diff --git a/cmd/installer/pkg/install/install.go b/cmd/installer/pkg/install/install.go
index 04e37ea3b9..a38c3fafa5 100644
--- a/cmd/installer/pkg/install/install.go
+++ b/cmd/installer/pkg/install/install.go
@@ -6,6 +6,7 @@ package install
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"log"
 	"os"
@@ -321,7 +322,7 @@ func (i *Installer) Install(ctx context.Context, mode Mode) (err error) {
 		}
 
 		if metaPartitionName == "" {
-			return fmt.Errorf("failed to detect META partition")
+			return errors.New("failed to detect META partition")
 		}
 
 		if metaState, err = meta.New(context.Background(), nil, meta.WithPrinter(i.options.Printf), meta.WithFixedPath(metaPartitionName)); err != nil {
diff --git a/cmd/installer/pkg/install/manifest.go b/cmd/installer/pkg/install/manifest.go
index 9f4a7f0662..76a517a87f 100644
--- a/cmd/installer/pkg/install/manifest.go
+++ b/cmd/installer/pkg/install/manifest.go
@@ -60,7 +60,7 @@ func NewManifest(mode Mode, uefiOnlyBoot bool, bootLoaderPresent bool, opts *Opt
 
 	if opts.Board != constants.BoardNone {
 		if uefiOnlyBoot {
-			return nil, fmt.Errorf("board option can't be used with uefi-only-boot")
+			return nil, errors.New("board option can't be used with uefi-only-boot")
 		}
 
 		var b runtime.Board
@@ -79,11 +79,11 @@ func NewManifest(mode Mode, uefiOnlyBoot bool, bootLoaderPresent bool, opts *Opt
 	}
 
 	if !opts.Force && opts.Zero {
-		return nil, fmt.Errorf("zero option can't be used without force")
+		return nil, errors.New("zero option can't be used without force")
 	}
 
 	if !opts.Force && !bootLoaderPresent {
-		return nil, fmt.Errorf("install with preserve is not supported if existing boot partition was not found")
+		return nil, errors.New("install with preserve is not supported if existing boot partition was not found")
 	}
 
 	// Verify that the target device(s) can satisfy the requested options.
diff --git a/cmd/talosctl/cmd/mgmt/cluster/create.go b/cmd/talosctl/cmd/mgmt/cluster/create.go
index f4826b9f43..fa5e16b321 100644
--- a/cmd/talosctl/cmd/mgmt/cluster/create.go
+++ b/cmd/talosctl/cmd/mgmt/cluster/create.go
@@ -262,7 +262,7 @@ func create(ctx context.Context, flags *pflag.FlagSet) error {
 	}
 
 	if controlplanes < 1 {
-		return fmt.Errorf("number of controlplanes can't be less than 1")
+		return errors.New("number of controlplanes can't be less than 1")
 	}
 
 	controlPlaneNanoCPUs, err := parseCPUShare(controlPlaneCpus)
@@ -287,7 +287,7 @@ func create(ctx context.Context, flags *pflag.FlagSet) error {
 	}
 
 	if !cidr4.Addr().Is4() {
-		return fmt.Errorf("--cidr is expected to be IPV4 CIDR")
+		return errors.New("--cidr is expected to be IPV4 CIDR")
 	}
 
 	// use ULA IPv6 network fd00::/8, add 'TAL' in hex to build /32 network, add IPv4 CIDR to build /64 unique network
@@ -312,7 +312,7 @@ func create(ctx context.Context, flags *pflag.FlagSet) error {
 	}
 
 	if len(cidrs) == 0 {
-		return fmt.Errorf("neither IPv4 nor IPv6 network was enabled")
+		return errors.New("neither IPv4 nor IPv6 network was enabled")
 	}
 
 	// Gateway addr at 1st IP in range, ex. 192.168.0.1
@@ -362,7 +362,7 @@ func create(ctx context.Context, flags *pflag.FlagSet) error {
 	// Validate network chaos flags
 	if !networkChaos {
 		if jitter != 0 || latency != 0 || packetLoss != 0 || packetReorder != 0 || packetCorrupt != 0 || bandwidth != 0 {
-			return fmt.Errorf("network chaos flags can only be used with --with-network-chaos")
+			return errors.New("network chaos flags can only be used with --with-network-chaos")
 		}
 	}
 
@@ -426,7 +426,7 @@ func create(ctx context.Context, flags *pflag.FlagSet) error {
 
 	if ports != "" {
 		if provisionerName != "docker" {
-			return fmt.Errorf("exposed-ports flag only supported with docker provisioner")
+			return errors.New("exposed-ports flag only supported with docker provisioner")
 		}
 
 		portList := strings.Split(ports, ",")
@@ -553,7 +553,7 @@ func create(ctx context.Context, flags *pflag.FlagSet) error {
 			}
 
 			if len(keys) == 0 {
-				return fmt.Errorf("no disk encryption key types enabled")
+				return errors.New("no disk encryption key types enabled")
 			}
 
 			if encryptStatePartition {
@@ -993,7 +993,7 @@ func getDisks() ([]*provision.Disk, error) {
 		)
 
 		if len(partitions)%2 != 0 {
-			return nil, fmt.Errorf("failed to parse malformed partition definitions")
+			return nil, errors.New("failed to parse malformed partition definitions")
 		}
 
 		partitionIndex := 0
@@ -1002,7 +1002,7 @@ func getDisks() ([]*provision.Disk, error) {
 			partitionPath := partitions[j]
 
 			if !strings.HasPrefix(partitionPath, "/var") {
-				return nil, fmt.Errorf("user disk partitions can only be mounted into /var folder")
+				return nil, errors.New("user disk partitions can only be mounted into /var folder")
 			}
 
 			value, e := strconv.ParseInt(partitions[j+1], 10, 0)
@@ -1012,7 +1012,7 @@ func getDisks() ([]*provision.Disk, error) {
 				partitionSize, e = humanize.ParseBytes(partitions[j+1])
 
 				if e != nil {
-					return nil, fmt.Errorf("failed to parse partition size")
+					return nil, errors.New("failed to parse partition size")
 				}
 			}
 
diff --git a/cmd/talosctl/cmd/mgmt/gen/config.go b/cmd/talosctl/cmd/mgmt/gen/config.go
index a8aa8c234b..f461dbfe30 100644
--- a/cmd/talosctl/cmd/mgmt/gen/config.go
+++ b/cmd/talosctl/cmd/mgmt/gen/config.go
@@ -5,6 +5,7 @@
 package gen
 
 import (
+	"errors"
 	"fmt"
 	"net/url"
 	"os"
@@ -262,15 +263,15 @@ func writeConfig(args []string) error {
 
 func validateFlags() error {
 	if len(genConfigCmdFlags.outputTypes) == 0 {
-		return fmt.Errorf("at least one output type must be specified")
+		return errors.New("at least one output type must be specified")
 	}
 
 	if len(genConfigCmdFlags.outputTypes) > 1 && genConfigCmdFlags.output == stdoutOutput {
-		return fmt.Errorf("can't use multiple output types with stdout")
+		return errors.New("can't use multiple output types with stdout")
 	}
 
 	if genConfigCmdFlags.outputDir != "" && genConfigCmdFlags.output != "" {
-		return fmt.Errorf("can't use both output-dir and output")
+		return errors.New("can't use both output-dir and output")
 	}
 
 	if genConfigCmdFlags.outputDir != "" {
diff --git a/cmd/talosctl/cmd/mgmt/gen/crt.go b/cmd/talosctl/cmd/mgmt/gen/crt.go
index 9ddd0c0086..1f9a59821b 100644
--- a/cmd/talosctl/cmd/mgmt/gen/crt.go
+++ b/cmd/talosctl/cmd/mgmt/gen/crt.go
@@ -7,6 +7,7 @@ package gen
 import (
 	stdlibx509 "crypto/x509"
 	"encoding/pem"
+	"errors"
 	"fmt"
 	"os"
 	"time"
@@ -38,7 +39,7 @@ var genCrtCmd = &cobra.Command{
 
 		caPemBlock, _ := pem.Decode(caBytes)
 		if caPemBlock == nil {
-			return fmt.Errorf("error decoding cert PEM")
+			return errors.New("error decoding cert PEM")
 		}
 
 		caCrt, err := stdlibx509.ParseCertificate(caPemBlock.Bytes)
@@ -53,7 +54,7 @@ var genCrtCmd = &cobra.Command{
 
 		keyPemBlock, _ := pem.Decode(keyBytes)
 		if keyPemBlock == nil {
-			return fmt.Errorf("error decoding key PEM")
+			return errors.New("error decoding key PEM")
 		}
 
 		caKey, err := stdlibx509.ParsePKCS8PrivateKey(keyPemBlock.Bytes)
@@ -68,7 +69,7 @@ var genCrtCmd = &cobra.Command{
 
 		csrPemBlock, _ := pem.Decode(csrBytes)
 		if csrPemBlock == nil {
-			return fmt.Errorf("error parsing CSR PEM")
+			return errors.New("error parsing CSR PEM")
 		}
 
 		ccsr, err := stdlibx509.ParseCertificateRequest(csrPemBlock.Bytes)
diff --git a/cmd/talosctl/cmd/mgmt/gen/csr.go b/cmd/talosctl/cmd/mgmt/gen/csr.go
index 66807910c6..5efaa2eb4c 100644
--- a/cmd/talosctl/cmd/mgmt/gen/csr.go
+++ b/cmd/talosctl/cmd/mgmt/gen/csr.go
@@ -7,6 +7,7 @@ package gen
 import (
 	stdlibx509 "crypto/x509"
 	"encoding/pem"
+	"errors"
 	"fmt"
 	"net"
 	"os"
@@ -40,7 +41,7 @@ var genCSRCmd = &cobra.Command{
 
 		pemBlock, _ := pem.Decode(keyBytes)
 		if pemBlock == nil {
-			return fmt.Errorf("error decoding PEM")
+			return errors.New("error decoding PEM")
 		}
 
 		keyEC, err := stdlibx509.ParsePKCS8PrivateKey(pemBlock.Bytes)
diff --git a/cmd/talosctl/cmd/mgmt/gen/secureboot.go b/cmd/talosctl/cmd/mgmt/gen/secureboot.go
index 9a418d548f..03959691e3 100644
--- a/cmd/talosctl/cmd/mgmt/gen/secureboot.go
+++ b/cmd/talosctl/cmd/mgmt/gen/secureboot.go
@@ -7,6 +7,7 @@ package gen
 import (
 	"context"
 	"encoding/pem"
+	"errors"
 	"fmt"
 	"io/fs"
 	"os"
@@ -191,11 +192,11 @@ func init() {
 func convertPEMToDER(data []byte) ([]byte, error) {
 	block, rest := pem.Decode(data)
 	if block == nil {
-		return nil, fmt.Errorf("failed to decode PEM data")
+		return nil, errors.New("failed to decode PEM data")
 	}
 
 	if len(rest) > 0 {
-		return nil, fmt.Errorf("more than one PEM block found in PEM data")
+		return nil, errors.New("more than one PEM block found in PEM data")
 	}
 
 	return block.Bytes, nil
diff --git a/cmd/talosctl/cmd/mgmt/kms_launch.go b/cmd/talosctl/cmd/mgmt/kms_launch.go
index 438e4d08df..0be09e956d 100644
--- a/cmd/talosctl/cmd/mgmt/kms_launch.go
+++ b/cmd/talosctl/cmd/mgmt/kms_launch.go
@@ -7,7 +7,6 @@ package mgmt
 import (
 	"context"
 	"errors"
-	"fmt"
 	"log"
 	"net"
 
@@ -34,7 +33,7 @@ var kmsLaunchCmd = &cobra.Command{
 	Hidden: true,
 	RunE: func(cmd *cobra.Command, args []string) error {
 		if kmsLaunchCmdFlags.key == nil {
-			return fmt.Errorf("no key provided to the KMS server")
+			return errors.New("no key provided to the KMS server")
 		}
 
 		srv := server.NewServer(func(_ context.Context, nodeUUID string) ([]byte, error) {
diff --git a/cmd/talosctl/cmd/talos/apply-config.go b/cmd/talosctl/cmd/talos/apply-config.go
index 8e95596c48..9c0d35302c 100644
--- a/cmd/talosctl/cmd/talos/apply-config.go
+++ b/cmd/talosctl/cmd/talos/apply-config.go
@@ -6,6 +6,7 @@ package talos
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"os"
 	"strings"
@@ -53,7 +54,7 @@ var applyConfigCmd = &cobra.Command{
 			} else if cmd.CalledAs() == "apply-config" {
 				cmd.Help() //nolint:errcheck
 
-				return fmt.Errorf("expected no positional arguments")
+				return errors.New("expected no positional arguments")
 			}
 		}
 
@@ -64,7 +65,7 @@ var applyConfigCmd = &cobra.Command{
 			}
 
 			if len(cfgBytes) < 1 {
-				return fmt.Errorf("no configuration data read")
+				return errors.New("no configuration data read")
 			}
 
 			if len(applyConfigCmdFlags.patches) != 0 {
@@ -89,7 +90,7 @@ var applyConfigCmd = &cobra.Command{
 				}
 			}
 		} else if applyConfigCmdFlags.Mode.Mode != helpers.InteractiveMode {
-			return fmt.Errorf("no filename supplied for configuration")
+			return errors.New("no filename supplied for configuration")
 		}
 
 		withClient := func(f func(context.Context, *client.Client) error) error {
diff --git a/cmd/talosctl/cmd/talos/bootstrap.go b/cmd/talosctl/cmd/talos/bootstrap.go
index 96814f40d7..179c87d589 100644
--- a/cmd/talosctl/cmd/talos/bootstrap.go
+++ b/cmd/talosctl/cmd/talos/bootstrap.go
@@ -6,6 +6,7 @@ package talos
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"os"
 
@@ -38,7 +39,7 @@ Talos etcd cluster can be recovered from a known snapshot with '--recover-from='
 	RunE: func(cmd *cobra.Command, args []string) error {
 		return WithClient(func(ctx context.Context, c *client.Client) error {
 			if len(GlobalArgs.Nodes) > 1 {
-				return fmt.Errorf("command \"bootstrap\" is not supported with multiple nodes")
+				return errors.New("command \"bootstrap\" is not supported with multiple nodes")
 			}
 
 			if bootstrapCmdFlags.recoverFrom != "" {
diff --git a/cmd/talosctl/cmd/talos/config.go b/cmd/talosctl/cmd/talos/config.go
index 20d97294bf..4a6d6a3786 100644
--- a/cmd/talosctl/cmd/talos/config.go
+++ b/cmd/talosctl/cmd/talos/config.go
@@ -53,7 +53,7 @@ func openConfigAndContext(context string) (*clientconfig.Config, error) {
 	}
 
 	if context == "" {
-		return nil, fmt.Errorf("no context is set")
+		return nil, errors.New("no context is set")
 	}
 
 	if _, ok := c.Contexts[context]; !ok {
@@ -215,7 +215,7 @@ var configRemoveCmd = &cobra.Command{
 	RunE: func(cmd *cobra.Command, args []string) error {
 		pattern := args[0]
 		if pattern == "" {
-			return fmt.Errorf("no context specified")
+			return errors.New("no context specified")
 		}
 
 		c, err := clientconfig.Open(GlobalArgs.Talosconfig)
@@ -293,7 +293,7 @@ func checkAndSetCrtAndKey(configContext *clientconfig.Context) error {
 	}
 
 	if crt == "" || key == "" {
-		return fmt.Errorf("if either the 'crt' or 'key' flag is specified, both are required")
+		return errors.New("if either the 'crt' or 'key' flag is specified, both are required")
 	}
 
 	crtBytes, err := os.ReadFile(crt)
@@ -491,7 +491,7 @@ func configInfo(config *clientconfig.Config, now time.Time) (talosconfigInfo, er
 
 		block, _ := pem.Decode(b)
 		if block == nil {
-			return talosconfigInfo{}, fmt.Errorf("error decoding PEM")
+			return talosconfigInfo{}, errors.New("error decoding PEM")
 		}
 
 		var crt *x509.Certificate
diff --git a/cmd/talosctl/cmd/talos/crashdump.go b/cmd/talosctl/cmd/talos/crashdump.go
index 82d7f88f9e..e772be9dd0 100644
--- a/cmd/talosctl/cmd/talos/crashdump.go
+++ b/cmd/talosctl/cmd/talos/crashdump.go
@@ -6,7 +6,7 @@ package talos
 
 import (
 	"context"
-	"fmt"
+	"errors"
 
