemp},
+			instruction.SetLocal{Index: lcopy},
+		)
 	}
 
 	inner = append(inner, instruction.Br{Index: uint32(len(path) - 1)})
@@ -1418,27 +1458,29 @@ func (c *Compiler) compileUpsert(local ir.Local, path []int, value ir.Operand, _
 	lval := c.genLocal()
 
 	for i := range len(path) - 1 {
-		block = append(block, instruction.Block{Instrs: inner})
-		block = append(block, instruction.Call{Index: c.function(opaObject)})
-		block = append(block, instruction.SetLocal{Index: lval})
-		block = append(block, instruction.GetLocal{Index: lcopy})
-		block = append(block, instruction.GetLocal{Index: lpath[i]})
-		block = append(block, instruction.GetLocal{Index: lval})
-		block = append(block, instruction.Call{Index: c.function(opaObjectInsert)})
-		block = append(block, instruction.GetLocal{Index: lval})
-		block = append(block, instruction.SetLocal{Index: lcopy})
+		block = append(block,
+			instruction.Block{Instrs: inner},
+			instruction.Call{Index: c.function(opaObject)},
+			instruction.SetLocal{Index: lval},
+			instruction.GetLocal{Index: lcopy},
+			instruction.GetLocal{Index: lpath[i]},
+			instruction.GetLocal{Index: lval},
+			instruction.Call{Index: c.function(opaObjectInsert)},
+			instruction.GetLocal{Index: lval},
+			instruction.SetLocal{Index: lcopy},
+		)
 		inner = block
 		block = nil
 	}
 
 	// Finish by inserting the statement's value into the shallow copied node.
-	instrs = append(instrs, instruction.Block{Instrs: inner})
-	instrs = append(instrs, instruction.GetLocal{Index: lcopy})
-	instrs = append(instrs, instruction.GetLocal{Index: lpath[len(path)-1]})
-	instrs = append(instrs, c.instrRead(value))
-	instrs = append(instrs, instruction.Call{Index: c.function(opaObjectInsert)})
-
-	return instrs
+	return append(instrs,
+		instruction.Block{Instrs: inner},
+		instruction.GetLocal{Index: lcopy},
+		instruction.GetLocal{Index: lpath[len(path)-1]},
+		c.instrRead(value),
+		instruction.Call{Index: c.function(opaObjectInsert)},
+	)
 }
 
 func (c *Compiler) compileCallDynamicStmt(stmt *ir.CallDynamicStmt, result *[]instruction.Instruction) error {
diff --git a/internal/gojsonschema/schema_test.go b/internal/gojsonschema/schema_test.go
index d7646d42a4..1beb3f660f 100644
--- a/internal/gojsonschema/schema_test.go
+++ b/internal/gojsonschema/schema_test.go
@@ -23,7 +23,6 @@
 //
 // created          16-06-2013
 
-// nolint: deadcode // Package in development (2021).
 package gojsonschema
 
 import (
diff --git a/internal/gojsonschema/utils.go b/internal/gojsonschema/utils.go
index ca071930f2..95754fab7f 100644
--- a/internal/gojsonschema/utils.go
+++ b/internal/gojsonschema/utils.go
@@ -23,7 +23,7 @@
 //
 // created          26-02-2013
 
-// nolint: deadcode,unused,varcheck // Package in development (2021).
+// nolint:unused,varcheck // Package in development (2021).
 package gojsonschema
 
 import (
diff --git a/internal/logging/logging.go b/internal/logging/logging.go
index acd44f8cad..fd09205be3 100644
--- a/internal/logging/logging.go
+++ b/internal/logging/logging.go
@@ -54,7 +54,7 @@ func (*prettyFormatter) Format(e *logrus.Entry) ([]byte, error) {
 	b := new(bytes.Buffer)
 
 	level := strings.ToUpper(e.Level.String())
-	b.WriteString(fmt.Sprintf("[%s] %s\n", level, e.Message))
+	fmt.Fprintf(b, "[%s] %s\n", level, e.Message)
 
 	// Format each key for optimal ease of human reading
 	fieldIndent := 2
diff --git a/internal/providers/aws/signing_v4.go b/internal/providers/aws/signing_v4.go
index 07aa568fa2..c463ccbff8 100644
--- a/internal/providers/aws/signing_v4.go
+++ b/internal/providers/aws/signing_v4.go
@@ -158,6 +158,8 @@ func SignV4(headers map[string][]string, method string, theURL *url.URL, body []
 	// include the values for the signed headers
 	orderedKeys := util.KeysSorted(headersToSign)
 	for _, k := range orderedKeys {
+		// TODO: fix later
+		//nolint:perfsprint
 		canonicalReq += k + ":" + strings.Join(headersToSign[k], ",") + "\n"
 	}
 	canonicalReq += "\n" // linefeed to terminate headers
diff --git a/loader/loader.go b/loader/loader.go
index 9b2f91d4e9..a319f2c64d 100644
--- a/loader/loader.go
+++ b/loader/loader.go
@@ -77,6 +77,7 @@ func Schemas(schemaPath string) (*ast.SchemaSet, error) {
 }
 
 // All returns a Result object loaded (recursively) from the specified paths.
+//
 // Deprecated: Use FileLoader.Filtered() instead.
 func All(paths []string) (*Result, error) {
 	return NewFileLoader().Filtered(paths, nil)
@@ -85,6 +86,7 @@ func All(paths []string) (*Result, error) {
 // Filtered returns a Result object loaded (recursively) from the specified
 // paths while applying the given filters. If any filter returns true, the
 // file/directory is excluded.
+//
 // Deprecated: Use FileLoader.Filtered() instead.
 func Filtered(paths []string, filter Filter) (*Result, error) {
 	return NewFileLoader().Filtered(paths, filter)
@@ -93,6 +95,7 @@ func Filtered(paths []string, filter Filter) (*Result, error) {
 // AsBundle loads a path as a bundle. If it is a single file
 // it will be treated as a normal tarball bundle. If a directory
 // is supplied it will be loaded as an unzipped bundle tree.
+//
 // Deprecated: Use FileLoader.AsBundle() instead.
 func AsBundle(path string) (*bundle.Bundle, error) {
 	return NewFileLoader().AsBundle(path)
diff --git a/plugins/bundle/config.go b/plugins/bundle/config.go
index fe103e3575..99d9291561 100644
--- a/plugins/bundle/config.go
+++ b/plugins/bundle/config.go
@@ -11,6 +11,7 @@ import (
 // ParseConfig validates the config and injects default values. This is
 // for the legacy single bundle configuration. This will add the bundle
 // to the `Bundles` map to provide compatibility with newer clients.
+//
 // Deprecated: Use `ParseBundlesConfig` with `bundles` OPA config option instead
 func ParseConfig(config []byte, services []string) (*Config, error) {
 	return v1.ParseConfig(config, services)
diff --git a/rego/rego.go b/rego/rego.go
index bdcf6c291a..0727dae69a 100644
--- a/rego/rego.go
+++ b/rego/rego.go
@@ -68,6 +68,7 @@ func EvalInstrument(instrument bool) EvalOption {
 }
 
 // EvalTracer configures a tracer for a Prepared Query's evaluation
+//
 // Deprecated: Use EvalQueryTracer instead.
 func EvalTracer(tracer topdown.Tracer) EvalOption {
 	return v1.EvalTracer(tracer)
@@ -441,6 +442,7 @@ func Trace(yes bool) func(r *Rego) {
 }
 
 // Tracer returns an argument that adds a query tracer to r.
+//
 // Deprecated: Use QueryTracer instead.
 func Tracer(t topdown.Tracer) func(r *Rego) {
 	return v1.Tracer(t)
diff --git a/server/types/types.go b/server/types/types.go
index c8224b13fc..0fa30beaf9 100644
--- a/server/types/types.go
+++ b/server/types/types.go
@@ -201,6 +201,7 @@ const (
 	// ParamBundleActivationV1 defines the name of the HTTP URL parameter that
 	// indicates the client wants to include bundle activation in the results
 	// of the health API.
+	//
 	// Deprecated: Use ParamBundlesActivationV1 instead.
 	ParamBundleActivationV1 = v1.ParamBundleActivationV1
 
diff --git a/server/writer/writer.go b/server/writer/writer.go
index 2dc464ec47..ae5b02e078 100644
--- a/server/writer/writer.go
+++ b/server/writer/writer.go
@@ -37,6 +37,7 @@ func Error(w http.ResponseWriter, status int, err *types.ErrorV1) {
 
 // JSON writes a response with the specified status code and object. The object
 // will be JSON serialized.
+//
 // Deprecated: This method is problematic when using a non-200 status `code`: if
 // encoding the payload fails, it'll print "superfluous call to WriteHeader()"
 // logs.
@@ -50,6 +51,7 @@ func JSONOK(w http.ResponseWriter, v any, pretty bool) {
 }
 
 // Bytes writes a response with the specified status code and bytes.
+//
 // Deprecated: Unused in OPA, will be removed in the future.
 func Bytes(w http.ResponseWriter, code int, bs []byte) {
 	v1.Bytes(w, code, bs)
diff --git a/topdown/trace.go b/topdown/trace.go
index 4d4cc295e2..fcd351d7ce 100644
--- a/topdown/trace.go
+++ b/topdown/trace.go
@@ -63,6 +63,7 @@ type VarMetadata = v1.VarMetadata
 type Event = v1.Event
 
 // Tracer defines the interface for tracing in the top-down evaluation engine.
+//
 // Deprecated: Use QueryTracer instead.
 type Tracer = v1.Tracer
 
diff --git a/v1/ast/compile.go b/v1/ast/compile.go
index 62e22bf937..f03718e806 100644
--- a/v1/ast/compile.go
+++ b/v1/ast/compile.go
@@ -440,6 +440,7 @@ func (c *Compiler) WithDebug(sink io.Writer) *Compiler {
 }
 
 // WithBuiltins is deprecated.
+//
 // Deprecated: Use WithCapabilities instead.
 func (c *Compiler) WithBuiltins(builtins map[string]*Builtin) *Compiler {
 	c.customBuiltins = maps.Clone(builtins)
@@ -447,6 +448,7 @@ func (c *Compiler) WithBuiltins(builtins map[string]*Builtin) *Compiler {
 }
 
 // WithUnsafeBuiltins is deprecated.
+//
 // Deprecated: Use WithCapabilities instead.
 func (c *Compiler) WithUnsafeBuiltins(unsafeBuiltins map[string]struct{}) *Compiler {
 	maps.Copy(c.unsafeBuiltinsMap, unsafeBuiltins)
diff --git a/v1/ast/env.go b/v1/ast/env.go
index 12d4be8918..91b82debcc 100644
--- a/v1/ast/env.go
+++ b/v1/ast/env.go
@@ -29,6 +29,7 @@ func newTypeEnv(f func() *typeChecker) *TypeEnv {
 }
 
 // Get returns the type of x.
+//
 // Deprecated: Use GetByValue or GetByRef instead, as they are more efficient.
 func (env *TypeEnv) Get(x any) types.Type {
 	if term, ok := x.(*Term); ok {
diff --git a/v1/ast/errors.go b/v1/ast/errors.go
index 75160afc6e..4a72b7931a 100644
--- a/v1/ast/errors.go
+++ b/v1/ast/errors.go
@@ -99,19 +99,24 @@ func (e *Error) Error() string {
 		}
 	}
 
-	msg := fmt.Sprintf("%v: %v", e.Code, e.Message)
-
+	sb := strings.Builder{}
 	if len(prefix) > 0 {
-		msg = prefix + ": " + msg
+		sb.WriteString(prefix)
+		sb.WriteString(": ")
 	}
 
+	sb.WriteString(e.Code)
+	sb.WriteString(": ")
+	sb.WriteString(e.Message)
+
 	if e.Details != nil {
 		for _, line := range e.Details.Lines() {
-			msg += "\n\t" + line
+			sb.WriteString("\n\t")
+			sb.WriteString(line)
 		}
 	}
 
-	return msg
+	return sb.String()
 }
 
 // NewError returns a new Error object.
diff --git a/v1/ast/index.go b/v1/ast/index.go
index 845447b6dc..d38827bf75 100644
--- a/v1/ast/index.go
+++ b/v1/ast/index.go
@@ -884,7 +884,6 @@ func indexValue(b Value) (Value, bool) {
 }
 
 func globDelimiterToString(delim *Term) (string, bool) {
-
 	arr, ok := delim.Value.(*Array)
 	if !ok {
 		return "", false
@@ -895,14 +894,16 @@ func globDelimiterToString(delim *Term) (string, bool) {
 	if arr.Len() == 0 {
 		result = "."
 	} else {
+		sb := strings.Builder{}
 		for i := range arr.Len() {
 			term := arr.Elem(i)
 			s, ok := term.Value.(String)
 			if !ok {
 				return "", false
 			}
-			result += string(s)
+			sb.WriteString(string(s))
 		}
+		result = sb.String()
 	}
 
 	return result, true
diff --git a/v1/ast/parser_bench_test.go b/v1/ast/parser_bench_test.go
index 835db87359..58d4c22a6f 100644
--- a/v1/ast/parser_bench_test.go
+++ b/v1/ast/parser_bench_test.go
@@ -220,6 +220,7 @@ func runParseStatementBenchmarkWithError(b *testing.B, stmt string) {
 func generateModule(numRules int) string {
 	mod := "package bench\n"
 	for i := range numRules {
+		//nolint:perfsprint
 		mod += fmt.Sprintf("p%d if { input.x%d = %d }\n", i, i, i)
 	}
 	return mod
diff --git a/v1/ast/parser_test.go b/v1/ast/parser_test.go
index 62d81d42d2..064afa99a9 100644
--- a/v1/ast/parser_test.go
+++ b/v1/ast/parser_test.go
@@ -5560,6 +5560,7 @@ func TestRuleFromBody(t *testing.T) {
 	// Verify the rule and rule and rule head col/loc values
 	testModule := "package a.b.c\n\n"
 	for _, tc := range tests {
+		//nolint:perfsprint
 		testModule += tc.input + "\n"
 	}
 	module, err := ParseModuleWithOpts("test.rego", testModule, popts)
diff --git a/v1/ast/policy.go b/v1/ast/policy.go
index df8aab7a5a..8d34f3011b 100644
--- a/v1/ast/policy.go
+++ b/v1/ast/policy.go
@@ -379,8 +379,10 @@ func (mod *Module) String() string {
 	appendAnnotationStrings := func(buf []string, node Node) []string {
 		if as, ok := byNode[node]; ok {
 			for i := range as {
-				buf = append(buf, "# METADATA")
-				buf = append(buf, "# "+as[i].String())
+				buf = append(buf,
+					"# METADATA",
+					"# "+as[i].String(),
+				)
 			}
 		}
 		return buf
@@ -730,6 +732,7 @@ func (rule *Rule) SetLoc(loc *Location) {
 