 	"github.com/spf13/cobra"
 
@@ -26,7 +26,7 @@ var crashdumpCmd = &cobra.Command{
 	Hidden: true,
 	RunE: func(cmd *cobra.Command, args []string) error {
 		return WithClient(func(ctx context.Context, c *client.Client) error {
-			return fmt.Errorf("`talosctl crashdump` is deprecated, please use `talosctl support` instead")
+			return errors.New("`talosctl crashdump` is deprecated, please use `talosctl support` instead")
 		})
 	},
 }
diff --git a/cmd/talosctl/cmd/talos/diskusage.go b/cmd/talosctl/cmd/talos/diskusage.go
index 1a36564f7a..40dbe3493d 100644
--- a/cmd/talosctl/cmd/talos/diskusage.go
+++ b/cmd/talosctl/cmd/talos/diskusage.go
@@ -6,6 +6,7 @@ package talos
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"os"
 	"strconv"
@@ -81,7 +82,7 @@ var duCmd = &cobra.Command{
 
 			return helpers.ReadGRPCStream(stream, func(info *machineapi.DiskUsageInfo, node string, multipleNodes bool) error {
 				if info.Error != "" {
-					return helpers.NonFatalError(fmt.Errorf(info.Error))
+					return helpers.NonFatalError(errors.New(info.Error))
 				}
 
 				pattern := "%s\t%s\n"
diff --git a/cmd/talosctl/cmd/talos/edit.go b/cmd/talosctl/cmd/talos/edit.go
index f901301825..fbe4f0e220 100644
--- a/cmd/talosctl/cmd/talos/edit.go
+++ b/cmd/talosctl/cmd/talos/edit.go
@@ -55,7 +55,7 @@ func editFn(c *client.Client) func(context.Context, string, resource.Resource, e
 		}
 
 		if mc.Metadata().Type() != config.MachineConfigType {
-			return fmt.Errorf("only the machineconfig resource can be edited")
+			return errors.New("only the machineconfig resource can be edited")
 		}
 
 		metadata := mc.Metadata()
diff --git a/cmd/talosctl/cmd/talos/interfaces.go b/cmd/talosctl/cmd/talos/interfaces.go
index c99afb79a6..d3425756cb 100644
--- a/cmd/talosctl/cmd/talos/interfaces.go
+++ b/cmd/talosctl/cmd/talos/interfaces.go
@@ -6,7 +6,7 @@ package talos
 
 import (
 	"context"
-	"fmt"
+	"errors"
 
 	"github.com/spf13/cobra"
 
@@ -22,7 +22,7 @@ var interfacesCmd = &cobra.Command{
 	Hidden: true,
 	RunE: func(cmd *cobra.Command, args []string) error {
 		return WithClient(func(ctx context.Context, c *client.Client) error {
-			return fmt.Errorf("`talosctl interfaces` is deprecated, please use `talosctl get addresses` and `talosctl get links` instead")
+			return errors.New("`talosctl interfaces` is deprecated, please use `talosctl get addresses` and `talosctl get links` instead")
 		})
 	},
 }
diff --git a/cmd/talosctl/cmd/talos/list.go b/cmd/talosctl/cmd/talos/list.go
index b50a202ced..c943845d88 100644
--- a/cmd/talosctl/cmd/talos/list.go
+++ b/cmd/talosctl/cmd/talos/list.go
@@ -6,6 +6,7 @@ package talos
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"os"
 	"strconv"
@@ -47,7 +48,7 @@ var lsCmd = &cobra.Command{
 	},
 	RunE: func(cmd *cobra.Command, args []string) error {
 		if recurse && recursionDepth != 1 {
-			return fmt.Errorf("only one of flags --recurse and --depth can be specified at the same time")
+			return errors.New("only one of flags --recurse and --depth can be specified at the same time")
 		}
 
 		return WithClient(func(ctx context.Context, c *client.Client) error {
diff --git a/cmd/talosctl/cmd/talos/netstat.go b/cmd/talosctl/cmd/talos/netstat.go
index 7492a8009f..96a0b040d6 100644
--- a/cmd/talosctl/cmd/talos/netstat.go
+++ b/cmd/talosctl/cmd/talos/netstat.go
@@ -6,6 +6,7 @@ package talos
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"os"
 	"strconv"
@@ -90,7 +91,7 @@ If you don't pass an argument, the command will show host connections.`,
 
 		return WithClient(func(ctx context.Context, c *client.Client) (err error) {
 			if netstatCmdFlags.pods && len(args) > 0 {
-				return fmt.Errorf("cannot use --pods and specify a pod")
+				return errors.New("cannot use --pods and specify a pod")
 			}
 
 			findThePod := len(args) > 0
diff --git a/cmd/talosctl/cmd/talos/patch.go b/cmd/talosctl/cmd/talos/patch.go
index 8ae5104fad..92a6a92203 100644
--- a/cmd/talosctl/cmd/talos/patch.go
+++ b/cmd/talosctl/cmd/talos/patch.go
@@ -7,6 +7,7 @@ package talos
 import (
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"os"
 	"time"
@@ -99,7 +100,7 @@ var patchCmd = &cobra.Command{
 			}
 
 			if len(patchCmdFlags.patch) == 0 {
-				return fmt.Errorf("either --patch or --patch-file should be defined")
+				return errors.New("either --patch or --patch-file should be defined")
 			}
 
 			patches, err := configpatcher.LoadPatches(patchCmdFlags.patch)
diff --git a/cmd/talosctl/cmd/talos/reboot.go b/cmd/talosctl/cmd/talos/reboot.go
index d45207b344..08e266638e 100644
--- a/cmd/talosctl/cmd/talos/reboot.go
+++ b/cmd/talosctl/cmd/talos/reboot.go
@@ -6,6 +6,7 @@ package talos
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
 	"github.com/spf13/cobra"
@@ -75,7 +76,7 @@ func rebootGetActorID(opts ...client.RebootMode) func(ctx context.Context, c *cl
 		}
 
 		if len(resp.GetMessages()) == 0 {
-			return "", fmt.Errorf("no messages returned from action run")
+			return "", errors.New("no messages returned from action run")
 		}
 
 		return resp.GetMessages()[0].GetActorId(), nil
diff --git a/cmd/talosctl/cmd/talos/reset.go b/cmd/talosctl/cmd/talos/reset.go
index e76a7699f2..f72340e894 100644
--- a/cmd/talosctl/cmd/talos/reset.go
+++ b/cmd/talosctl/cmd/talos/reset.go
@@ -6,6 +6,7 @@ package talos
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"sort"
 	"strings"
@@ -91,7 +92,7 @@ var resetCmd = &cobra.Command{
 		resetRequest := buildResetRequest()
 
 		if resetCmdFlags.wait && resetCmdFlags.insecure {
-			return fmt.Errorf("cannot use --wait and --insecure together")
+			return errors.New("cannot use --wait and --insecure together")
 		}
 
 		if !resetCmdFlags.wait {
@@ -176,7 +177,7 @@ func resetGetActorID(ctx context.Context, c *client.Client, req *machineapi.Rese
 	}
 
 	if len(resp.GetMessages()) == 0 {
-		return "", fmt.Errorf("no messages returned from action run")
+		return "", errors.New("no messages returned from action run")
 	}
 
 	return resp.GetMessages()[0].GetActorId(), nil
diff --git a/cmd/talosctl/cmd/talos/routes.go b/cmd/talosctl/cmd/talos/routes.go
index bb082a7a77..28691e9d0c 100644
--- a/cmd/talosctl/cmd/talos/routes.go
+++ b/cmd/talosctl/cmd/talos/routes.go
@@ -6,7 +6,7 @@ package talos
 
 import (
 	"context"
-	"fmt"
+	"errors"
 
 	"github.com/spf13/cobra"
 
@@ -23,7 +23,7 @@ var routesCmd = &cobra.Command{
 	Hidden:  true,
 	RunE: func(cmd *cobra.Command, args []string) error {
 		return WithClient(func(ctx context.Context, c *client.Client) error {
-			return fmt.Errorf("`talosctl routes` is deprecated, please use `talosctl get routes` instead")
+			return errors.New("`talosctl routes` is deprecated, please use `talosctl get routes` instead")
 		})
 	},
 }
diff --git a/cmd/talosctl/cmd/talos/shutdown.go b/cmd/talosctl/cmd/talos/shutdown.go
index bbbc1ee05f..d3bb7c3624 100644
--- a/cmd/talosctl/cmd/talos/shutdown.go
+++ b/cmd/talosctl/cmd/talos/shutdown.go
@@ -6,6 +6,7 @@ package talos
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
 	"github.com/spf13/cobra"
@@ -66,7 +67,7 @@ func shutdownGetActorID(ctx context.Context, c *client.Client) (string, error) {
 	}
 
 	if len(resp.GetMessages()) == 0 {
-		return "", fmt.Errorf("no messages returned from action run")
+		return "", errors.New("no messages returned from action run")
 	}
 
 	return resp.GetMessages()[0].GetActorId(), nil
diff --git a/cmd/talosctl/cmd/talos/support.go b/cmd/talosctl/cmd/talos/support.go
index 8606c7bd1a..03772b9cc9 100644
--- a/cmd/talosctl/cmd/talos/support.go
+++ b/cmd/talosctl/cmd/talos/support.go
@@ -61,7 +61,7 @@ var supportCmd = &cobra.Command{
 	Args: cobra.NoArgs,
 	RunE: func(cmd *cobra.Command, args []string) error {
 		if len(GlobalArgs.Nodes) == 0 {
-			return fmt.Errorf("please provide at least a single node to gather the debug information from")
+			return errors.New("please provide at least a single node to gather the debug information from")
 		}
 
 		f, err := openArchive()
diff --git a/cmd/talosctl/cmd/talos/time.go b/cmd/talosctl/cmd/talos/time.go
index 76725acb3f..45d77a8fd3 100644
--- a/cmd/talosctl/cmd/talos/time.go
+++ b/cmd/talosctl/cmd/talos/time.go
@@ -6,6 +6,7 @@ package talos
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"os"
 	"text/tabwriter"
@@ -66,11 +67,11 @@ var timeCmd = &cobra.Command{
 				}
 
 				if !msg.Localtime.IsValid() {
-					return fmt.Errorf("error parsing local time")
+					return errors.New("error parsing local time")
 				}
 
 				if !msg.Remotetime.IsValid() {
-					return fmt.Errorf("error parsing remote time")
+					return errors.New("error parsing remote time")
 				}
 
 				localtime = msg.Localtime.AsTime()
diff --git a/cmd/talosctl/cmd/talos/upgrade.go b/cmd/talosctl/cmd/talos/upgrade.go
index c2143ee9c4..58452ded67 100644
--- a/cmd/talosctl/cmd/talos/upgrade.go
+++ b/cmd/talosctl/cmd/talos/upgrade.go
@@ -6,6 +6,7 @@ package talos
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"os"
 	"sort"
@@ -50,7 +51,7 @@ var upgradeCmd = &cobra.Command{
 		}
 
 		if upgradeCmdFlags.wait && upgradeCmdFlags.insecure {
-			return fmt.Errorf("cannot use --wait and --insecure together")
+			return errors.New("cannot use --wait and --insecure together")
 		}
 
 		rebootModeStr := strings.ToUpper(upgradeCmdFlags.rebootMode)
@@ -137,7 +138,7 @@ func upgradeGetActorID(ctx context.Context, c *client.Client, opts []client.Upgr
 	}
 
 	if len(resp.GetMessages()) == 0 {
-		return "", fmt.Errorf("no messages returned from action run")
+		return "", errors.New("no messages returned from action run")
 	}
 
 	return resp.GetMessages()[0].GetActorId(), nil
diff --git a/cmd/talosctl/pkg/talos/action/node.go b/cmd/talosctl/pkg/talos/action/node.go
index be850f3937..6af7202e7a 100644
--- a/cmd/talosctl/pkg/talos/action/node.go
+++ b/cmd/talosctl/pkg/talos/action/node.go
@@ -268,7 +268,7 @@ func (a *nodeTracker) handleEvent(event client.Event) error {
 		})
 
 		if msg.GetTask() == "stopAllServices" {
-			return retry.ExpectedError(fmt.Errorf("stopAllServices task completed"))
+			return retry.ExpectedErrorf("stopAllServices task completed")
 		}
 
 	case *machineapi.SequenceEvent:
diff --git a/cmd/talosctl/pkg/talos/global/client.go b/cmd/talosctl/pkg/talos/global/client.go
index dae2601cbf..d6412202a5 100644
--- a/cmd/talosctl/pkg/talos/global/client.go
+++ b/cmd/talosctl/pkg/talos/global/client.go
@@ -8,6 +8,7 @@ package global
 import (
 	"context"
 	"crypto/tls"
+	"errors"
 	"fmt"
 
 	"github.com/siderolabs/crypto/x509"
@@ -69,7 +70,7 @@ func (c *Args) WithClientNoNodes(action func(context.Context, *client.Client) er
 }
 
 // ErrConfigContext is returned when config context cannot be resolved.
-var ErrConfigContext = fmt.Errorf("failed to resolve config context")
+var ErrConfigContext = errors.New("failed to resolve config context")
 