 // Path returns a ref referring to the document produced by this rule. If rule
 // is not contained in a module, this function panics.
+//
 // Deprecated: Poor handling of ref rules. Use `(*Rule).Ref()` instead.
 func (rule *Rule) Path() Ref {
 	if rule.Module == nil {
diff --git a/v1/ast/schema_test.go b/v1/ast/schema_test.go
index eaa3e7d196..30e030a05d 100644
--- a/v1/ast/schema_test.go
+++ b/v1/ast/schema_test.go
@@ -41,17 +41,17 @@ func testParseSchema(t *testing.T, schema string, expectedType types.Type, expec
 }
 
 func TestParseSchemaObject(t *testing.T) {
-	innerObjectStaticProps := []*types.StaticProperty{}
-	innerObjectStaticProps = append(innerObjectStaticProps, &types.StaticProperty{Key: "a", Value: types.N})
-	innerObjectStaticProps = append(innerObjectStaticProps, &types.StaticProperty{Key: "b", Value: types.NewArray(nil, types.N)})
-	innerObjectStaticProps = append(innerObjectStaticProps, &types.StaticProperty{Key: "c", Value: types.A})
-	innerObjectType := types.NewObject(innerObjectStaticProps, nil)
-
-	staticProps := []*types.StaticProperty{}
-	staticProps = append(staticProps, &types.StaticProperty{Key: "b", Value: types.NewArray(nil, innerObjectType)})
-	staticProps = append(staticProps, &types.StaticProperty{Key: "foo", Value: types.S})
-
+	innerObjectStaticProps := append([]*types.StaticProperty{},
+		&types.StaticProperty{Key: "a", Value: types.N},
+		&types.StaticProperty{Key: "b", Value: types.NewArray(nil, types.N)},
+		&types.StaticProperty{Key: "c", Value: types.A},
+	)
+	staticProps := append([]*types.StaticProperty{},
+		&types.StaticProperty{Key: "b", Value: types.NewArray(nil, types.NewObject(innerObjectStaticProps, nil))},
+		&types.StaticProperty{Key: "foo", Value: types.S},
+	)
 	expectedType := types.NewObject(staticProps, nil)
+
 	testParseSchema(t, objectSchema, expectedType, nil)
 }
 
@@ -141,25 +141,27 @@ func TestSetTypesWithPodSchema(t *testing.T) {
 
 func TestAllOfSchemas(t *testing.T) {
 	// Test 1: object schema
-	objectSchemaStaticProps := []*types.StaticProperty{}
-	objectSchemaStaticProps = append(objectSchemaStaticProps, &types.StaticProperty{Key: "AddressLine1", Value: types.S})
-	objectSchemaStaticProps = append(objectSchemaStaticProps, &types.StaticProperty{Key: "AddressLine2", Value: types.S})
-	objectSchemaStaticProps = append(objectSchemaStaticProps, &types.StaticProperty{Key: "City", Value: types.S})
-	objectSchemaStaticProps = append(objectSchemaStaticProps, &types.StaticProperty{Key: "State", Value: types.S})
-	objectSchemaStaticProps = append(objectSchemaStaticProps, &types.StaticProperty{Key: "ZipCode", Value: types.S})
-	objectSchemaStaticProps = append(objectSchemaStaticProps, &types.StaticProperty{Key: "County", Value: types.S})
-	objectSchemaStaticProps = append(objectSchemaStaticProps, &types.StaticProperty{Key: "PostCode", Value: types.S})
+	objectSchemaStaticProps := []*types.StaticProperty{
+		{Key: "AddressLine1", Value: types.S},
+		{Key: "AddressLine2", Value: types.S},
+		{Key: "City", Value: types.S},
+		{Key: "State", Value: types.S},
+		{Key: "ZipCode", Value: types.S},
+		{Key: "County", Value: types.S},
+		{Key: "PostCode", Value: types.S},
+	}
 	objectSchemaExpectedType := types.NewObject(objectSchemaStaticProps, nil)
 
 	// Test 2: array schema
 	arrayExpectedType := types.NewArray(nil, types.N)
 
 	// Test 3: parent variation
-	parentVariationStaticProps := []*types.StaticProperty{}
-	parentVariationStaticProps = append(parentVariationStaticProps, &types.StaticProperty{Key: "State", Value: types.S})
-	parentVariationStaticProps = append(parentVariationStaticProps, &types.StaticProperty{Key: "ZipCode", Value: types.S})
-	parentVariationStaticProps = append(parentVariationStaticProps, &types.StaticProperty{Key: "County", Value: types.S})
-	parentVariationStaticProps = append(parentVariationStaticProps, &types.StaticProperty{Key: "PostCode", Value: types.S})
+	parentVariationStaticProps := []*types.StaticProperty{
+		{Key: "State", Value: types.S},
+		{Key: "ZipCode", Value: types.S},
+		{Key: "County", Value: types.S},
+		{Key: "PostCode", Value: types.S},
+	}
 	parentVariationExpectedType := types.NewObject(parentVariationStaticProps, nil)
 
 	// Test 4: empty schema with allOf
@@ -169,23 +171,25 @@ func TestAllOfSchemas(t *testing.T) {
 	expectedError := errors.New("unable to merge these schemas")
 
 	// Test 7: array of objects
-	arrayOfObjectsStaticProps := []*types.StaticProperty{}
-	arrayOfObjectsStaticProps = append(arrayOfObjectsStaticProps, &types.StaticProperty{Key: "State", Value: types.S})
-	arrayOfObjectsStaticProps = append(arrayOfObjectsStaticProps, &types.StaticProperty{Key: "ZipCode", Value: types.S})
-	arrayOfObjectsStaticProps = append(arrayOfObjectsStaticProps, &types.StaticProperty{Key: "County", Value: types.S})
-	arrayOfObjectsStaticProps = append(arrayOfObjectsStaticProps, &types.StaticProperty{Key: "PostCode", Value: types.S})
-	arrayOfObjectsStaticProps = append(arrayOfObjectsStaticProps, &types.StaticProperty{Key: "Street", Value: types.S})
-	arrayOfObjectsStaticProps = append(arrayOfObjectsStaticProps, &types.StaticProperty{Key: "House", Value: types.S})
+	arrayOfObjectsStaticProps := []*types.StaticProperty{
+		{Key: "State", Value: types.S},
+		{Key: "ZipCode", Value: types.S},
+		{Key: "County", Value: types.S},
+		{Key: "PostCode", Value: types.S},
+		{Key: "Street", Value: types.S},
+		{Key: "House", Value: types.S},
+	}
 	innerType := types.NewObject(arrayOfObjectsStaticProps, nil)
 	arrayOfObjectsExpectedType := types.NewArray(nil, innerType)
 
 	// Tests 8 & 9: allOf schema with type not specified
-	objectMissingStaticProps := []*types.StaticProperty{}
-	objectMissingStaticProps = append(objectMissingStaticProps, &types.StaticProperty{Key: "AddressLine", Value: types.S})
-	objectMissingStaticProps = append(objectMissingStaticProps, &types.StaticProperty{Key: "State", Value: types.S})
-	objectMissingStaticProps = append(objectMissingStaticProps, &types.StaticProperty{Key: "ZipCode", Value: types.S})
-	objectMissingStaticProps = append(objectMissingStaticProps, &types.StaticProperty{Key: "County", Value: types.S})
-	objectMissingStaticProps = append(objectMissingStaticProps, &types.StaticProperty{Key: "PostCode", Value: types.N})
+	objectMissingStaticProps := []*types.StaticProperty{
+		{Key: "AddressLine", Value: types.S},
+		{Key: "State", Value: types.S},
+		{Key: "ZipCode", Value: types.S},
+		{Key: "County", Value: types.S},
+		{Key: "PostCode", Value: types.N},
+	}
 	objectMissingExpectedType := types.NewObject(objectMissingStaticProps, nil)
 	arrayMissingExpectedType := types.NewArray([]types.Type{types.N, types.N}, nil)
 
@@ -193,24 +197,27 @@ func TestAllOfSchemas(t *testing.T) {
 	arrayDifTypesExpectedType := types.NewArray([]types.Type{types.S, types.N}, nil)
 
 	// Test 12: array inside of object
-	arrayInObjectstaticProps := []*types.StaticProperty{}
-	arrayInObjectstaticProps = append(arrayInObjectstaticProps, &types.StaticProperty{Key: "age", Value: types.N})
-	arrayInObjectstaticProps = append(arrayInObjectstaticProps, &types.StaticProperty{Key: "name", Value: types.S})
-	arrayInObjectstaticProps = append(arrayInObjectstaticProps, &types.StaticProperty{Key: "personality", Value: types.S})
-	arrayInObjectstaticProps = append(arrayInObjectstaticProps, &types.StaticProperty{Key: "nickname", Value: types.S})
+	arrayInObjectstaticProps := []*types.StaticProperty{
+		{Key: "age", Value: types.N},
+		{Key: "name", Value: types.S},
+		{Key: "personality", Value: types.S},
+		{Key: "nickname", Value: types.S},
+	}
 	innerObjectsType := types.NewObject(arrayInObjectstaticProps, nil)
 	arrayInObjectInnerType := types.NewArray(nil, innerObjectsType)
 	arrayInObjectExpectedType := types.NewObject([]*types.StaticProperty{
 		types.NewStaticProperty("familyMembers", arrayInObjectInnerType)}, nil)
 
 	// Test 13: allOf inside core schema
-	coreStaticProps := []*types.StaticProperty{}
-	coreStaticProps = append(coreStaticProps, &types.StaticProperty{Key: "accessMe", Value: types.S})
-	coreStaticProps = append(coreStaticProps, &types.StaticProperty{Key: "accessYou", Value: types.S})
+	coreStaticProps := []*types.StaticProperty{
+		{Key: "accessMe", Value: types.S},
+		{Key: "accessYou", Value: types.S},
+	}
 	insideType := types.NewObject(coreStaticProps, nil)
-	outerType := []*types.StaticProperty{}
-	outerType = append(outerType, &types.StaticProperty{Key: "RandomInfo", Value: insideType})
-	outerType = append(outerType, &types.StaticProperty{Key: "AddressLine", Value: types.S})
+	outerType := []*types.StaticProperty{
+		{Key: "RandomInfo", Value: insideType},
+		{Key: "AddressLine", Value: types.S},
+	}
 	coreSchemaExpectedType := types.NewObject(outerType, nil)
 
 	// Test 14-17: other types besides array and object
diff --git a/v1/ast/term.go b/v1/ast/term.go
index 10c0f5b475..8575379d02 100644
--- a/v1/ast/term.go
+++ b/v1/ast/term.go
@@ -2,7 +2,6 @@
 // Use of this source code is governed by an Apache2
 // license that can be found in the LICENSE file.
 
-// nolint: deadcode // Public API.
 package ast
 
 import (
diff --git a/v1/ast/visit.go b/v1/ast/visit.go
index 4ae6569ad7..fd3dcdea29 100644
--- a/v1/ast/visit.go
+++ b/v1/ast/visit.go
@@ -8,6 +8,7 @@ package ast
 // can return a Visitor w which will be used to visit the children of the AST
 // element v. If the Visit function returns nil, the children will not be
 // visited.
+//
 // Deprecated: use GenericVisitor or another visitor implementation
 type Visitor interface {
 	Visit(v any) (w Visitor)
@@ -15,6 +16,7 @@ type Visitor interface {
 
 // BeforeAndAfterVisitor wraps Visitor to provide hooks for being called before
 // and after the AST has been visited.
+//
 // Deprecated: use GenericVisitor or another visitor implementation
 type BeforeAndAfterVisitor interface {
 	Visitor
@@ -24,6 +26,7 @@ type BeforeAndAfterVisitor interface {
 
 // Walk iterates the AST by calling the Visit function on the Visitor
 // v for x before recursing.
+//
 // Deprecated: use GenericVisitor.Walk
 func Walk(v Visitor, x any) {
 	if bav, ok := v.(BeforeAndAfterVisitor); !ok {
@@ -37,6 +40,7 @@ func Walk(v Visitor, x any) {
 
 // WalkBeforeAndAfter iterates the AST by calling the Visit function on the
 // Visitor v for x before recursing.
+//
 // Deprecated: use GenericVisitor.Walk
 func WalkBeforeAndAfter(v BeforeAndAfterVisitor, x any) {
 	Walk(v, x)
diff --git a/v1/bundle/store.go b/v1/bundle/store.go
index 992bf78f63..4e43330a5f 100644
--- a/v1/bundle/store.go
+++ b/v1/bundle/store.go
@@ -1191,17 +1191,20 @@ func applyPatches(ctx context.Context, store storage.Store, txn storage.Transact
 // Helpers for the older single (unnamed) bundle style manifest storage.
 