 // WithClient builds upon WithClientNoNodes to provide set of nodes on request context based on config & flags.
 func (c *Args) WithClient(action func(context.Context, *client.Client) error, dialOptions ...grpc.DialOption) error {
@@ -85,7 +86,7 @@ func (c *Args) WithClient(action func(context.Context, *client.Client) error, di
 			}
 
 			if len(c.Nodes) < 1 {
-				return fmt.Errorf("nodes are not set for the command: please use `--nodes` flag or configuration file to set the nodes to run the command against")
+				return errors.New("nodes are not set for the command: please use `--nodes` flag or configuration file to set the nodes to run the command against")
 			}
 
 			ctx = client.WithNodes(ctx, c.Nodes...)
diff --git a/cmd/talosctl/pkg/talos/helpers/archive.go b/cmd/talosctl/pkg/talos/helpers/archive.go
index f46d8009b0..dc7ffb7cf5 100644
--- a/cmd/talosctl/pkg/talos/helpers/archive.go
+++ b/cmd/talosctl/pkg/talos/helpers/archive.go
@@ -7,6 +7,7 @@ package helpers
 import (
 	"archive/tar"
 	"compress/gzip"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -38,7 +39,7 @@ func ExtractFileFromTarGz(filename string, r io.ReadCloser) ([]byte, error) {
 
 		hdrPath := safepath.CleanPath(hdr.Name)
 		if hdrPath == "" {
-			return nil, fmt.Errorf("empty tar header path")
+			return nil, errors.New("empty tar header path")
 		}
 
 		if hdrPath == filename {
@@ -78,7 +79,7 @@ func ExtractTarGz(localPath string, r io.ReadCloser) error {
 
 		hdrPath := safepath.CleanPath(hdr.Name)
 		if hdrPath == "" {
-			return fmt.Errorf("empty tar header path")
+			return errors.New("empty tar header path")
 		}
 
 		path := filepath.Join(localPath, hdrPath)
diff --git a/cmd/talosctl/pkg/talos/helpers/checks.go b/cmd/talosctl/pkg/talos/helpers/checks.go
index eb3253e06c..3fde276eda 100644
--- a/cmd/talosctl/pkg/talos/helpers/checks.go
+++ b/cmd/talosctl/pkg/talos/helpers/checks.go
@@ -6,6 +6,7 @@ package helpers
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"os"
 	"strings"
@@ -39,7 +40,7 @@ func CheckErrors[T interface{ GetMetadata() *common.Metadata }](messages ...T) e
 	for _, msg := range messages {
 		md := msg.GetMetadata()
 		if md != nil && md.Error != "" {
-			err = AppendErrors(err, fmt.Errorf(md.Error))
+			err = AppendErrors(err, errors.New(md.Error))
 		}
 	}
 
diff --git a/cmd/talosctl/pkg/talos/helpers/resources.go b/cmd/talosctl/pkg/talos/helpers/resources.go
index d6b566ae2f..e99ae6bcde 100644
--- a/cmd/talosctl/pkg/talos/helpers/resources.go
+++ b/cmd/talosctl/pkg/talos/helpers/resources.go
@@ -6,7 +6,7 @@ package helpers
 
 import (
 	"context"
-	"fmt"
+	"errors"
 
 	"github.com/cosi-project/runtime/pkg/resource"
 	"github.com/cosi-project/runtime/pkg/resource/meta"
@@ -27,7 +27,7 @@ func ForEachResource(ctx context.Context,
 	args ...string,
 ) error {
 	if len(args) == 0 {
-		return fmt.Errorf("not enough arguments: at least 1 is expected")
+		return errors.New("not enough arguments: at least 1 is expected")
 	}
 
 	resourceType := args[0]
diff --git a/cmd/talosctl/pkg/talos/helpers/stream.go b/cmd/talosctl/pkg/talos/helpers/stream.go
index bd04ca9e8a..a7094ce8dc 100644
--- a/cmd/talosctl/pkg/talos/helpers/stream.go
+++ b/cmd/talosctl/pkg/talos/helpers/stream.go
@@ -56,7 +56,7 @@ func ReadGRPCStream[S Stream[T], T Message](stream S, handler func(T, string, bo
 			}
 
 			if info.GetMetadata().Error != "" {
-				streamErrs = AppendErrors(streamErrs, fmt.Errorf(info.GetMetadata().Error))
+				streamErrs = AppendErrors(streamErrs, errors.New(info.GetMetadata().Error))
 
 				continue
 			}
diff --git a/hack/cloud-image-uploader/aws.go b/hack/cloud-image-uploader/aws.go
index 4f66fb1531..4dd7a7f630 100644
--- a/hack/cloud-image-uploader/aws.go
+++ b/hack/cloud-image-uploader/aws.go
@@ -237,11 +237,11 @@ func (au *AWSUploader) registerAMIArch(ctx context.Context, region string, svc *
 					log.Printf("aws: import into %s/%s, import snapshot %s%%", region, arch, progress)
 				}
 
-				return retry.ExpectedError(fmt.Errorf("task status is %s", *task.SnapshotTaskDetail.Status))
+				return retry.ExpectedErrorf("task status is %s", *task.SnapshotTaskDetail.Status)
 			}
 		}
 
-		return retry.ExpectedError(fmt.Errorf("task status not found"))
+		return retry.ExpectedErrorf("task status not found")
 	})
 	if err != nil {
 		log.Printf("WARNING: aws: ignoring failure to import snapshot into %s/%s: %s", region, arch, err)
diff --git a/hack/cloud-image-uploader/azure.go b/hack/cloud-image-uploader/azure.go
index 7ff01a59de..5593d3bf75 100644
--- a/hack/cloud-image-uploader/azure.go
+++ b/hack/cloud-image-uploader/azure.go
@@ -8,6 +8,7 @@ import (
 	"bytes"
 	"context"
 	_ "embed"
+	"errors"
 	"fmt"
 	"io"
 	"log"
@@ -166,7 +167,7 @@ func (azu *AzureUploader) uploadAzureBlob(ctx context.Context, arch string) erro
 
 	// Check if the file size is a multiple of 512 bytes
 	if totalSize%pageblob.PageBytes != 0 {
-		return fmt.Errorf("azure: error: the file size must be a multiple of 512 bytes")
+		return errors.New("azure: error: the file size must be a multiple of 512 bytes")
 	}
 
 	_, err = pageBlobClient.Create(ctx, totalSize, nil)
@@ -350,7 +351,7 @@ type azureHelper struct {
 func (helper *azureHelper) setDefaultAzureCreds() error {
 	helper.subscriptionID = os.Getenv("AZURE_SUBSCRIPTION_ID")
 	if len(helper.subscriptionID) == 0 {
-		return fmt.Errorf("azure: AZURE_SUBSCRIPTION_ID is not set")
+		return errors.New("azure: AZURE_SUBSCRIPTION_ID is not set")
 	}
 
 	authFromEnvironment, err := auth.NewAuthorizerFromEnvironment()
diff --git a/hack/module-sig-verify/main.go b/hack/module-sig-verify/main.go
index a7379245d9..3f3d3df54e 100644
--- a/hack/module-sig-verify/main.go
+++ b/hack/module-sig-verify/main.go
@@ -12,6 +12,7 @@ import (
 	"crypto/sha512"
 	"crypto/x509"
 	"encoding/binary"
+	"errors"
 	"flag"
 	"fmt"
 	"io"
@@ -177,7 +178,7 @@ func verifyModule(crt *x509.Certificate, moduleData io.ReadSeeker) error {
 
 	pubKey, ok := crt.PublicKey.(*rsa.PublicKey)
 	if !ok {
-		return fmt.Errorf("failed to convert public key to RSA key")
+		return errors.New("failed to convert public key to RSA key")
 	}
 
 	if err := rsa.VerifyPKCS1v15(pubKey, crypto.SHA512, hashed[:], signatureSigned); err != nil {
diff --git a/hack/structprotogen/loader/loader.go b/hack/structprotogen/loader/loader.go
index 96bc2c68ad..f8fe5a759e 100644
--- a/hack/structprotogen/loader/loader.go
+++ b/hack/structprotogen/loader/loader.go
@@ -26,7 +26,7 @@ func LoadPackages(pkgPath string) ([]*packages.Package, error) {
 	}
 
 	if len(pkgs) == 0 {
-		return nil, fmt.Errorf("no packages found")
+		return nil, errors.New("no packages found")
 	}
 
 	err = collectErrors(pkgs)
diff --git a/hack/structprotogen/types/types.go b/hack/structprotogen/types/types.go
index e4ee07651c..acb5154ed2 100644
--- a/hack/structprotogen/types/types.go
+++ b/hack/structprotogen/types/types.go
@@ -7,6 +7,7 @@ package types
 
 //nolint:gci
 import (
+	"errors"
 	"fmt"
 	"go/types"
 	"path"
@@ -43,7 +44,7 @@ func FindPkgDecls(taggedStructs ast.TaggedStructs, loadedPkgs []*packages.Packag
 	}
 
 	if result.Len() == 0 {
-		return slices.Sorted[*PkgDecl]{}, fmt.Errorf("no definitions found")
+		return slices.Sorted[*PkgDecl]{}, errors.New("no definitions found")
 	}
 
 	return result, nil
diff --git a/internal/app/apid/main.go b/internal/app/apid/main.go
index fcd944b007..0e43d7510a 100644
--- a/internal/app/apid/main.go
+++ b/internal/app/apid/main.go
@@ -8,6 +8,7 @@ package apid
 import (
 	"context"
 	"crypto/x509"
+	"errors"
 	"flag"
 	"fmt"
 	"log"
@@ -241,7 +242,7 @@ func apidMain() error {
 
 func verifyExtKeyUsage(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
 	if len(verifiedChains) == 0 {
-		return fmt.Errorf("no verified chains")
+		return errors.New("no verified chains")
 	}
 
 	certs := verifiedChains[0]
diff --git a/internal/app/machined/internal/server/v1alpha1/v1alpha1_server.go b/internal/app/machined/internal/server/v1alpha1/v1alpha1_server.go
index c1b8213004..f37a959511 100644
--- a/internal/app/machined/internal/server/v1alpha1/v1alpha1_server.go
+++ b/internal/app/machined/internal/server/v1alpha1/v1alpha1_server.go
@@ -305,7 +305,7 @@ Config diff:
 // GenerateConfiguration implements the machine.MachineServer interface.
 func (s *Server) GenerateConfiguration(ctx context.Context, in *machine.GenerateConfigurationRequest) (reply *machine.GenerateConfigurationResponse, err error) {
 	if s.Controller.Runtime().Config().Machine().Type() == machinetype.TypeWorker {
-		return nil, fmt.Errorf("config can't be generated on worker nodes")
+		return nil, errors.New("config can't be generated on worker nodes")
 	}
 
 	return configuration.Generate(ctx, in)
@@ -572,7 +572,7 @@ func (s *Server) Reset(ctx context.Context, in *machine.ResetRequest) (reply *ma
 
 	if len(in.GetUserDisksToWipe()) > 0 {
 		if in.Mode == machine.ResetRequest_SYSTEM_DISK {
-			return nil, fmt.Errorf("reset failed: invalid input, wipe mode SYSTEM_DISK doesn't support UserDisksToWipe parameter")
+			return nil, errors.New("reset failed: invalid input, wipe mode SYSTEM_DISK doesn't support UserDisksToWipe parameter")
 		}
 
 		var diskList []*bddisk.Disk
@@ -607,7 +607,7 @@ func (s *Server) Reset(ctx context.Context, in *machine.ResetRequest) (reply *ma
 
 	if len(in.GetSystemPartitionsToWipe()) > 0 {
 		if in.Mode == machine.ResetRequest_USER_DISKS {
-			return nil, fmt.Errorf("reset failed: invalid input, wipe mode USER_DISKS doesn't support SystemPartitionsToWipe parameter")
+			return nil, errors.New("reset failed: invalid input, wipe mode USER_DISKS doesn't support SystemPartitionsToWipe parameter")
 		}
 
 		bd := s.Controller.Runtime().State().Machine().Disk().BlockDevice
@@ -1294,7 +1294,7 @@ func (s *Server) Read(in *machine.ReadRequest, srv machine.MachineService_ReadSe
 
 		return nil
 	default:
-		return fmt.Errorf("path must be a regular file")
+		return errors.New("path must be a regular file")
 	}
 }
 
diff --git a/internal/app/machined/pkg/adapters/kubespan/identity.go b/internal/app/machined/pkg/adapters/kubespan/identity.go
index dc1ead970f..c31670a17a 100644
--- a/internal/app/machined/pkg/adapters/kubespan/identity.go
+++ b/internal/app/machined/pkg/adapters/kubespan/identity.go
@@ -5,6 +5,7 @@
 package kubespan
 
 import (
+	"errors"
 	"fmt"
 	"net"
 	"net/netip"
@@ -57,7 +58,7 @@ func (a identity) UpdateAddress(clusterID string, mac net.HardwareAddr) error {
 
 func wgEUI64(prefix netip.Prefix, mac net.HardwareAddr) (out netip.Prefix, err error) {
 	if value.IsZero(prefix) {
-		return out, fmt.Errorf("cannot calculate IP from zero prefix")
+		return out, errors.New("cannot calculate IP from zero prefix")
 	}
 
 	stdIP, err := eui64.ParseMAC(netipx.PrefixIPNet(prefix).IP, mac)
diff --git a/internal/app/machined/pkg/controllers/cluster/affiliate_merge.go b/internal/app/machined/pkg/controllers/cluster/affiliate_merge.go
index 955da6e6b2..ac558f5853 100644
--- a/internal/app/machined/pkg/controllers/cluster/affiliate_merge.go
+++ b/internal/app/machined/pkg/controllers/cluster/affiliate_merge.go
@@ -6,6 +6,7 @@ package cluster
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
 	"github.com/cosi-project/runtime/pkg/controller"
@@ -58,7 +59,7 @@ func (ctrl *AffiliateMergeController) Run(ctx context.Context, r controller.Runt
 
 		rawAffiliates, err := safe.ReaderList[*cluster.Affiliate](ctx, r, resource.NewMetadata(cluster.RawNamespaceName, cluster.AffiliateType, "", resource.VersionUndefined))
 		if err != nil {
-			return fmt.Errorf("error listing affiliates")
+			return errors.New("error listing affiliates")
 		}
 
 		mergedAffiliates := make(map[resource.ID]*cluster.AffiliateSpec, rawAffiliates.Len())
diff --git a/internal/app/machined/pkg/controllers/cluster/member.go b/internal/app/machined/pkg/controllers/cluster/member.go
index b559b607da..c0a0c58c67 100644
--- a/internal/app/machined/pkg/controllers/cluster/member.go
+++ b/internal/app/machined/pkg/controllers/cluster/member.go
@@ -6,6 +6,7 @@ package cluster
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"slices"
 
@@ -59,7 +60,7 @@ func (ctrl *MemberController) Run(ctx context.Context, r controller.Runtime, _ *
 
 		affiliates, err := safe.ReaderListAll[*cluster.Affiliate](ctx, r)
 		if err != nil {
-			return fmt.Errorf("error listing affiliates")
+			return errors.New("error listing affiliates")
 		}
 
 		touchedIDs := make(map[resource.ID]struct{})
diff --git a/internal/app/machined/pkg/controllers/config/acquire_test.go b/internal/app/machined/pkg/controllers/config/acquire_test.go
index a20a7fb49f..1f616a014d 100644
--- a/internal/app/machined/pkg/controllers/config/acquire_test.go
+++ b/internal/app/machined/pkg/controllers/config/acquire_test.go
@@ -8,6 +8,7 @@ import (
 	"bytes"
 	"compress/gzip"
 	"context"
+	stderrors "errors"
 	"fmt"
 	"math/rand"
 	"net/url"
@@ -325,7 +326,7 @@ func (suite *AcquireSuite) TestFromPlatform() {
 }
 
 func (suite *AcquireSuite) TestFromPlatformFailure() {
-	suite.platformConfig.err = fmt.Errorf("mock error")
+	suite.platformConfig.err = stderrors.New("mock error")
 
 	suite.triggerAcquire()
 
diff --git a/internal/app/machined/pkg/controllers/etcd/advertised_peer.go b/internal/app/machined/pkg/controllers/etcd/advertised_peer.go
index 4541ab2219..d920ed57ea 100644
--- a/internal/app/machined/pkg/controllers/etcd/advertised_peer.go
+++ b/internal/app/machined/pkg/controllers/etcd/advertised_peer.go
@@ -6,6 +6,7 @@ package etcd
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net/netip"
 	"reflect"
@@ -144,7 +145,7 @@ func (ctrl *AdvertisedPeerController) updateAdvertisedPeers(ctx context.Context,
 	}
 
 	if localMember == nil {
-		return fmt.Errorf("local member not found in member list")
+		return errors.New("local member not found in member list")
 	}
 
 	newPeerURLs := xslices.Map(advertisedAddresses, func(addr netip.Addr) string {
diff --git a/internal/app/machined/pkg/controllers/etcd/member_test.go b/internal/app/machined/pkg/controllers/etcd/member_test.go
index a93df983ad..cb6d53847b 100644
--- a/internal/app/machined/pkg/controllers/etcd/member_test.go
+++ b/internal/app/machined/pkg/controllers/etcd/member_test.go
@@ -6,7 +6,6 @@ package etcd_test
 
 import (
 	"context"
-	"fmt"
 	"testing"
 	"time"
 