 // LegacyManifestStoragePath is the older unnamed bundle path for manifests to be stored.
+//
 // Deprecated: Use ManifestStoragePath and named bundles instead.
 var legacyManifestStoragePath = storage.MustParsePath("/system/bundle/manifest")
 var legacyRevisionStoragePath = append(legacyManifestStoragePath, "revision")
 
 // LegacyWriteManifestToStore will write the bundle manifest to the older single (unnamed) bundle manifest location.
+//
 // Deprecated: Use WriteManifestToStore and named bundles instead.
 func LegacyWriteManifestToStore(ctx context.Context, store storage.Store, txn storage.Transaction, manifest Manifest) error {
 	return write(ctx, store, txn, legacyManifestStoragePath, manifest)
 }
 
 // LegacyEraseManifestFromStore will erase the bundle manifest from the older single (unnamed) bundle manifest location.
+//
 // Deprecated: Use WriteManifestToStore and named bundles instead.
 func LegacyEraseManifestFromStore(ctx context.Context, store storage.Store, txn storage.Transaction) error {
 	err := store.Write(ctx, txn, storage.RemoveOp, legacyManifestStoragePath, nil)
@@ -1212,12 +1215,14 @@ func LegacyEraseManifestFromStore(ctx context.Context, store storage.Store, txn
 }
 
 // LegacyReadRevisionFromStore will read the bundle manifest revision from the older single (unnamed) bundle manifest location.
+//
 // Deprecated: Use ReadBundleRevisionFromStore and named bundles instead.
 func LegacyReadRevisionFromStore(ctx context.Context, store storage.Store, txn storage.Transaction) (string, error) {
 	return readRevisionFromStore(ctx, store, txn, legacyRevisionStoragePath)
 }
 
 // ActivateLegacy calls Activate for the bundles but will also write their manifest to the older unnamed store location.
+//
 // Deprecated: Use Activate with named bundles instead.
 func ActivateLegacy(opts *ActivateOpts) error {
 	opts.legacy = true
diff --git a/v1/compile/compile_test.go b/v1/compile/compile_test.go
index 99de3f5e23..b42eb0fd56 100644
--- a/v1/compile/compile_test.go
+++ b/v1/compile/compile_test.go
@@ -3697,15 +3697,16 @@ type prettyBundle struct {
 }
 
 func (p prettyBundle) String() string {
-
 	buf := []string{fmt.Sprintf("%d module(s) (hiding data):", len(p.Modules)), ""}
 
 	for _, mf := range p.Modules {
-		buf = append(buf, "#")
-		buf = append(buf, fmt.Sprintf("# Module: %q", mf.Path))
-		buf = append(buf, "#")
-		buf = append(buf, mf.Parsed.String())
-		buf = append(buf, "")
+		buf = append(buf,
+			"#",
+			fmt.Sprintf("# Module: %q", mf.Path),
+			"#",
+			mf.Parsed.String(),
+			"",
+		)
 	}
 
 	return strings.Join(buf, "\n")
diff --git a/v1/cover/cover.go b/v1/cover/cover.go
index 00c8655bef..a4447afc8b 100644
--- a/v1/cover/cover.go
+++ b/v1/cover/cover.go
@@ -107,6 +107,7 @@ func (c *Cover) Report(modules map[string]*ast.Module) (report Report) {
 }
 
 // Trace updates the coverage state.
+//
 // Deprecated: Use TraceEvent instead.
 func (c *Cover) Trace(event *topdown.Event) {
 	c.TraceEvent(*event)
diff --git a/v1/debug/debugger.go b/v1/debug/debugger.go
index 9e74410a25..dbf0138032 100644
--- a/v1/debug/debugger.go
+++ b/v1/debug/debugger.go
@@ -264,10 +264,12 @@ func (d *debugger) LaunchEval(ctx context.Context, props LaunchEvalProperties, o
 	// We apply all user options first, so the debugger can make overrides if necessary.
 	regoArgs = append(regoArgs, options.regoOptions...)
 
-	regoArgs = append(regoArgs, rego.Query(props.Query))
-	regoArgs = append(regoArgs, rego.Store(store))
-	regoArgs = append(regoArgs, rego.Transaction(txn))
-	regoArgs = append(regoArgs, rego.StrictBuiltinErrors(props.StrictBuiltinErrors))
+	regoArgs = append(regoArgs,
+		rego.Query(props.Query),
+		rego.Store(store),
+		rego.Transaction(txn),
+		rego.StrictBuiltinErrors(props.StrictBuiltinErrors),
+	)
 
 	if props.SkipOps == nil {
 		props.SkipOps = []topdown.Op{topdown.IndexOp, topdown.RedoOp, topdown.SaveOp, topdown.UnifyOp}
diff --git a/v1/debug/event.go b/v1/debug/event.go
index 2218c92cf7..43ada0535c 100644
--- a/v1/debug/event.go
+++ b/v1/debug/event.go
@@ -32,15 +32,14 @@ type Event struct {
 func (d Event) String() string {
 	buf := new(strings.Builder)
 
-	buf.WriteString(fmt.Sprintf("%s{", d.Type))
-	buf.WriteString(fmt.Sprintf("thread=%d", d.Thread))
+	fmt.Fprintf(buf, "%s{thread=%d", d.Type, d.Thread)
 
 	if d.Message != "" {
-		buf.WriteString(fmt.Sprintf(", message=%q", d.Message))
+		fmt.Fprintf(buf, ", message=%q", d.Message)
 	}
 
 	if d.stackEvent != nil {
-		buf.WriteString(fmt.Sprintf(", stackIndex=%d", d.stackIndex))
+		fmt.Fprintf(buf, ", stackIndex=%d", d.stackIndex)
 	}
 
 	buf.WriteString("}")
diff --git a/v1/loader/loader.go b/v1/loader/loader.go
index 42a59d031f..d97e3e5409 100644
--- a/v1/loader/loader.go
+++ b/v1/loader/loader.go
@@ -495,6 +495,7 @@ func loadOneSchema(path string) (any, error) {
 }
 
 // All returns a Result object loaded (recursively) from the specified paths.
+//
 // Deprecated: Use FileLoader.Filtered() instead.
 func All(paths []string) (*Result, error) {
 	return NewFileLoader().Filtered(paths, nil)
@@ -503,6 +504,7 @@ func All(paths []string) (*Result, error) {
 // Filtered returns a Result object loaded (recursively) from the specified
 // paths while applying the given filters. If any filter returns true, the
 // file/directory is excluded.
+//
 // Deprecated: Use FileLoader.Filtered() instead.
 func Filtered(paths []string, filter Filter) (*Result, error) {
 	return NewFileLoader().Filtered(paths, filter)
@@ -511,6 +513,7 @@ func Filtered(paths []string, filter Filter) (*Result, error) {
 // AsBundle loads a path as a bundle. If it is a single file
 // it will be treated as a normal tarball bundle. If a directory
 // is supplied it will be loaded as an unzipped bundle tree.
+//
 // Deprecated: Use FileLoader.AsBundle() instead.
 func AsBundle(path string) (*bundle.Bundle, error) {
 	return NewFileLoader().AsBundle(path)
@@ -631,11 +634,10 @@ func (l *Result) mergeDocument(path string, doc any) error {
 }
 
 func (l *Result) withParent(p string) *Result {
-	path := append(l.path, p)
 	return &Result{
 		Documents: l.Documents,
 		Modules:   l.Modules,
-		path:      path,
+		path:      append(l.path, p),
 	}
 }
 
diff --git a/v1/plugins/bundle/config.go b/v1/plugins/bundle/config.go
index cad437b6bd..80bac30ac5 100644
--- a/v1/plugins/bundle/config.go
+++ b/v1/plugins/bundle/config.go
@@ -22,6 +22,7 @@ import (
 // ParseConfig validates the config and injects default values. This is
 // for the legacy single bundle configuration. This will add the bundle
 // to the `Bundles` map to provide compatibility with newer clients.
+//
 // Deprecated: Use `ParseBundlesConfig` with `bundles` OPA config option instead
 func ParseConfig(config []byte, services []string) (*Config, error) {
 	if config == nil {
diff --git a/v1/plugins/bundle/plugin.go b/v1/plugins/bundle/plugin.go
index 23685b63f7..665bad702e 100644
--- a/v1/plugins/bundle/plugin.go
+++ b/v1/plugins/bundle/plugin.go
@@ -784,7 +784,7 @@ func getNormalizedBundleName(name string) string {
 	sb := new(strings.Builder)
 	for i := range len(name) {
 		if isReservedCharacter(rune(name[i])) {
-			sb.WriteString(fmt.Sprintf("\\%c", name[i]))
+			fmt.Fprintf(sb, "\\%c", name[i])
 		} else {
 			sb.WriteByte(name[i])
 		}
diff --git a/v1/plugins/bundle/plugin_test.go b/v1/plugins/bundle/plugin_test.go
index 6e6f5bf0b0..a12931b6ad 100644
--- a/v1/plugins/bundle/plugin_test.go
+++ b/v1/plugins/bundle/plugin_test.go
@@ -1366,7 +1366,7 @@ func TestPluginStart(t *testing.T) {
 	if err != nil {
 		t.Fatal("unexpected error:", err)
 	}
-	defer plugin.Stop(ctx)
+	plugin.Stop(ctx)
 }
 
 func TestStop(t *testing.T) {
@@ -2559,7 +2559,7 @@ corge contains 2 if {
 						if err != nil {
 							fatal(err)
 						} else if !bytes.Equal(bs, exp) {
-							fatal("Bad policy content. Exp:\n%v\n\nGot:\n\n%v", string(exp), string(bs))
+							fatal(fmt.Sprintf("Bad policy content. Exp:\n%v\n\nGot:\n\n%v", string(exp), string(bs)))
 						}
 					}
 
@@ -2574,7 +2574,7 @@ corge contains 2 if {
 					if err != nil {
 						fatal(err)
 					} else if !reflect.DeepEqual(data, expData) {
-						fatal("Bad data content. Exp:\n%v\n\nGot:\n\n%v", expData, data)
+						fatal(fmt.Sprintf("Bad data content. Exp:\n%v\n\nGot:\n\n%v", expData, data))
 					}
 
 					manager.Store.Abort(ctx, txn)
diff --git a/v1/plugins/rest/auth.go b/v1/plugins/rest/auth.go
index 8ec337bd1e..14c2f266ac 100644
--- a/v1/plugins/rest/auth.go
+++ b/v1/plugins/rest/auth.go
@@ -250,9 +250,8 @@ func convertPointsToBase64(alg string, r, s []byte) (string, error) {
 	copy(rBytesPadded[keyBytes-len(r):], r)
 	sBytesPadded := make([]byte, keyBytes)
 	copy(sBytesPadded[keyBytes-len(s):], s)
-	signatureEnc := append(rBytesPadded, sBytesPadded...)
 
-	return base64.RawURLEncoding.EncodeToString(signatureEnc), nil
+	return base64.RawURLEncoding.EncodeToString(append(rBytesPadded, sBytesPadded...)), nil
 }
 
 func retrieveCurveBits(alg string) (int, error) {
diff --git a/v1/plugins/status/plugin.go b/v1/plugins/status/plugin.go
index f509f096a0..0aa81a5108 100644
--- a/v1/plugins/status/plugin.go
+++ b/v1/plugins/status/plugin.go
@@ -293,6 +293,7 @@ func (p *Plugin) flush(ctx context.Context) {
 }
 
 // UpdateBundleStatus notifies the plugin that the policy bundle was updated.
+//
 // Deprecated: Use BulkUpdateBundleStatus instead.
 func (p *Plugin) UpdateBundleStatus(status bundle.Status) {
 	util.PushFIFO(p.bundleCh, status, p.metrics, statusBufferDropCounterName)
diff --git a/v1/profiler/profiler.go b/v1/profiler/profiler.go
index adc071598b..fe99cb8755 100644
--- a/v1/profiler/profiler.go
+++ b/v1/profiler/profiler.go
@@ -140,6 +140,7 @@ func (p *Profiler) ReportTopNResults(numResults int, criteria []string) []ExprSt
 }
 
 // Trace updates the profiler state.
+//
 // Deprecated: Use TraceEvent instead.
 func (p *Profiler) Trace(event *topdown.Event) {
 	p.TraceEvent(*event)
diff --git a/v1/rego/rego.go b/v1/rego/rego.go
index 2c4d8a8d91..13465fc81c 100644
--- a/v1/rego/rego.go
+++ b/v1/rego/rego.go
@@ -44,7 +44,7 @@ const (
 	wasmVarPrefix           = "^"
 )
 
-// nolint: deadcode,varcheck
+// nolint:varcheck
 const (
 	targetWasm = "wasm"
 	targetRego = "rego"
@@ -235,6 +235,7 @@ func EvalInstrument(instrument bool) EvalOption {
 }
 
 // EvalTracer configures a tracer for a Prepared Query's evaluation
+//
 // Deprecated: Use EvalQueryTracer instead.
 func EvalTracer(tracer topdown.Tracer) EvalOption {
 	return func(e *EvalContext) {
@@ -1115,6 +1116,7 @@ func Trace(yes bool) func(r *Rego) {
 }
 
 // Tracer returns an argument that adds a query tracer to r.
+//
 // Deprecated: Use QueryTracer instead.
 func Tracer(t topdown.Tracer) func(r *Rego) {
 	return func(r *Rego) {
diff --git a/v1/repl/repl.go b/v1/repl/repl.go
index 0fdc1e308a..3f65a593b7 100644
--- a/v1/repl/repl.go
+++ b/v1/repl/repl.go
@@ -361,6 +361,7 @@ func (r *REPL) WithRegoVersion(v ast.RegoVersion) *REPL {
 }
 
 // WithV1Compatible sets the Rego version to v1.
+//
 // Deprecated: Use WithRegoVersion instead.
 func (r *REPL) WithV1Compatible(v1Compatible bool) *REPL {
 	if v1Compatible {
diff --git a/v1/runtime/runtime_test.go b/v1/runtime/runtime_test.go
index e18a945cd2..7bb5b9e7e9 100644
--- a/v1/runtime/runtime_test.go
+++ b/v1/runtime/runtime_test.go
@@ -2068,7 +2068,7 @@ func TestExtraMiddleware(t *testing.T) {
 	}
 	rt.Manager.ExtraMiddleware(func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			ctx := context.WithValue(r.Context(), "foo", "bar") //nolint:staticcheck,SA1029 // this is a simple example
+			ctx := context.WithValue(r.Context(), "foo", "bar") //nolint:staticcheck // this is a simple example
 			next.ServeHTTP(w, r.WithContext(ctx))
 		})
 	})
diff --git a/v1/server/server.go b/v1/server/server.go
index d3b9af08de..914c002035 100644
--- a/v1/server/server.go
+++ b/v1/server/server.go
@@ -272,6 +272,7 @@ func (s *Server) Shutdown(ctx context.Context) error {
 	if len(errorList) > 0 {
 		errMsg := "error while shutting down: "
 		for i, err := range errorList {
+			//nolint:perfsprint
 			errMsg += fmt.Sprintf("(%d) %s. ", i, err.Error())
 		}
 		return errors.New(errMsg)
diff --git a/v1/server/types/types.go b/v1/server/types/types.go
index 572f6966e6..4f7c2070e8 100644
--- a/v1/server/types/types.go
+++ b/v1/server/types/types.go
@@ -448,6 +448,7 @@ const (
 	// ParamBundleActivationV1 defines the name of the HTTP URL parameter that
 	// indicates the client wants to include bundle activation in the results
 	// of the health API.
+	//
 	// Deprecated: Use ParamBundlesActivationV1 instead.
 	ParamBundleActivationV1 = "bundle"
 