@@ -72,7 +71,7 @@ func (suite *MemberSuite) assertInexistentEtcdMember(member *etcd.Member) func()
 			return retry.ExpectedError(err)
 		}
 
-		return retry.ExpectedError(fmt.Errorf("should not exist"))
+		return retry.ExpectedErrorf("should not exist")
 	}
 }
 
diff --git a/internal/app/machined/pkg/controllers/k8s/control_plane_static_pod_test.go b/internal/app/machined/pkg/controllers/k8s/control_plane_static_pod_test.go
index 50348ffd52..81207a8259 100644
--- a/internal/app/machined/pkg/controllers/k8s/control_plane_static_pod_test.go
+++ b/internal/app/machined/pkg/controllers/k8s/control_plane_static_pod_test.go
@@ -2,7 +2,6 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-//nolint:dupl
 package k8s_test
 
 import (
@@ -83,7 +82,6 @@ func (suite *ControlPlaneStaticPodSuite) startRuntime() {
 	}()
 }
 
-//nolint:dupl
 func (suite *ControlPlaneStaticPodSuite) assertControlPlaneStaticPods(manifests []string) error {
 	resources, err := suite.state.List(
 		suite.ctx,
@@ -96,7 +94,7 @@ func (suite *ControlPlaneStaticPodSuite) assertControlPlaneStaticPods(manifests
 	ids := xslices.Map(resources.Items, func(r resource.Resource) string { return r.Metadata().ID() })
 
 	if !reflect.DeepEqual(manifests, ids) {
-		return retry.ExpectedError(fmt.Errorf("expected %q, got %q", manifests, ids))
+		return retry.ExpectedErrorf("expected %q, got %q", manifests, ids)
 	}
 
 	return nil
diff --git a/internal/app/machined/pkg/controllers/k8s/extra_manifest_test.go b/internal/app/machined/pkg/controllers/k8s/extra_manifest_test.go
index 72863bc6c0..ac93a3062f 100644
--- a/internal/app/machined/pkg/controllers/k8s/extra_manifest_test.go
+++ b/internal/app/machined/pkg/controllers/k8s/extra_manifest_test.go
@@ -7,7 +7,6 @@ package k8s_test
 
 import (
 	"context"
-	"fmt"
 	"log"
 	"reflect"
 	"strings"
@@ -81,7 +80,7 @@ func (suite *ExtraManifestSuite) assertExtraManifests(manifests []string) error
 	ids := xslices.Map(resources.Items, func(r resource.Resource) string { return r.Metadata().ID() })
 
 	if !reflect.DeepEqual(manifests, ids) {
-		return retry.ExpectedError(fmt.Errorf("expected %q, got %q", manifests, ids))
+		return retry.ExpectedErrorf("expected %q, got %q", manifests, ids)
 	}
 
 	return nil
diff --git a/internal/app/machined/pkg/controllers/k8s/manifest_test.go b/internal/app/machined/pkg/controllers/k8s/manifest_test.go
index 1b202d32c7..21fe5d33f0 100644
--- a/internal/app/machined/pkg/controllers/k8s/manifest_test.go
+++ b/internal/app/machined/pkg/controllers/k8s/manifest_test.go
@@ -82,7 +82,7 @@ func (suite *ManifestSuite) assertManifests(manifests []string) error {
 	ids := xslices.Map(resources.Items, func(r resource.Resource) string { return r.Metadata().ID() })
 
 	if !reflect.DeepEqual(manifests, ids) {
-		return retry.ExpectedError(fmt.Errorf("expected %q, got %q", manifests, ids))
+		return retry.ExpectedErrorf("expected %q, got %q", manifests, ids)
 	}
 
 	return nil
diff --git a/internal/app/machined/pkg/controllers/k8s/static_pod_config.go b/internal/app/machined/pkg/controllers/k8s/static_pod_config.go
index a2e8ed0ef5..1b8a219caa 100644
--- a/internal/app/machined/pkg/controllers/k8s/static_pod_config.go
+++ b/internal/app/machined/pkg/controllers/k8s/static_pod_config.go
@@ -6,6 +6,7 @@ package k8s
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
 	"github.com/cosi-project/runtime/pkg/controller"
@@ -85,7 +86,7 @@ func (ctrl *StaticPodConfigController) Run(ctx context.Context, r controller.Run
 				}
 
 				if !ok {
-					return fmt.Errorf("name is missing in static pod metadata")
+					return errors.New("name is missing in static pod metadata")
 				}
 
 				namespace, ok, err = unstructured.NestedString(pod, "metadata", "namespace")
diff --git a/internal/app/machined/pkg/controllers/kubeaccess/serviceaccount/crd_controller.go b/internal/app/machined/pkg/controllers/kubeaccess/serviceaccount/crd_controller.go
index cec2b34f51..754cc7a2e9 100644
--- a/internal/app/machined/pkg/controllers/kubeaccess/serviceaccount/crd_controller.go
+++ b/internal/app/machined/pkg/controllers/kubeaccess/serviceaccount/crd_controller.go
@@ -223,7 +223,7 @@ func (t *CRDController) Run(ctx context.Context, workers int) error {
 	t.logger.Debug("waiting for informer caches to sync")
 
 	if ok := cache.WaitForCacheSync(ctx.Done(), t.secretsSynced, t.talosSAsSynced); !ok {
-		return fmt.Errorf("failed to wait for caches to sync")
+		return errors.New("failed to wait for caches to sync")
 	}
 
 	t.logger.Debug("starting workers")
@@ -448,14 +448,14 @@ func (t *CRDController) handleSecret(obj interface{}) {
 	if object, ok = obj.(metav1.Object); !ok {
 		tombstone, tombstoneOK := obj.(cache.DeletedFinalStateUnknown)
 		if !tombstoneOK {
-			utilruntime.HandleError(fmt.Errorf("error decoding object, invalid type"))
+			utilruntime.HandleError(errors.New("error decoding object, invalid type"))
 
 			return
 		}
 
 		object, tombstoneOK = tombstone.Obj.(metav1.Object)
 		if !tombstoneOK {
-			utilruntime.HandleError(fmt.Errorf("error decoding object tombstone, invalid type"))
+			utilruntime.HandleError(errors.New("error decoding object tombstone, invalid type"))
 
 			return
 		}
diff --git a/internal/app/machined/pkg/controllers/network/address_event_test.go b/internal/app/machined/pkg/controllers/network/address_event_test.go
index f4c21c8bff..978edb6ef9 100644
--- a/internal/app/machined/pkg/controllers/network/address_event_test.go
+++ b/internal/app/machined/pkg/controllers/network/address_event_test.go
@@ -6,7 +6,7 @@ package network_test
 
 import (
 	"context"
-	"fmt"
+	"errors"
 	"log"
 	"net/netip"
 	"sync"
@@ -103,7 +103,7 @@ func (suite *AddressEventsSuite) TestReconcile() {
 				defer suite.events.messagesMu.Unlock()
 
 				if len(suite.events.messages) == 0 {
-					return retry.ExpectedError(fmt.Errorf("no events created"))
+					return retry.ExpectedErrorf("no events created")
 				}
 
 				m := suite.events.messages[len(suite.events.messages)-1]
@@ -112,11 +112,11 @@ func (suite *AddressEventsSuite) TestReconcile() {
 
 				event, ok = m.(*machine.AddressEvent)
 				if !ok {
-					return fmt.Errorf("not an endpoint event")
+					return errors.New("not an endpoint event")
 				}
 
 				if event.Hostname == "" {
-					return retry.ExpectedError(fmt.Errorf("expected hostname to be set"))
+					return retry.ExpectedErrorf("expected hostname to be set")
 				}
 
 				return nil
@@ -154,7 +154,7 @@ func (suite *AddressEventsSuite) TestReconcile() {
 				defer suite.events.messagesMu.Unlock()
 
 				if len(suite.events.messages) == 0 {
-					return retry.ExpectedError(fmt.Errorf("no events created"))
+					return retry.ExpectedErrorf("no events created")
 				}
 
 				m := suite.events.messages[len(suite.events.messages)-1]
@@ -163,11 +163,11 @@ func (suite *AddressEventsSuite) TestReconcile() {
 
 				event, ok = m.(*machine.AddressEvent)
 				if !ok {
-					return fmt.Errorf("not an address event")
+					return errors.New("not an address event")
 				}
 
 				if len(event.Addresses) == 0 {
-					return retry.ExpectedError(fmt.Errorf("expected addresses to be set"))
+					return retry.ExpectedErrorf("expected addresses to be set")
 				}
 
 				return nil
diff --git a/internal/app/machined/pkg/controllers/network/address_merge_test.go b/internal/app/machined/pkg/controllers/network/address_merge_test.go
index 97ab79e412..9ecf6bd7d2 100644
--- a/internal/app/machined/pkg/controllers/network/address_merge_test.go
+++ b/internal/app/machined/pkg/controllers/network/address_merge_test.go
@@ -7,7 +7,6 @@ package network_test
 
 import (
 	"context"
-	"fmt"
 	"log"
 	"net/netip"
 	"sync"
@@ -84,7 +83,7 @@ func (suite *AddressMergeSuite) assertNoAddress(id string) error {
 
 	for _, res := range resources.Items {
 		if res.Metadata().ID() == id {
-			return retry.ExpectedError(fmt.Errorf("address %q is still there", id))
+			return retry.ExpectedErrorf("address %q is still there", id)
 		}
 	}
 
diff --git a/internal/app/machined/pkg/controllers/network/address_spec_test.go b/internal/app/machined/pkg/controllers/network/address_spec_test.go
index 5d5b3cb5c4..aa5af66050 100644
--- a/internal/app/machined/pkg/controllers/network/address_spec_test.go
+++ b/internal/app/machined/pkg/controllers/network/address_spec_test.go
@@ -104,7 +104,7 @@ func (suite *AddressSpecSuite) assertLinkAddress(linkName, address string) error
 		return nil
 	}
 
-	return retry.ExpectedError(fmt.Errorf("address %s not found on %q", addr, linkName))
+	return retry.ExpectedErrorf("address %s not found on %q", addr, linkName)
 }
 
 func (suite *AddressSpecSuite) assertNoLinkAddress(linkName, address string) error {
@@ -123,7 +123,7 @@ func (suite *AddressSpecSuite) assertNoLinkAddress(linkName, address string) err
 
 	for _, linkAddress := range linkAddresses {
 		if linkAddress.Index == uint32(iface.Index) && int(linkAddress.PrefixLength) == addr.Bits() && linkAddress.Attributes.Address.Equal(addr.Addr().AsSlice()) {
-			return retry.ExpectedError(fmt.Errorf("address %s is assigned to %q", addr, linkName))
+			return retry.ExpectedErrorf("address %s is assigned to %q", addr, linkName)
 		}
 	}
 
diff --git a/internal/app/machined/pkg/controllers/network/hardware_addr_test.go b/internal/app/machined/pkg/controllers/network/hardware_addr_test.go
index 70521479ff..e4623152bf 100644
--- a/internal/app/machined/pkg/controllers/network/hardware_addr_test.go
+++ b/internal/app/machined/pkg/controllers/network/hardware_addr_test.go
@@ -7,7 +7,6 @@ package network_test
 
 import (
 	"context"
-	"fmt"
 	"log"
 	"net"
 	"sync"
@@ -81,7 +80,7 @@ func (suite *HardwareAddrSuite) assertNoHWAddr(id string) error {
 
 	for _, res := range resources.Items {
 		if res.Metadata().ID() == id {
-			return retry.ExpectedError(fmt.Errorf("interface %q is still there", id))
+			return retry.ExpectedErrorf("interface %q is still there", id)
 		}
 	}
 
diff --git a/internal/app/machined/pkg/controllers/network/hostname_config_test.go b/internal/app/machined/pkg/controllers/network/hostname_config_test.go
index 93e6f2c8ca..4abbbb6209 100644
--- a/internal/app/machined/pkg/controllers/network/hostname_config_test.go
+++ b/internal/app/machined/pkg/controllers/network/hostname_config_test.go
@@ -6,7 +6,6 @@ package network_test
 
 import (
 	"context"
-	"fmt"
 	"log"
 	"net/netip"
 	"net/url"
@@ -89,7 +88,7 @@ func (suite *HostnameConfigSuite) assertNoHostname(id string) error {
 
 	for _, res := range resources.Items {
 		if res.Metadata().ID() == id {
-			return retry.ExpectedError(fmt.Errorf("spec %q is still there", id))
+			return retry.ExpectedErrorf("spec %q is still there", id)
 		}
 	}
 
diff --git a/internal/app/machined/pkg/controllers/network/internal/probe/probe.go b/internal/app/machined/pkg/controllers/network/internal/probe/probe.go
index a76175364c..406313f02c 100644
--- a/internal/app/machined/pkg/controllers/network/internal/probe/probe.go
+++ b/internal/app/machined/pkg/controllers/network/internal/probe/probe.go
@@ -7,7 +7,7 @@ package probe
 
 import (
 	"context"
-	"fmt"
+	"errors"
 	"net"
 	"sync"
 	"syscall"
@@ -132,7 +132,7 @@ func (runner *Runner) probe(ctx context.Context) error {
 	case runner.Spec.TCP != zeroTCP:
 		return runner.probeTCP(ctx)
 	default:
-		return fmt.Errorf("no probe type specified")
+		return errors.New("no probe type specified")
 	}
 }
 
diff --git a/internal/app/machined/pkg/controllers/network/link_merge_test.go b/internal/app/machined/pkg/controllers/network/link_merge_test.go
index 3ad89577c0..46e52ebbee 100644
--- a/internal/app/machined/pkg/controllers/network/link_merge_test.go
+++ b/internal/app/machined/pkg/controllers/network/link_merge_test.go
@@ -7,7 +7,6 @@ package network_test
 
 import (
 	"context"
-	"fmt"
 	"log"
 	"sync"
 	"testing"
@@ -81,7 +80,7 @@ func (suite *LinkMergeSuite) assertNoLinks(id string) error {
 
 	for _, res := range resources.Items {
 		if res.Metadata().ID() == id {
-			return retry.ExpectedError(fmt.Errorf("link %q is still there", id))
+			return retry.ExpectedErrorf("link %q is still there", id)
 		}
 	}
 
diff --git a/internal/app/machined/pkg/controllers/network/link_spec.go b/internal/app/machined/pkg/controllers/network/link_spec.go
index c8e515012f..52f88c651f 100644
--- a/internal/app/machined/pkg/controllers/network/link_spec.go
+++ b/internal/app/machined/pkg/controllers/network/link_spec.go
@@ -6,6 +6,7 @@ package network
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"sort"
 
@@ -516,7 +517,7 @@ func (ctrl *LinkSpecController) syncLink(ctx context.Context, r controller.Runti
 
 					return nil
 				}); err != nil {
-					return fmt.Errorf("error bumping link refresh")
+					return errors.New("error bumping link refresh")
 				}
 			}
 		}
diff --git a/internal/app/machined/pkg/controllers/network/link_spec_test.go b/internal/app/machined/pkg/controllers/network/link_spec_test.go
index 89c0b60c5c..91f3ff175b 100644
--- a/internal/app/machined/pkg/controllers/network/link_spec_test.go
+++ b/internal/app/machined/pkg/controllers/network/link_spec_test.go
@@ -114,7 +114,7 @@ func (suite *LinkSpecSuite) assertInterfaces(requiredIDs []string, check func(*n
 	}
 
 	if len(missingIDs) > 0 {
-		return retry.ExpectedError(fmt.Errorf("some resources are missing: %q", missingIDs))
+		return retry.ExpectedErrorf("some resources are missing: %q", missingIDs)
 	}
 
 	return nil
@@ -131,7 +131,7 @@ func (suite *LinkSpecSuite) assertNoInterface(id string) error {
 
 	for _, res := range resources.Items {
 		if res.Metadata().ID() == id {
-			return retry.ExpectedError(fmt.Errorf("interface %q is still there", id))
+			return retry.ExpectedErrorf("interface %q is still there", id)
 		}
 	}
 
diff --git a/internal/app/machined/pkg/controllers/network/link_status_test.go b/internal/app/machined/pkg/controllers/network/link_status_test.go
index 9c5a44072f..56204a9026 100644
--- a/internal/app/machined/pkg/controllers/network/link_status_test.go
+++ b/internal/app/machined/pkg/controllers/network/link_status_test.go
@@ -111,7 +111,7 @@ func (suite *LinkStatusSuite) assertInterfaces(requiredIDs []string, check func(
 	}
 
 	if len(missingIDs) > 0 {
-		return retry.ExpectedError(fmt.Errorf("some resources are missing: %q", missingIDs))
+		return retry.ExpectedErrorf("some resources are missing: %q", missingIDs)
 	}
 
 	return nil
@@ -128,7 +128,7 @@ func (suite *LinkStatusSuite) assertNoInterface(id string) error {
 
 	for _, res := range resources.Items {
 		if res.Metadata().ID() == id {
-			return retry.ExpectedError(fmt.Errorf("interface %q is still there", id))
+			return retry.ExpectedErrorf("interface %q is still there", id)
 		}
 	}
 
@@ -136,7 +136,7 @@ func (suite *LinkStatusSuite) assertNoInterface(id string) error {
 }
 
 func (suite *LinkStatusSuite) TestInterfaceHwInfo() {
-	errNoInterfaces := fmt.Errorf("no suitable interfaces found")
+	errNoInterfaces := errors.New("no suitable interfaces found")
 
 	err := retry.Constant(5*time.Second, retry.WithUnits(100*time.Millisecond)).Retry(
 		func() error {
@@ -271,11 +271,9 @@ func (suite *LinkStatusSuite) TestDummyInterface() {
 				return suite.assertInterfaces(
 					[]string{dummyInterface}, func(r *network.LinkStatus) error {
 						if r.TypedSpec().OperationalState != nethelpers.OperStateUp && r.TypedSpec().OperationalState != nethelpers.OperStateUnknown {
-							return retry.ExpectedError(
-								fmt.Errorf(
-									"operational state is not up: %s",
-									r.TypedSpec().OperationalState,
-								),
+							return retry.ExpectedErrorf(
+								"operational state is not up: %s",
+								r.TypedSpec().OperationalState,
 							)
 						}
 
diff --git a/internal/app/machined/pkg/controllers/network/operator/vip.go b/internal/app/machined/pkg/controllers/network/operator/vip.go
index 6dfc0e3f84..61381fa223 100644
--- a/internal/app/machined/pkg/controllers/network/operator/vip.go
+++ b/internal/app/machined/pkg/controllers/network/operator/vip.go
@@ -208,7 +208,7 @@ func (vip *VIP) campaign(ctx context.Context, notifyCh chan<- struct{}) error {
 
 	hostname, err := os.Hostname() // TODO: this should be etcd nodename
 	if err != nil {
-		return fmt.Errorf("refusing to join election without a hostname")
+		return errors.New("refusing to join election without a hostname")
 	}
 
 	ec, err := etcd.NewLocalClient(ctx)
diff --git a/internal/app/machined/pkg/controllers/network/operator_merge_test.go b/internal/app/machined/pkg/controllers/network/operator_merge_test.go
index 6819070f41..0d5c486095 100644
--- a/internal/app/machined/pkg/controllers/network/operator_merge_test.go
+++ b/internal/app/machined/pkg/controllers/network/operator_merge_test.go
@@ -7,7 +7,6 @@ package network_test
 
 import (
 	"context"
-	"fmt"
 	"log"
 	"sync"
 	"testing"
@@ -93,7 +92,7 @@ func (suite *OperatorMergeSuite) assertOperators(requiredIDs []string, check fun
 	}
 
 	if len(missingIDs) > 0 {
-		return retry.ExpectedError(fmt.Errorf("some resources are missing: %q", missingIDs))
+		return retry.ExpectedErrorf("some resources are missing: %q", missingIDs)
 	}
 
 	return nil
@@ -110,7 +109,7 @@ func (suite *OperatorMergeSuite) assertNoOperator(id string) error {
 
 	for _, res := range resources.Items {
 		if res.Metadata().ID() == id {
-			return retry.ExpectedError(fmt.Errorf("operator %q is still there", id))
+			return retry.ExpectedErrorf("operator %q is still there", id)
 		}
 	}
 
@@ -293,7 +292,7 @@ func (suite *OperatorMergeSuite) TestMergeFlapping() {
 
 						if *override.TypedSpec() != *r.TypedSpec() {
 							// using retry here, as it might not be reconciled immediately
-							return retry.ExpectedError(fmt.Errorf("not equal yet"))
+							return retry.ExpectedErrorf("not equal yet")
 						}
 
 						return nil
diff --git a/internal/app/machined/pkg/controllers/network/operator_spec_test.go b/internal/app/machined/pkg/controllers/network/operator_spec_test.go
index 550a80d768..dc250f990f 100644
--- a/internal/app/machined/pkg/controllers/network/operator_spec_test.go
+++ b/internal/app/machined/pkg/controllers/network/operator_spec_test.go
@@ -236,7 +236,7 @@ func (suite *OperatorSpecSuite) assertResources(resourceType resource.Type, requ
 	}
 
 	if len(missingIDs) > 0 {
-		return retry.ExpectedError(fmt.Errorf("some resources are missing: %q", missingIDs))
+		return retry.ExpectedErrorf("some resources are missing: %q", missingIDs)
 	}
 
 	return nil
diff --git a/internal/app/machined/pkg/controllers/network/platform_config_test.go b/internal/app/machined/pkg/controllers/network/platform_config_test.go
index a172d87dce..f07fdf7d16 100644
--- a/internal/app/machined/pkg/controllers/network/platform_config_test.go
+++ b/internal/app/machined/pkg/controllers/network/platform_config_test.go
@@ -103,7 +103,7 @@ func (suite *PlatformConfigSuite) assertResources(
 	}
 
 	if len(missingIDs) > 0 {
-		return retry.ExpectedError(fmt.Errorf("some resources are missing: %q", missingIDs))
+		return retry.ExpectedErrorf("some resources are missing: %q", missingIDs)
 	}
 
 	return nil
@@ -120,7 +120,7 @@ func (suite *PlatformConfigSuite) assertNoResource(resourceType resource.Type, i
 
 	for _, res := range resources.Items {
 		if res.Metadata().ID() == id {
-			return retry.ExpectedError(fmt.Errorf("spec %q is still there", id))
+			return retry.ExpectedErrorf("spec %q is still there", id)
 		}
 	}
 
diff --git a/internal/app/machined/pkg/controllers/network/resolver_config_test.go b/internal/app/machined/pkg/controllers/network/resolver_config_test.go
index 7740abd399..c963c203af 100644
--- a/internal/app/machined/pkg/controllers/network/resolver_config_test.go
+++ b/internal/app/machined/pkg/controllers/network/resolver_config_test.go
@@ -6,7 +6,6 @@ package network_test
 
 import (
 	"context"
-	"fmt"
 	"log"
 	"net/netip"
 	"net/url"
@@ -87,7 +86,7 @@ func (suite *ResolverConfigSuite) assertNoResolver(id string) error {
 
 	for _, res := range resources.Items {
 		if res.Metadata().ID() == id {
-			return retry.ExpectedError(fmt.Errorf("spec %q is still there", id))
+			return retry.ExpectedErrorf("spec %q is still there", id)
 		}
 	}
 
diff --git a/internal/app/machined/pkg/controllers/network/route_merge_test.go b/internal/app/machined/pkg/controllers/network/route_merge_test.go
index f1697b9537..cca5fb8769 100644
--- a/internal/app/machined/pkg/controllers/network/route_merge_test.go
+++ b/internal/app/machined/pkg/controllers/network/route_merge_test.go
@@ -7,7 +7,6 @@ package network_test
 
 import (
 	"context"
-	"fmt"
 	"log"
 	"net/netip"
 	"sync"
@@ -95,7 +94,7 @@ func (suite *RouteMergeSuite) assertRoutes(requiredIDs []string, check func(*net
 	}
 
 	if len(missingIDs) > 0 {
-		return retry.ExpectedError(fmt.Errorf("some resources are missing: %q", missingIDs))
+		return retry.ExpectedErrorf("some resources are missing: %q", missingIDs)
 	}
 
 	return nil
@@ -112,7 +111,7 @@ func (suite *RouteMergeSuite) assertNoRoute(id string) error {
 
 	for _, res := range resources.Items {
 		if res.Metadata().ID() == id {
-			return retry.ExpectedError(fmt.Errorf("address %q is still there", id))
+			return retry.ExpectedErrorf("address %q is still there", id)
 		}
 	}
 
@@ -201,7 +200,7 @@ func (suite *RouteMergeSuite) TestMerge() {
 						case "inet4/10.5.0.3//50":
 							if *cmdline.TypedSpec() != *r.TypedSpec() {
 								// using retry here, as it might not be reconciled immediately
-								return retry.ExpectedError(fmt.Errorf("not equal yet"))
+								return retry.ExpectedErrorf("not equal yet")
 							}
 						case "inet4/10.0.0.34/10.0.0.35/32/1024":
 							suite.Assert().Equal(*static.TypedSpec(), *r.TypedSpec())
@@ -336,7 +335,7 @@ func (suite *RouteMergeSuite) TestMergeFlapping() {
 
 						if *dhcp.TypedSpec() != *r.TypedSpec() {
 							// using retry here, as it might not be reconciled immediately
-							return retry.ExpectedError(fmt.Errorf("not equal yet"))
+							return retry.ExpectedErrorf("not equal yet")
 						}
 
 						return nil
diff --git a/internal/app/machined/pkg/controllers/network/route_spec_test.go b/internal/app/machined/pkg/controllers/network/route_spec_test.go
index a18ba498cf..687ee69cc1 100644
--- a/internal/app/machined/pkg/controllers/network/route_spec_test.go
+++ b/internal/app/machined/pkg/controllers/network/route_spec_test.go
@@ -119,9 +119,9 @@ func (suite *RouteSpecSuite) assertRoute(
 	case matching == 1:
 		return nil
 	case matching == 0:
-		return retry.ExpectedError(fmt.Errorf("route to %s via %s not found", destination, gateway))
+		return retry.ExpectedErrorf("route to %s via %s not found", destination, gateway)
 	default:
-		return retry.ExpectedError(fmt.Errorf("route to %s via %s found %d matches", destination, gateway, matching))
+		return retry.ExpectedErrorf("route to %s via %s found %d matches", destination, gateway, matching)
 	}
 }
 
@@ -138,7 +138,7 @@ func (suite *RouteSpecSuite) assertNoRoute(destination netip.Prefix, gateway net
 		if route.Attributes.Gateway.Equal(gateway.AsSlice()) &&
 			(destination.Bits() == int(route.DstLength) || (destination.Bits() == -1 && route.DstLength == 0)) &&
 			route.Attributes.Dst.Equal(destination.Addr().AsSlice()) {
-			return retry.ExpectedError(fmt.Errorf("route to %s via %s is present", destination, gateway))
+			return retry.ExpectedErrorf("route to %s via %s is present", destination, gateway)
 		}
 	}
 
diff --git a/internal/app/machined/pkg/controllers/network/timeserver_config_test.go b/internal/app/machined/pkg/controllers/network/timeserver_config_test.go
index 8c750db158..6f0abe1699 100644
--- a/internal/app/machined/pkg/controllers/network/timeserver_config_test.go
+++ b/internal/app/machined/pkg/controllers/network/timeserver_config_test.go
@@ -6,7 +6,6 @@ package network_test
 
 import (
 	"context"
-	"fmt"
 	"log"
 	"net/url"
 	"sync"
@@ -89,7 +88,7 @@ func (suite *TimeServerConfigSuite) assertNoTimeServer(id string) error {
 
 	for _, res := range resources.Items {
 		if res.Metadata().ID() == id {
-			return retry.ExpectedError(fmt.Errorf("spec %q is still there", id))
+			return retry.ExpectedErrorf("spec %q is still there", id)
 		}
 	}
 
diff --git a/internal/app/machined/pkg/controllers/network/watch/ethtool.go b/internal/app/machined/pkg/controllers/network/watch/ethtool.go
index 713442717c..eb2d79dfa4 100644
--- a/internal/app/machined/pkg/controllers/network/watch/ethtool.go
+++ b/internal/app/machined/pkg/controllers/network/watch/ethtool.go
@@ -5,6 +5,7 @@
 package watch
 
 import (
+	"errors"
 	"fmt"
 	"sync"
 