diff --git a/v1/server/writer/writer.go b/v1/server/writer/writer.go
index 0ae348c672..5720c34e42 100644
--- a/v1/server/writer/writer.go
+++ b/v1/server/writer/writer.go
@@ -56,6 +56,7 @@ func Error(w http.ResponseWriter, status int, err *types.ErrorV1) {
 
 // JSON writes a response with the specified status code and object. The object
 // will be JSON serialized.
+//
 // Deprecated: This method is problematic when using a non-200 status `code`: if
 // encoding the payload fails, it'll print "superfluous call to WriteHeader()"
 // logs.
@@ -91,6 +92,7 @@ func JSONOK(w http.ResponseWriter, v any, pretty bool) {
 }
 
 // Bytes writes a response with the specified status code and bytes.
+//
 // Deprecated: Unused in OPA, will be removed in the future.
 func Bytes(w http.ResponseWriter, code int, bs []byte) {
 	w.WriteHeader(code)
diff --git a/v1/test/e2e/authz/disk.go b/v1/test/e2e/authz/disk.go
index 0917afb262..1860383fca 100644
--- a/v1/test/e2e/authz/disk.go
+++ b/v1/test/e2e/authz/disk.go
@@ -5,7 +5,7 @@
 //go:build bench_disk
 // +build bench_disk
 
-// nolint: deadcode,unused // build tags confuse these linters
+// nolint: unused // build tags confuse these linters
 package authz
 
 import (
diff --git a/v1/test/e2e/authz/nodisk.go b/v1/test/e2e/authz/nodisk.go
index 50109ea596..b14774a9ca 100644
--- a/v1/test/e2e/authz/nodisk.go
+++ b/v1/test/e2e/authz/nodisk.go
@@ -5,7 +5,7 @@
 //go:build !bench_disk
 // +build !bench_disk
 
-// nolint: deadcode,unused // build tags confuse these linters
+// nolint: unused // build tags confuse these linters
 package authz
 
 import "github.com/open-policy-agent/opa/v1/storage/disk"
diff --git a/v1/test/e2e/testing.go b/v1/test/e2e/testing.go
index 7f727403f2..844986b7ca 100644
--- a/v1/test/e2e/testing.go
+++ b/v1/test/e2e/testing.go
@@ -124,6 +124,7 @@ func WrapRuntime(ctx context.Context, cancel context.CancelFunc, rt *runtime.Run
 // handles starting and stopping the local API server. The return
 // value is what should be used as the code in `os.Exit` in the
 // `TestMain` function.
+//
 // Deprecated: Use RunTests instead
 func (t *TestRuntime) RunAPIServerTests(m *testing.M) int {
 	return t.runTests(m, true)
@@ -134,6 +135,7 @@ func (t *TestRuntime) RunAPIServerTests(m *testing.M) int {
 // will suppress logging output on stdout to prevent the tests
 // from being overly verbose. If log output is desired set
 // the `test.v` flag.
+//
 // Deprecated: Use RunTests instead
 func (t *TestRuntime) RunAPIServerBenchmarks(m *testing.M) int {
 	return t.runTests(m, !testing.Verbose())
diff --git a/v1/test/e2e/wasm/authz/disk.go b/v1/test/e2e/wasm/authz/disk.go
index 124a23407b..2b0372eb07 100644
--- a/v1/test/e2e/wasm/authz/disk.go
+++ b/v1/test/e2e/wasm/authz/disk.go
@@ -5,7 +5,7 @@
 //go:build bench_disk
 // +build bench_disk
 
-// nolint: deadcode,unused // build tags confuse these linters
+// nolint: unused // build tags confuse these linters
 package authz
 
 import (
diff --git a/v1/test/e2e/wasm/authz/nodisk.go b/v1/test/e2e/wasm/authz/nodisk.go
index 50109ea596..b14774a9ca 100644
--- a/v1/test/e2e/wasm/authz/nodisk.go
+++ b/v1/test/e2e/wasm/authz/nodisk.go
@@ -5,7 +5,7 @@
 //go:build !bench_disk
 // +build !bench_disk
 
-// nolint: deadcode,unused // build tags confuse these linters
+// nolint: unused // build tags confuse these linters
 package authz
 
 import "github.com/open-policy-agent/opa/v1/storage/disk"
diff --git a/v1/tester/reporter.go b/v1/tester/reporter.go
index 45f3113f8b..09f3a92a25 100644
--- a/v1/tester/reporter.go
+++ b/v1/tester/reporter.go
@@ -245,7 +245,7 @@ func (r PrettyReporter) fmtBenchmark(tr *Result) string {
 		// like BenchmarkDataFooBarTestAuth.
 		camelCaseName := ""
 		for part := range strings.SplitSeq(strings.ReplaceAll(name, "_", "."), ".") {
-			camelCaseName += strings.Title(part) //nolint:staticcheck // SA1019, no unicode here
+			camelCaseName += strings.Title(part) //nolint:perfsprint,staticcheck
 		}
 		name = "Benchmark" + camelCaseName
 	}
diff --git a/v1/tester/runner.go b/v1/tester/runner.go
index c0c58f42f5..d010a17172 100644
--- a/v1/tester/runner.go
+++ b/v1/tester/runner.go
@@ -325,6 +325,7 @@ func (r *Runner) SetStore(store storage.Store) *Runner {
 }
 
 // SetCoverageTracer sets the tracer to use to compute coverage.
+//
 // Deprecated: Use SetCoverageQueryTracer instead.
 func (r *Runner) SetCoverageTracer(tracer topdown.Tracer) *Runner {
 	if tracer == nil {
@@ -406,6 +407,7 @@ func (r *Runner) Target(target string) *Runner {
 }
 
 // Run executes all tests contained in supplied modules.
+//
 // Deprecated: Use RunTests and the Runner#SetModules or Runner#SetBundles
 // helpers instead. This will NOT use the modules or bundles set on the Runner.
 func (r *Runner) Run(ctx context.Context, modules map[string]*ast.Module) (chan *Result, error) {
diff --git a/v1/topdown/http_test.go b/v1/topdown/http_test.go
index feb1ff6870..004e8e7ee3 100644
--- a/v1/topdown/http_test.go
+++ b/v1/topdown/http_test.go
@@ -107,10 +107,7 @@ func TestHTTPGetRequest(t *testing.T) {
 func TestHTTPGetRequestTlsInsecureSkipVerify(t *testing.T) {
 	t.Parallel()
 