@@ -44,7 +45,7 @@ func NewEthtool(trigger Trigger) (Watcher, error) {
 	}
 
 	if monitorID == 0 {
-		return nil, fmt.Errorf("could not find monitor multicast group ID for ethtool")
+		return nil, errors.New("could not find monitor multicast group ID for ethtool")
 	}
 
 	if err = watcher.conn.JoinGroup(monitorID); err != nil {
diff --git a/internal/app/machined/pkg/controllers/perf/perf_test.go b/internal/app/machined/pkg/controllers/perf/perf_test.go
index 8cd5cb8c0c..849dbea95a 100644
--- a/internal/app/machined/pkg/controllers/perf/perf_test.go
+++ b/internal/app/machined/pkg/controllers/perf/perf_test.go
@@ -6,7 +6,6 @@ package perf_test
 
 import (
 	"context"
-	"fmt"
 	"log"
 	"sync"
 	"testing"
@@ -107,7 +106,7 @@ func (suite *PerfSuite) TestReconcile() {
 				memSpec := mem.(*perfresource.Memory).TypedSpec()
 
 				if len(cpuSpec.CPU) == 0 || memSpec.MemTotal == 0 {
-					return retry.ExpectedError(fmt.Errorf("cpu spec does not contain any CPU or Total memory is zero"))
+					return retry.ExpectedErrorf("cpu spec does not contain any CPU or Total memory is zero")
 				}
 
 				return nil
diff --git a/internal/app/machined/pkg/controllers/runtime/common_test.go b/internal/app/machined/pkg/controllers/runtime/common_test.go
index 8fd46ce2fa..faad27d456 100644
--- a/internal/app/machined/pkg/controllers/runtime/common_test.go
+++ b/internal/app/machined/pkg/controllers/runtime/common_test.go
@@ -6,7 +6,7 @@ package runtime_test
 
 import (
 	"context"
-	"fmt"
+	"errors"
 	"log"
 	"sync"
 	"time"
@@ -75,7 +75,7 @@ func (suite *RuntimeSuite) assertResource(md resource.Metadata, compare func(res
 		}
 
 		if !compare(r) {
-			return fmt.Errorf("resource is not equal to the expected one")
+			return errors.New("resource is not equal to the expected one")
 		}
 
 		return nil
diff --git a/internal/app/machined/pkg/controllers/runtime/kernel_module_config_test.go b/internal/app/machined/pkg/controllers/runtime/kernel_module_config_test.go
index 1b4d83ba39..93590b41ff 100644
--- a/internal/app/machined/pkg/controllers/runtime/kernel_module_config_test.go
+++ b/internal/app/machined/pkg/controllers/runtime/kernel_module_config_test.go
@@ -4,7 +4,6 @@
 package runtime_test
 
 import (
-	"fmt"
 	"testing"
 	"time"
 
@@ -95,7 +94,7 @@ func (suite *KernelModuleConfigSuite) TestReconcileConfig() {
 				}
 			}
 
-			return retry.ExpectedError(fmt.Errorf("resource still exists"))
+			return retry.ExpectedErrorf("resource still exists")
 		},
 	))
 }
diff --git a/internal/app/machined/pkg/controllers/runtime/kernel_param_config_test.go b/internal/app/machined/pkg/controllers/runtime/kernel_param_config_test.go
index 99c2f4d3fb..0d0b780d88 100644
--- a/internal/app/machined/pkg/controllers/runtime/kernel_param_config_test.go
+++ b/internal/app/machined/pkg/controllers/runtime/kernel_param_config_test.go
@@ -4,7 +4,6 @@
 package runtime_test
 
 import (
-	"fmt"
 	"testing"
 	"time"
 
@@ -112,7 +111,7 @@ func (suite *KernelParamConfigSuite) TestReconcileConfig() {
 				}
 			}
 
-			return retry.ExpectedError(fmt.Errorf("resource still exists"))
+			return retry.ExpectedErrorf("resource still exists")
 		},
 	))
 }
diff --git a/internal/app/machined/pkg/controllers/runtime/kernel_param_spec_test.go b/internal/app/machined/pkg/controllers/runtime/kernel_param_spec_test.go
index 7fa23fde6b..a1d7a5548c 100644
--- a/internal/app/machined/pkg/controllers/runtime/kernel_param_spec_test.go
+++ b/internal/app/machined/pkg/controllers/runtime/kernel_param_spec_test.go
@@ -5,7 +5,6 @@
 package runtime_test
 
 import (
-	"fmt"
 	"os"
 	"strings"
 	"testing"
@@ -74,7 +73,7 @@ func (suite *KernelParamSpecSuite) TestParamsSynced() {
 				}
 			}
 
-			return retry.ExpectedError(fmt.Errorf("resource still exists"))
+			return retry.ExpectedErrorf("resource still exists")
 		},
 	))
 
diff --git a/internal/app/machined/pkg/controllers/runtime/kmsg_log.go b/internal/app/machined/pkg/controllers/runtime/kmsg_log.go
index 6c386bda9f..4eb35a0c7e 100644
--- a/internal/app/machined/pkg/controllers/runtime/kmsg_log.go
+++ b/internal/app/machined/pkg/controllers/runtime/kmsg_log.go
@@ -233,7 +233,7 @@ func (ctrl *KmsgLogDeliveryController) resend(ctx context.Context, r controller.
 			return nil
 		case <-r.EventCh():
 			// config changed, restart the loop
-			return fmt.Errorf("config changed")
+			return errors.New("config changed")
 		case <-time.After(logRetryTimeout):
 		}
 	}
diff --git a/internal/app/machined/pkg/controllers/runtime/machine_status.go b/internal/app/machined/pkg/controllers/runtime/machine_status.go
index 19596d36bc..2dfb3fca77 100644
--- a/internal/app/machined/pkg/controllers/runtime/machine_status.go
+++ b/internal/app/machined/pkg/controllers/runtime/machine_status.go
@@ -6,6 +6,7 @@ package runtime
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"strings"
 	"sync"
@@ -229,7 +230,7 @@ func (ctrl *MachineStatusController) timeSyncCheck(ctx context.Context, r contro
 	}
 
 	if !timeSyncStatus.TypedSpec().Synced {
-		return fmt.Errorf("time is not synced")
+		return errors.New("time is not synced")
 	}
 
 	return nil
diff --git a/internal/app/machined/pkg/controllers/runtime/security_state.go b/internal/app/machined/pkg/controllers/runtime/security_state.go
index b84541a76e..4e1c3048a4 100644
--- a/internal/app/machined/pkg/controllers/runtime/security_state.go
+++ b/internal/app/machined/pkg/controllers/runtime/security_state.go
@@ -11,6 +11,7 @@ import (
 	"crypto/x509"
 	"encoding/hex"
 	"encoding/pem"
+	"errors"
 	"fmt"
 	"os"
 	"strings"
@@ -93,7 +94,7 @@ func (ctrl *SecurityStateController) Run(ctx context.Context, r controller.Runti
 			if pcrPublicKeyData, err := os.ReadFile(constants.PCRPublicKey); err == nil {
 				block, _ := pem.Decode(pcrPublicKeyData)
 				if block == nil {
-					return fmt.Errorf("failed to decode PEM block for PCR public key")
+					return errors.New("failed to decode PEM block for PCR public key")
 				}
 
 				cert := x509.Certificate{
diff --git a/internal/app/machined/pkg/controllers/secrets/api.go b/internal/app/machined/pkg/controllers/secrets/api.go
index ea515baaa0..3a9dc3e9e6 100644
--- a/internal/app/machined/pkg/controllers/secrets/api.go
+++ b/internal/app/machined/pkg/controllers/secrets/api.go
@@ -7,6 +7,7 @@ package secrets
 import (
 	"context"
 	stdlibx509 "crypto/x509"
+	"errors"
 	"fmt"
 	"time"
 
@@ -202,14 +203,14 @@ func (ctrl *APIController) reconcile(ctx context.Context, r controller.Runtime,
 		switch machineType {
 		case machine.TypeInit, machine.TypeControlPlane:
 			if !isControlplane {
-				return fmt.Errorf("machine type changed")
+				return errors.New("machine type changed")
 			}
 		case machine.TypeWorker:
 			if isControlplane {
-				return fmt.Errorf("machine type changed")
+				return errors.New("machine type changed")
 			}
 		case machine.TypeUnknown:
-			return fmt.Errorf("machine type changed")
+			return errors.New("machine type changed")
 		default:
 			panic(fmt.Sprintf("unexpected machine type %v", machineType))
 		}
diff --git a/internal/app/machined/pkg/controllers/secrets/kubelet.go b/internal/app/machined/pkg/controllers/secrets/kubelet.go
index 9ed48a74d8..fb06e4c100 100644
--- a/internal/app/machined/pkg/controllers/secrets/kubelet.go
+++ b/internal/app/machined/pkg/controllers/secrets/kubelet.go
@@ -6,6 +6,7 @@ package secrets
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net/url"
 
@@ -66,7 +67,7 @@ func NewKubeletController() *KubeletController {
 				kubeletSecrets.CA = cfgProvider.Cluster().CA()
 
 				if kubeletSecrets.CA == nil {
-					return fmt.Errorf("missing cluster.CA secret")
+					return errors.New("missing cluster.CA secret")
 				}
 
 				kubeletSecrets.BootstrapTokenID = cfgProvider.Cluster().Token().ID()
diff --git a/internal/app/machined/pkg/controllers/secrets/root.go b/internal/app/machined/pkg/controllers/secrets/root.go
index b848d94fea..879e55e264 100644
--- a/internal/app/machined/pkg/controllers/secrets/root.go
+++ b/internal/app/machined/pkg/controllers/secrets/root.go
@@ -6,6 +6,7 @@ package secrets
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net/netip"
 	"net/url"
@@ -55,7 +56,7 @@ func NewRootEtcdController() *RootEtcdController {
 				etcdSecrets.EtcdCA = cfgProvider.Cluster().Etcd().CA()
 
 				if etcdSecrets.EtcdCA == nil {
-					return fmt.Errorf("missing cluster.etcdCA secret")
+					return errors.New("missing cluster.etcdCA secret")
 				}
 
 				return nil
@@ -108,13 +109,13 @@ func NewRootKubernetesController() *RootKubernetesController {
 				k8sSecrets.AggregatorCA = cfgProvider.Cluster().AggregatorCA()
 
 				if k8sSecrets.AggregatorCA == nil {
-					return fmt.Errorf("missing cluster.aggregatorCA secret")
+					return errors.New("missing cluster.aggregatorCA secret")
 				}
 
 				k8sSecrets.CA = cfgProvider.Cluster().CA()
 
 				if k8sSecrets.CA == nil {
-					return fmt.Errorf("missing cluster.CA secret")
+					return errors.New("missing cluster.CA secret")
 				}
 
 				k8sSecrets.ServiceAccount = cfgProvider.Cluster().ServiceAccount()
diff --git a/internal/app/machined/pkg/controllers/secrets/trustd.go b/internal/app/machined/pkg/controllers/secrets/trustd.go
index 5cb5426041..0bca826ddd 100644
--- a/internal/app/machined/pkg/controllers/secrets/trustd.go
+++ b/internal/app/machined/pkg/controllers/secrets/trustd.go
@@ -7,6 +7,7 @@ package secrets
 import (
 	"context"
 	stdlibx509 "crypto/x509"
+	"errors"
 	"fmt"
 	"time"
 
@@ -179,7 +180,7 @@ func (ctrl *TrustdController) reconcile(ctx context.Context, r controller.Runtim
 		machineType := machineTypeRes.MachineType()
 
 		if !machineType.IsControlPlane() {
-			return fmt.Errorf("machine type changed")
+			return errors.New("machine type changed")
 		}
 
 		rootResource, err := safe.ReaderGet[*secrets.OSRoot](ctx, r, resource.NewMetadata(secrets.NamespaceName, secrets.OSRootType, secrets.OSRootID, resource.VersionUndefined))
diff --git a/internal/app/machined/pkg/controllers/siderolink/manager_test.go b/internal/app/machined/pkg/controllers/siderolink/manager_test.go
index e127a00e3c..2d63f3865b 100644
--- a/internal/app/machined/pkg/controllers/siderolink/manager_test.go
+++ b/internal/app/machined/pkg/controllers/siderolink/manager_test.go
@@ -159,14 +159,14 @@ func (suite *ManagerSuite) TestReconcile() {
 	suite.AssertWithin(10*time.Second, 100*time.Millisecond, func() error {
 		_, err := ctest.Get[*network.LinkSpec](suite, linkSpec.Metadata())
 		if err == nil {
-			return retry.ExpectedError(fmt.Errorf("link resource still exists"))
+			return retry.ExpectedErrorf("link resource still exists")
 		}
 
 		suite.Assert().Truef(state.IsNotFoundError(err), "unexpected error: %v", err)
 
 		_, err = ctest.Get[*network.AddressSpec](suite, addressSpec.Metadata())
 		if err == nil {
-			return retry.ExpectedError(fmt.Errorf("address resource still exists"))
+			return retry.ExpectedErrorf("address resource still exists")
 		}
 
 		suite.Assert().Truef(state.IsNotFoundError(err), "unexpected error: %v", err)
diff --git a/internal/app/machined/pkg/controllers/time/sync_test.go b/internal/app/machined/pkg/controllers/time/sync_test.go
index c72e36efe3..39ffd57f6e 100644
--- a/internal/app/machined/pkg/controllers/time/sync_test.go
+++ b/internal/app/machined/pkg/controllers/time/sync_test.go
@@ -6,7 +6,6 @@ package time_test
 
 import (
 	"context"
-	"fmt"
 	"log"
 	"reflect"
 	"slices"
@@ -100,7 +99,7 @@ func (suite *SyncSuite) assertTimeStatus(spec timeresource.StatusSpec) error {
 	status := r.(*timeresource.Status) //nolint:errcheck,forcetypeassert
 
 	if *status.TypedSpec() != spec {
-		return retry.ExpectedError(fmt.Errorf("time status doesn't match: %v != %v", *status.TypedSpec(), spec))
+		return retry.ExpectedErrorf("time status doesn't match: %v != %v", *status.TypedSpec(), spec)
 	}
 
 	return nil
@@ -291,7 +290,7 @@ func (suite *SyncSuite) TestReconcileSyncChangeConfig() {
 				mockSyncer = suite.getMockSyncer()
 
 				if mockSyncer == nil {
-					return retry.ExpectedError(fmt.Errorf("syncer not created yet"))
+					return retry.ExpectedErrorf("syncer not created yet")
 				}
 
 				return nil
@@ -341,7 +340,7 @@ func (suite *SyncSuite) TestReconcileSyncChangeConfig() {
 		retry.Constant(10*time.Second, retry.WithUnits(100*time.Millisecond)).Retry(
 			func() error {
 				if !reflect.DeepEqual(mockSyncer.getTimeServers(), []string{"127.0.0.1"}) {
-					return retry.ExpectedError(fmt.Errorf("time servers not updated yet"))
+					return retry.ExpectedErrorf("time servers not updated yet")
 				}
 
 				return nil
diff --git a/internal/app/machined/pkg/controllers/utils.go b/internal/app/machined/pkg/controllers/utils.go
index a913a07fc0..a511e4e48b 100644
--- a/internal/app/machined/pkg/controllers/utils.go
+++ b/internal/app/machined/pkg/controllers/utils.go
@@ -6,6 +6,7 @@
 package controllers
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"reflect"
@@ -53,7 +54,7 @@ func LoadOrNewFromFile(path string, empty interface{}, generate func(interface{}
 	}
 
 	if reflect.ValueOf(empty).Elem().IsZero() {
-		return fmt.Errorf("value is still zero after unmarshaling")
+		return errors.New("value is still zero after unmarshaling")
 	}
 
 	return f.Close()
diff --git a/internal/app/machined/pkg/runtime/drainer.go b/internal/app/machined/pkg/runtime/drainer.go
index 3d1c818e9c..c9d79f4e05 100644
--- a/internal/app/machined/pkg/runtime/drainer.go
+++ b/internal/app/machined/pkg/runtime/drainer.go
@@ -6,7 +6,7 @@ package runtime
 
 import (
 	"context"
-	"fmt"
+	"errors"
 	"sync"
 )
 
@@ -32,7 +32,7 @@ func (d *Drainer) Drain(ctx context.Context) error {
 	if d.draining {
 		d.subscriptionsMu.Unlock()
 
-		return fmt.Errorf("already draining")
+		return errors.New("already draining")
 	}
 
 	d.draining = true
diff --git a/internal/app/machined/pkg/runtime/events.go b/internal/app/machined/pkg/runtime/events.go
index 2c737de62a..969fcd7df8 100644
--- a/internal/app/machined/pkg/runtime/events.go
+++ b/internal/app/machined/pkg/runtime/events.go
@@ -6,6 +6,7 @@ package runtime
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"time"
 
@@ -61,7 +62,7 @@ type WatchOptionFunc func(opts *WatchOptions) error
 func WithTailEvents(number int) WatchOptionFunc {
 	return func(opts *WatchOptions) error {
 		if !opts.TailID.IsNil() || opts.TailDuration != 0 {
-			return fmt.Errorf("WithTailEvents can't be specified at the same time with WithTailID or WithTailDuration")
+			return errors.New("WithTailEvents can't be specified at the same time with WithTailID or WithTailDuration")
 		}
 
 		opts.TailEvents = number
@@ -74,7 +75,7 @@ func WithTailEvents(number int) WatchOptionFunc {
 func WithTailID(id xid.ID) WatchOptionFunc {
 	return func(opts *WatchOptions) error {
 		if opts.TailEvents != 0 || opts.TailDuration != 0 {
-			return fmt.Errorf("WithTailID can't be specified at the same time with WithTailEvents or WithTailDuration")
+			return errors.New("WithTailID can't be specified at the same time with WithTailEvents or WithTailDuration")
 		}
 
 		opts.TailID = id
@@ -87,7 +88,7 @@ func WithTailID(id xid.ID) WatchOptionFunc {
 func WithTailDuration(dur time.Duration) WatchOptionFunc {
 	return func(opts *WatchOptions) error {
 		if opts.TailEvents != 0 || !opts.TailID.IsNil() {
-			return fmt.Errorf("WithTailDuration can't be specified at the same time with WithTailEvents or WithTailID")
+			return errors.New("WithTailDuration can't be specified at the same time with WithTailEvents or WithTailID")
 		}
 
 		opts.TailDuration = dur
diff --git a/internal/app/machined/pkg/runtime/logging.go b/internal/app/machined/pkg/runtime/logging.go
index 40b0d8b3b8..6160056c03 100644
--- a/internal/app/machined/pkg/runtime/logging.go
+++ b/internal/app/machined/pkg/runtime/logging.go
@@ -6,7 +6,7 @@ package runtime
 
 import (
 	"context"
-	"fmt"
+	"errors"
 	"io"
 	"time"
 
@@ -67,7 +67,7 @@ type LogEvent struct {
 }
 
 // ErrDontRetry indicates that log event should not be resent.
-var ErrDontRetry = fmt.Errorf("don't retry")
+var ErrDontRetry = errors.New("don't retry")
 
 // LogSender provides common interface for log senders.
 type LogSender interface {
diff --git a/internal/app/machined/pkg/runtime/logging/file.go b/internal/app/machined/pkg/runtime/logging/file.go
index 8f12bd1c4c..71d3d8fba4 100644
--- a/internal/app/machined/pkg/runtime/logging/file.go
+++ b/internal/app/machined/pkg/runtime/logging/file.go
@@ -6,6 +6,7 @@ package logging
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -52,7 +53,7 @@ type fileLogHandler struct {
 
 func (handler *fileLogHandler) buildPath() error {
 	if strings.ContainsAny(handler.id, string(os.PathSeparator)+".") {
-		return fmt.Errorf("service ID is invalid")
+		return errors.New("service ID is invalid")
 	}
 
 	handler.path = filepath.Join(handler.logDirectory, handler.id+".log")
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/decode.go b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/decode.go
index 94bdd7a2d4..8166a6dbc5 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/decode.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/decode.go
@@ -37,19 +37,19 @@ func Read(path string) (*Config, error) {
 func Decode(c []byte) (*Config, error) {
 	defaultEntryMatches := defaultEntryRegex.FindAllSubmatch(c, -1)
 	if len(defaultEntryMatches) != 1 {
-		return nil, fmt.Errorf("failed to find default")
+		return nil, errors.New("failed to find default")
 	}
 
 	fallbackEntryMatches := fallbackEntryRegex.FindAllSubmatch(c, -1)
 	if len(fallbackEntryMatches) > 1 {
-		return nil, fmt.Errorf("found multiple fallback entries")
+		return nil, errors.New("found multiple fallback entries")
 	}
 
 	var fallbackEntry BootLabel
 
 	if len(fallbackEntryMatches) == 1 {
 		if len(fallbackEntryMatches[0]) != 2 {
-			return nil, fmt.Errorf("failed to parse fallback entry")
+			return nil, errors.New("failed to parse fallback entry")
 		}
 
 		entry, err := ParseBootLabel(string(fallbackEntryMatches[0][1]))
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/grub.go b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/grub.go
index 7891222994..1c41775e1a 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/grub.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/grub.go
@@ -6,6 +6,7 @@
 package grub
 
 import (
+	"errors"
 	"fmt"
 	"path/filepath"
 
@@ -67,7 +68,7 @@ func (c *Config) validate() error {
 	}
 
 	if c.Default == c.Fallback {
-		return fmt.Errorf("default and fallback entries must not be the same")
+		return errors.New("default and fallback entries must not be the same")
 	}
 
 	return nil
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/sdboot/sdboot.go b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/sdboot/sdboot.go
index 1225d69ad5..1dc3788f55 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/bootloader/sdboot/sdboot.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/bootloader/sdboot/sdboot.go
@@ -7,6 +7,7 @@ package sdboot
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"log"
 	"os"
@@ -223,7 +224,7 @@ func (c *Config) Revert(ctx context.Context) error {
 			return WriteVariable(efivario.NewDefaultContext(), LoaderEntryDefaultName, filepath.Base(file))
 		}
 
-		return fmt.Errorf("previous UKI not found")
+		return errors.New("previous UKI not found")
 	}); err != nil {
 		return err
 	}
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/platform/equinixmetal/equinix.go b/internal/app/machined/pkg/runtime/v1alpha1/platform/equinixmetal/equinix.go
index 49eee6a7d0..b5b2b64e14 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/platform/equinixmetal/equinix.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/platform/equinixmetal/equinix.go
@@ -9,6 +9,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	stderrors "errors"
 	"fmt"
 	"io"
 	"log"
@@ -137,7 +138,7 @@ func (p *EquinixMetal) ParseMetadata(ctx context.Context, equinixMetadata *Metad
 		}
 
 		if bondName != "" && iface.Bond != bondName {
-			return nil, fmt.Errorf("encountered multiple bonds. this is unexpected in the equinix metal platform")
+			return nil, stderrors.New("encountered multiple bonds. this is unexpected in the equinix metal platform")
 		}
 
 		bondName = iface.Bond
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/platform/internal/address/address.go b/internal/app/machined/pkg/runtime/v1alpha1/platform/internal/address/address.go
index 0f0afde05d..adcfb1074f 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/platform/internal/address/address.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/platform/internal/address/address.go
@@ -6,6 +6,7 @@
 package address
 
 import (
+	"errors"
 	"fmt"
 	"net"
 	"net/netip"
@@ -50,7 +51,7 @@ func IPPrefixFrom(address, netmask string) (netip.Prefix, error) {
 	}
 
 	if ip.Is4() && bits > 32 {
-		return netip.Prefix{}, fmt.Errorf("failed netmask should be the same address family")
+		return netip.Prefix{}, errors.New("failed netmask should be the same address family")
 	}
 
 	return netip.PrefixFrom(ip, bits), nil
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/platform/metal/metal.go b/internal/app/machined/pkg/runtime/v1alpha1/platform/metal/metal.go
index e6c2fcceb8..6ab223bea5 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/platform/metal/metal.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/platform/metal/metal.go
@@ -7,6 +7,7 @@ package metal
 
 import (
 	"context"
+	stderrors "errors"
 	"fmt"
 	"log"
 	"os"
@@ -133,7 +134,7 @@ func readConfigFromISO() ([]byte, error) {
 	}
 
 	if sb == nil {
-		return nil, fmt.Errorf("error while substituting filesystem type")
+		return nil, stderrors.New("error while substituting filesystem type")
 	}
 
 	if err = unix.Mount(dev.Device().Name(), mnt, sb.Type(), unix.MS_RDONLY, ""); err != nil {
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/platform/vmware/vmware_other.go b/internal/app/machined/pkg/runtime/v1alpha1/platform/vmware/vmware_other.go
index 7ccb7086c1..ff58202486 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/platform/vmware/vmware_other.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/platform/vmware/vmware_other.go
@@ -8,7 +8,7 @@ package vmware
 
 import (
 	"context"
-	"fmt"
+	"errors"
 
 	"github.com/cosi-project/runtime/pkg/state"
 	"github.com/siderolabs/go-procfs/procfs"
@@ -26,7 +26,7 @@ func (v *VMware) Name() string {
 
 // Configuration implements the platform.Platform interface.
 func (v *VMware) Configuration(context.Context, state.State) ([]byte, error) {
-	return nil, fmt.Errorf("arch not supported")
+	return nil, errors.New("arch not supported")
 }
 
 // Mode implements the platform.Platform interface.
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_dbus.go b/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_dbus.go
index e6bb329f1c..bb8f61c395 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_dbus.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_dbus.go
@@ -6,7 +6,7 @@ package v1alpha1
 
 import (
 	"context"
-	"fmt"
+	"errors"
 	"os"
 	"path/filepath"
 	"time"
@@ -75,7 +75,7 @@ func (dbus *DBusState) Stop() error {
 
 	select {
 	case <-time.After(time.Second):
-		return fmt.Errorf("timed out stopping D-Bus broker")
+		return errors.New("timed out stopping D-Bus broker")
 	case err := <-dbus.errCh:
 		return err
 	}
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_priority_lock.go b/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_priority_lock.go
index 3f178cf096..771669a0c6 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_priority_lock.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_priority_lock.go
@@ -6,7 +6,7 @@ package v1alpha1
 
 import (
 	"context"
-	"fmt"
+	"errors"
 	"sync"
 	"time"
 
@@ -85,7 +85,7 @@ func (lock *PriorityLock[T]) Lock(ctx context.Context, takeOverTimeout time.Dura
 	select {
 	case lock.takeoverCh <- struct{}{}:
 	case <-takeOverTimer.C:
-		return nil, fmt.Errorf("failed to acquire lock: timeout")
+		return nil, errors.New("failed to acquire lock: timeout")
 	}
 
 	defer func() {
@@ -109,7 +109,7 @@ func (lock *PriorityLock[T]) Lock(ctx context.Context, takeOverTimeout time.Dura
 
 		return seqCtx, nil
 	case <-takeOverTimer.C:
-		return nil, fmt.Errorf("failed to acquire lock: timeout")
+		return nil, errors.New("failed to acquire lock: timeout")
 	}
 }
 
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_runtime.go b/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_runtime.go
index 3242b36cf3..3231a8e2db 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_runtime.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_runtime.go
@@ -6,6 +6,7 @@ package v1alpha1
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"log"
 	"reflect"
@@ -95,17 +96,17 @@ func (r *Runtime) SetConfig(cfg config.Provider) error {
 func (r *Runtime) CanApplyImmediate(cfg config.Provider) error {
 	cfgProv := r.c.Load()
 	if cfgProv == nil {
-		return fmt.Errorf("no current config")
+		return errors.New("no current config")
 	}
 
 	currentConfig := cfgProv.RawV1Alpha1()
 	if currentConfig == nil {
-		return fmt.Errorf("current config is not v1alpha1")
+		return errors.New("current config is not v1alpha1")
 	}
 
 	newConfig := cfg.RawV1Alpha1()
 	if newConfig == nil {
-		return fmt.Errorf("new config is not v1alpha1")
+		return errors.New("new config is not v1alpha1")
 	}
 
 	// copy the config as we're going to modify it
diff --git a/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_sequencer_tasks.go b/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_sequencer_tasks.go
index c28b538afa..cc7b37034d 100644
--- a/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_sequencer_tasks.go
+++ b/internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_sequencer_tasks.go
@@ -160,7 +160,7 @@ func CreateSystemCgroups(runtime.Sequence, any) (runtime.TaskExecutionFunc, stri
 			// assert that cgroupsv2 is being used when running not in container mode,
 			// as Talos sets up cgroupsv2 on its own
 			if cgroups.Mode() != cgroups.Unified && !mount.ForceGGroupsV1() {
-				return fmt.Errorf("cgroupsv2 should be used")
+				return errors.New("cgroupsv2 should be used")
 			}
 		}
 
@@ -504,7 +504,7 @@ func DiskSizeCheck(runtime.Sequence, any) (runtime.TaskExecutionFunc, string) {
 
 		disk := r.State().Machine().Disk() // get ephemeral disk state
 		if disk == nil {
-			return fmt.Errorf("failed to get ephemeral disk state")
+			return errors.New("failed to get ephemeral disk state")
 		}
 
 		diskSize, err := disk.Size()
@@ -1569,7 +1569,7 @@ func ResetUserDisks(_ runtime.Sequence, data any) (runtime.TaskExecutionFunc, st
 	return func(ctx context.Context, logger *log.Logger, r runtime.Runtime) (err error) {
 		in, ok := data.(runtime.ResetOptions)
 		if !ok {
-			return fmt.Errorf("unexpected runtime data")
+			return errors.New("unexpected runtime data")
 		}
 
 		wipeDevice := func(deviceName string) error {
@@ -1637,7 +1637,7 @@ func parseTargets(r runtime.Runtime, wipeStr string) (targets, error) {
 	}
 
 	if len(result) == 0 {
-		return targets{}, fmt.Errorf("no wipe labels specified")
+		return targets{}, errors.New("no wipe labels specified")
 	}
 
 	return targets{systemDiskTargets: result}, nil
@@ -1654,7 +1654,7 @@ func ResetSystemDiskSpec(_ runtime.Sequence, data any) (runtime.TaskExecutionFun
 	return func(ctx context.Context, logger *log.Logger, r runtime.Runtime) (err error) {
 		in, ok := data.(SystemDiskTargets)
 		if !ok {
-			return fmt.Errorf("unexpected runtime data")
+			return errors.New("unexpected runtime data")
 		}
 
 		for _, target := range in.GetSystemDiskTargets() {
@@ -1730,7 +1730,7 @@ func VerifyDiskAvailability(runtime.Sequence, any) (runtime.TaskExecutionFunc, s
 						mountsReported = true
 					}
 