-	var people []Person
-
-	// test data
-	people = append(people, Person{ID: "1", Firstname: "John"})
+	people := []Person{{ID: "1", Firstname: "John"}}
 
 	// test server
 	ts := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -120,9 +117,10 @@ func TestHTTPGetRequestTlsInsecureSkipVerify(t *testing.T) {
 	defer ts.Close()
 
 	// expected result
-	expectedResult := make(map[string]any)
-	expectedResult["status"] = "200 OK"
-	expectedResult["status_code"] = http.StatusOK
+	expectedResult := map[string]any{
+		"status":      "200 OK",
+		"status_code": http.StatusOK,
+	}
 
 	var body []any
 	bodyMap := map[string]string{"id": "1", "firstname": "John"}
@@ -143,15 +141,25 @@ func TestHTTPGetRequestTlsInsecureSkipVerify(t *testing.T) {
 	}
 
 	// run the test
-	tests := []httpsStruct{}
-	tests = append(tests, httpsStruct{note: "http.send", rules: []string{fmt.Sprintf(
-		`p = x { http.send({"method": "get", "url": "%s", "force_json_decode": true, "tls_insecure_skip_verify": true}, resp); x := clean_headers(resp) }`, ts.URL)}, expected: resultObj.String()})
-
-	// This case verifies that `tls_insecure_skip_verify`
-	// is still applied, even if other TLS settings are
-	// present.
-	tests = append(tests, httpsStruct{note: "http.send", rules: []string{fmt.Sprintf(
-		`p = x { http.send({"method": "get", "url": "%s", "force_json_decode": true, "tls_insecure_skip_verify": true, "tls_use_system_certs": true,}, resp); x := clean_headers(resp) }`, ts.URL)}, expected: resultObj.String()})
+	tests := []httpsStruct{
+		{
+			note: "http.send",
+			rules: []string{fmt.Sprintf(
+				`p = x { http.send({"method": "get", "url": "%s", "force_json_decode": true, "tls_insecure_skip_verify": true}, resp); x := clean_headers(resp) }`, ts.URL),
+			},
+			expected: resultObj.String(),
+		},
+		{
+			// This case verifies that `tls_insecure_skip_verify`
+			// is still applied, even if other TLS settings are
+			// present.
+			note: "http.send",
+			rules: []string{fmt.Sprintf(
+				`p = x { http.send({"method": "get", "url": "%s", "force_json_decode": true, "tls_insecure_skip_verify": true}, resp); x := clean_headers(resp) }`, ts.URL),
+			},
+			expected: resultObj.String(),
+		},
+	}
 
 	data := loadSmallTestData()
 
diff --git a/v1/topdown/query.go b/v1/topdown/query.go
index aadcc060cf..f81402eb32 100644
--- a/v1/topdown/query.go
+++ b/v1/topdown/query.go
@@ -121,6 +121,7 @@ func (q *Query) WithInput(input *ast.Term) *Query {
 }
 
 // WithTracer adds a query tracer to use during evaluation. This is optional.
+//
 // Deprecated: Use WithQueryTracer instead.
 func (q *Query) WithTracer(tracer Tracer) *Query {
 	qt, ok := tracer.(QueryTracer)
diff --git a/v1/topdown/trace.go b/v1/topdown/trace.go
index c9df12b4c5..49748dcace 100644
--- a/v1/topdown/trace.go
+++ b/v1/topdown/trace.go
@@ -170,6 +170,7 @@ func (evt *Event) equalNodes(other *Event) bool {
 }
 
 // Tracer defines the interface for tracing in the top-down evaluation engine.
+//
 // Deprecated: Use QueryTracer instead.
 type Tracer interface {
 	Enabled() bool
@@ -230,6 +231,7 @@ func (b *BufferTracer) Enabled() bool {
 }
 
 // Trace adds the event to the buffer.
+//
 // Deprecated: Use TraceEvent instead.
 func (b *BufferTracer) Trace(evt *Event) {
 	*b = append(*b, evt)
@@ -806,7 +808,7 @@ func printPrettyVars(w *bytes.Buffer, exprVars map[string]varInfo) {
 
 		w.WriteString("\n\nWhere:\n")
 		for _, info := range byName {
-			w.WriteString(fmt.Sprintf("\n%s: %s", info.Title(), iStrs.Truncate(info.Value(), maxPrettyExprVarWidth)))
+			fmt.Fprintf(w, "\n%s: %s", info.Title(), iStrs.Truncate(info.Value(), maxPrettyExprVarWidth))
 		}
 
 		return
@@ -878,7 +880,7 @@ func printArrows(w *bytes.Buffer, l []varInfo, printValueAt int) {
 			valueStr := iStrs.Truncate(info.Value(), maxPrettyExprVarWidth)
 			if (i > 0 && col == l[i-1].col) || (i < len(l)-1 && col == l[i+1].col) {
 				// There is another var on this column, so we need to include the name to differentiate them.
-				w.WriteString(fmt.Sprintf("%s: %s", info.Title(), valueStr))
+				fmt.Fprintf(w, "%s: %s", info.Title(), valueStr)
 			} else {
 				w.WriteString(valueStr)
 			}
diff --git a/v1/types/types.go b/v1/types/types.go
index 366903f0cb..794f80ea2b 100644
--- a/v1/types/types.go
+++ b/v1/types/types.go
@@ -716,6 +716,7 @@ func (t *Function) NamedFuncArgs() FuncArgs {
 }
 
 // Args returns the function's arguments as a slice, ignoring variadic arguments.
+//
 // Deprecated: Use FuncArgs instead.
 func (t *Function) Args() []Type {
 	cpy := make([]Type, len(t.args))
diff --git a/v1/util/graph.go b/v1/util/graph.go
index f0e8242454..acb62590b6 100644
--- a/v1/util/graph.go
+++ b/v1/util/graph.go
@@ -77,13 +77,10 @@ func dfsRecursive(t Traversal, eq Equals, u, z T, path []T) []T {
 	}
 	for _, v := range t.Edges(u) {
 		if eq(v, z) {
-			path = append(path, z)
-			path = append(path, u)
-			return path
+			return append(path, z, u)
 		}
 		if p := dfsRecursive(t, eq, v, z, path); len(p) > 0 {
-			path = append(p, u)
-			return path
+			return append(p, u)
 		}
 	}
 	return path
diff --git a/v1/util/test/benchmark.go b/v1/util/test/benchmark.go
index 0176b7f29d..8ca20cf1d6 100644
--- a/v1/util/test/benchmark.go
+++ b/v1/util/test/benchmark.go
@@ -44,6 +44,7 @@ func PartialObjectBenchmarkCrossModule(n int) []string {
 	ruleBuilder := ""
 
 	for idx := 1; idx <= n; idx++ {
+		//nolint:perfsprint
 		barMod += fmt.Sprintf(`
 		bench_test_%[1]d := result if {
             input.bench_test_collector_mambo_number_%[3]d