-					return retry.ExpectedError(fmt.Errorf("ephemeral partition in use: %q", partname))
+					return retry.ExpectedErrorf("ephemeral partition in use: %q", partname)
 				}
 
 				return fmt.Errorf("failed to verify ephemeral partition not in use: %w", err)
@@ -1868,7 +1868,7 @@ func SaveStateEncryptionConfig(runtime.Sequence, any) (runtime.TaskExecutionFunc
 		}
 
 		if !ok {
-			return fmt.Errorf("failed to save state encryption config in the META partition")
+			return errors.New("failed to save state encryption config in the META partition")
 		}
 
 		return r.State().Machine().Meta().Flush()
@@ -2051,7 +2051,7 @@ func Install(runtime.Sequence, any) (runtime.TaskExecutionFunc, string) {
 			logger.Println("staged upgrade successful")
 
 		default:
-			return fmt.Errorf("unsupported configuration for install task")
+			return errors.New("unsupported configuration for install task")
 		}
 
 		return nil
diff --git a/internal/app/machined/pkg/system/service_runner_test.go b/internal/app/machined/pkg/system/service_runner_test.go
index 5d98549b6b..337051e86d 100644
--- a/internal/app/machined/pkg/system/service_runner_test.go
+++ b/internal/app/machined/pkg/system/service_runner_test.go
@@ -45,7 +45,7 @@ func (suite *ServiceRunnerSuite) TestFullFlow() {
 	suite.Require().NoError(retry.Constant(time.Minute, retry.WithUnits(10*time.Millisecond)).Retry(func() error {
 		state := sr.AsProto().State
 		if state != events.StateRunning.String() {
-			return retry.ExpectedError(errors.New("service should be running"))
+			return retry.ExpectedErrorf("service should be running")
 		}
 
 		return nil
@@ -87,7 +87,7 @@ func (suite *ServiceRunnerSuite) TestFullFlowHealthy() {
 	suite.Require().NoError(retry.Constant(time.Minute, retry.WithUnits(10*time.Millisecond)).Retry(func() error {
 		health := sr.AsProto().Health
 		if health.Unknown || !health.Healthy {
-			return retry.ExpectedError(errors.New("service should be healthy"))
+			return retry.ExpectedErrorf("service should be healthy")
 		}
 
 		return nil
@@ -128,7 +128,7 @@ func (suite *ServiceRunnerSuite) TestFullFlowHealthChanges() {
 	suite.Require().NoError(retry.Constant(time.Minute, retry.WithUnits(10*time.Millisecond)).Retry(func() error {
 		health := sr.AsProto().Health
 		if health.Unknown || !health.Healthy {
-			return retry.ExpectedError(errors.New("service should be healthy"))
+			return retry.ExpectedErrorf("service should be healthy")
 		}
 
 		return nil
@@ -139,7 +139,7 @@ func (suite *ServiceRunnerSuite) TestFullFlowHealthChanges() {
 	suite.Require().NoError(retry.Constant(time.Minute, retry.WithUnits(10*time.Millisecond)).Retry(func() error {
 		health := sr.AsProto().Health
 		if health.Unknown || health.Healthy {
-			return retry.ExpectedError(errors.New("service should be not healthy"))
+			return retry.ExpectedErrorf("service should be not healthy")
 		}
 
 		return nil
@@ -150,7 +150,7 @@ func (suite *ServiceRunnerSuite) TestFullFlowHealthChanges() {
 	suite.Require().NoError(retry.Constant(time.Minute, retry.WithUnits(10*time.Millisecond)).Retry(func() error {
 		health := sr.AsProto().Health
 		if health.Unknown || !health.Healthy {
-			return retry.ExpectedError(errors.New("service should be healthy"))
+			return retry.ExpectedErrorf("service should be healthy")
 		}
 
 		return nil
@@ -194,7 +194,7 @@ func (suite *ServiceRunnerSuite) TestWaitingDescriptionChange() {
 	suite.Require().NoError(retry.Constant(time.Minute, retry.WithUnits(10*time.Millisecond)).Retry(func() error {
 		state := sr.AsProto().State
 		if state != events.StateWaiting.String() {
-			return retry.ExpectedError(errors.New("service should be waiting"))
+			return retry.ExpectedErrorf("service should be waiting")
 		}
 
 		return nil
@@ -213,7 +213,7 @@ func (suite *ServiceRunnerSuite) TestWaitingDescriptionChange() {
 
 		lastMsg := events[len(events)-1].Msg
 		if lastMsg != "Waiting for cond2" {
-			return retry.ExpectedError(errors.New("service should be waiting on 2nd condition"))
+			return retry.ExpectedErrorf("service should be waiting on 2nd condition")
 		}
 
 		return nil
@@ -230,7 +230,7 @@ func (suite *ServiceRunnerSuite) TestWaitingDescriptionChange() {
 	suite.Require().NoError(retry.Constant(time.Minute, retry.WithUnits(10*time.Millisecond)).Retry(func() error {
 		state := sr.AsProto().State
 		if state != events.StateRunning.String() {
-			return retry.ExpectedError(errors.New("service should be running"))
+			return retry.ExpectedErrorf("service should be running")
 		}
 
 		return nil
@@ -309,7 +309,7 @@ func (suite *ServiceRunnerSuite) TestAbortOnCondition() {
 	suite.Require().NoError(retry.Constant(time.Minute, retry.WithUnits(10*time.Millisecond)).Retry(func() error {
 		state := sr.AsProto().State
 		if state != events.StateWaiting.String() {
-			return retry.ExpectedError(errors.New("service should be waiting"))
+			return retry.ExpectedErrorf("service should be waiting")
 		}
 
 		return nil
@@ -392,7 +392,7 @@ func (suite *ServiceRunnerSuite) TestFullFlowRestart() {
 	suite.Require().NoError(retry.Constant(time.Minute, retry.WithUnits(10*time.Millisecond)).Retry(func() error {
 		state := sr.AsProto().State
 		if state != events.StateRunning.String() {
-			return retry.ExpectedError(errors.New("service should be running"))
+			return retry.ExpectedErrorf("service should be running")
 		}
 
 		return nil
@@ -415,7 +415,7 @@ func (suite *ServiceRunnerSuite) TestFullFlowRestart() {
 	suite.Require().NoError(retry.Constant(time.Minute, retry.WithUnits(10*time.Millisecond)).Retry(func() error {
 		state := sr.AsProto().State
 		if state != events.StateRunning.String() {
-			return retry.ExpectedError(errors.New("service should be running"))
+			return retry.ExpectedErrorf("service should be running")
 		}
 
 		return nil
diff --git a/internal/app/machined/pkg/system/services/apid.go b/internal/app/machined/pkg/system/services/apid.go
index 29353607ce..108c424f0b 100644
--- a/internal/app/machined/pkg/system/services/apid.go
+++ b/internal/app/machined/pkg/system/services/apid.go
@@ -7,6 +7,7 @@ package services
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net"
 	"os"
@@ -52,7 +53,7 @@ func (o *APID) ID(r runtime.Runtime) string {
 // apidResourceFilter filters access to COSI state for apid.
 func apidResourceFilter(ctx context.Context, access state.Access) error {
 	if !access.Verb.Readonly() {
-		return fmt.Errorf("write access denied")
+		return errors.New("write access denied")
 	}
 
 	switch {
@@ -63,7 +64,7 @@ func apidResourceFilter(ctx context.Context, access state.Access) error {
 	case access.ResourceNamespace == network.NamespaceName && access.ResourceType == network.HostnameStatusType:
 		// allowed, contains local node hostname
 	default:
-		return fmt.Errorf("access denied")
+		return errors.New("access denied")
 	}
 
 	return nil
diff --git a/internal/app/machined/pkg/system/services/etcd.go b/internal/app/machined/pkg/system/services/etcd.go
index 1c9f851af7..3888cf5437 100644
--- a/internal/app/machined/pkg/system/services/etcd.go
+++ b/internal/app/machined/pkg/system/services/etcd.go
@@ -667,7 +667,7 @@ func BootstrapEtcd(ctx context.Context, r runtime.Runtime, req *machineapi.Boots
 	}
 
 	if entries, _ := os.ReadDir(constants.EtcdDataPath); len(entries) > 0 { //nolint:errcheck
-		return fmt.Errorf("etcd data directory is not empty")
+		return errors.New("etcd data directory is not empty")
 	}
 
 	svc := &Etcd{
diff --git a/internal/app/machined/pkg/system/services/trustd.go b/internal/app/machined/pkg/system/services/trustd.go
index 4bb0d50049..dbf016fc36 100644
--- a/internal/app/machined/pkg/system/services/trustd.go
+++ b/internal/app/machined/pkg/system/services/trustd.go
@@ -7,6 +7,7 @@ package services
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net"
 	"os"
@@ -58,14 +59,14 @@ func (t *Trustd) PreFunc(ctx context.Context, r runtime.Runtime) error {
 		r.State().V1Alpha2().Resources(),
 		func(ctx context.Context, access state.Access) error {
 			if !access.Verb.Readonly() {
-				return fmt.Errorf("write access denied")
+				return errors.New("write access denied")
 			}
 
 			switch {
 			case access.ResourceNamespace == secrets.NamespaceName && access.ResourceType == secrets.TrustdType && access.ResourceID == secrets.TrustdID:
 			case access.ResourceNamespace == secrets.NamespaceName && access.ResourceType == secrets.OSRootType && access.ResourceID == secrets.OSRootID:
 			default:
-				return fmt.Errorf("access denied")
+				return errors.New("access denied")
 			}
 
 			return nil
diff --git a/internal/app/maintenance/server.go b/internal/app/maintenance/server.go
index 7a09017571..c4f98a8ff9 100644
--- a/internal/app/maintenance/server.go
+++ b/internal/app/maintenance/server.go
@@ -117,13 +117,13 @@ Node is running in maintenance mode and does not have a config yet.`
 // GenerateConfiguration implements the [machine.MachineServiceServer] interface.
 func (s *Server) GenerateConfiguration(ctx context.Context, in *machine.GenerateConfigurationRequest) (*machine.GenerateConfigurationResponse, error) {
 	if in.MachineConfig == nil {
-		return nil, fmt.Errorf("invalid generate request")
+		return nil, errors.New("invalid generate request")
 	}
 
 	machineType := v1alpha1machine.Type(in.MachineConfig.Type)
 
 	if machineType == v1alpha1machine.TypeWorker {
-		return nil, fmt.Errorf("join config can't be generated in the maintenance mode")
+		return nil, errors.New("join config can't be generated in the maintenance mode")
 	}
 
 	return configuration.Generate(ctx, in)
@@ -215,7 +215,7 @@ func (s *Server) Reset(ctx context.Context, in *machine.ResetRequest) (reply *ma
 	}
 
 	if in.UserDisksToWipe != nil && in.Mode == machine.ResetRequest_SYSTEM_DISK {
-		return nil, fmt.Errorf("reset failed: invalid input, wipe mode SYSTEM_DISK doesn't support UserDisksToWipe parameter")
+		return nil, errors.New("reset failed: invalid input, wipe mode SYSTEM_DISK doesn't support UserDisksToWipe parameter")
 	}
 
 	actorID := uuid.New().String()
@@ -223,7 +223,7 @@ func (s *Server) Reset(ctx context.Context, in *machine.ResetRequest) (reply *ma
 	log.Printf("reset request received. actorID: %s", actorID)
 
 	if len(in.GetSystemPartitionsToWipe()) > 0 {
-		return nil, fmt.Errorf("system partitions to wipe params is not supported in the maintenance mode")
+		return nil, errors.New("system partitions to wipe params is not supported in the maintenance mode")
 	}
 
 	var dev *blockdevice.BlockDevice
@@ -231,7 +231,7 @@ func (s *Server) Reset(ctx context.Context, in *machine.ResetRequest) (reply *ma
 	disk := s.controller.Runtime().State().Machine().Disk(disk.WithPartitionLabel(constants.BootPartitionLabel))
 
 	if disk == nil {
-		return nil, fmt.Errorf("reset failed: Talos is not installed")
+		return nil, errors.New("reset failed: Talos is not installed")
 	}
 
 	dev, err = blockdevice.Open(disk.Device().Name())
diff --git a/internal/integration/api/etcd-recover.go b/internal/integration/api/etcd-recover.go
index 07b11b1584..27741138d7 100644
--- a/internal/integration/api/etcd-recover.go
+++ b/internal/integration/api/etcd-recover.go
@@ -142,13 +142,11 @@ func (suite *EtcdRecoverSuite) TestSnapshotRecover() {
 
 						if bootIDAfter == bootIDBefore {
 							// bootID should be different after reboot
-							return retry.ExpectedError(
-								fmt.Errorf(
-									"bootID didn't change for node %q: before %s, after %s",
-									node,
-									bootIDBefore,
-									bootIDAfter,
-								),
+							return retry.ExpectedErrorf(
+								"bootID didn't change for node %q: before %s, after %s",
+								node,
+								bootIDBefore,
+								bootIDAfter,
 							)
 						}
 
diff --git a/internal/integration/api/firewall.go b/internal/integration/api/firewall.go
index 810e296b8a..60132fce76 100644
--- a/internal/integration/api/firewall.go
+++ b/internal/integration/api/firewall.go
@@ -98,7 +98,7 @@ func (suite *FirewallSuite) TestKubeletAccess() {
 
 			if firewallEnabled {
 				if err == nil {
-					return fmt.Errorf("kubelet API should not be available")
+					return errors.New("kubelet API should not be available")
 				}
 
 				if !errors.Is(err, os.ErrDeadlineExceeded) && !errors.Is(err, context.DeadlineExceeded) {
diff --git a/internal/integration/api/reboot.go b/internal/integration/api/reboot.go
index 4b37991bca..f5bf0eb016 100644
--- a/internal/integration/api/reboot.go
+++ b/internal/integration/api/reboot.go
@@ -178,18 +178,16 @@ func (suite *RebootSuite) TestRebootAllNodes() {
 						bootIDAfter, err := suite.ReadBootID(requestCtx)
 						if err != nil {
 							// API might be unresponsive during reboot
-							return retry.ExpectedError(fmt.Errorf("error reading bootID for node %q: %w", node, err))
+							return retry.ExpectedErrorf("error reading bootID for node %q: %w", node, err)
 						}
 
 						if bootIDAfter == bootIDBefore {
 							// bootID should be different after reboot
-							return retry.ExpectedError(
-								fmt.Errorf(
-									"bootID didn't change for node %q: before %s, after %s",
-									node,
-									bootIDBefore,
-									bootIDAfter,
-								),
+							return retry.ExpectedErrorf(
+								"bootID didn't change for node %q: before %s, after %s",
+								node,
+								bootIDBefore,
+								bootIDAfter,
 							)
 						}
 
diff --git a/internal/integration/base/api.go b/internal/integration/base/api.go
index 17e71dd855..31a897c3bd 100644
--- a/internal/integration/base/api.go
+++ b/internal/integration/base/api.go
@@ -324,7 +324,7 @@ func (apiSuite *APISuite) AssertBootIDChanged(nodeCtx context.Context, bootIDBef
 
 		if bootIDAfter == bootIDBefore {
 			// bootID should be different after reboot
-			return retry.ExpectedError(fmt.Errorf("bootID didn't change for node %q: before %s, after %s", node, bootIDBefore, bootIDAfter))
+			return retry.ExpectedErrorf("bootID didn't change for node %q: before %s, after %s", node, bootIDBefore, bootIDAfter)
 		}
 
 		return nil
diff --git a/internal/integration/base/cli.go b/internal/integration/base/cli.go
index ec9a4bdffd..3c3b6c54ee 100644
--- a/internal/integration/base/cli.go
+++ b/internal/integration/base/cli.go
@@ -126,7 +126,7 @@ func (cliSuite *CLISuite) RunAndWaitForMatch(args []string, regex *regexp.Regexp
 		}
 
 		if !regex.MatchString(stdout.String()) {
-			return retry.ExpectedError(fmt.Errorf("stdout doesn't match: %q", stdout))
+			return retry.ExpectedErrorf("stdout doesn't match: %q", stdout)
 		}
 
 		return nil
diff --git a/internal/integration/base/k8s.go b/internal/integration/base/k8s.go
index 6ed5e75938..3405b4d800 100644
--- a/internal/integration/base/k8s.go
+++ b/internal/integration/base/k8s.go
@@ -108,7 +108,7 @@ func (k8sSuite *K8sSuite) WaitForK8sNodeReadinessStatus(ctx context.Context, nod
 		}
 
 		if !checkFn(readinessStatus) {
-			return retry.ExpectedError(fmt.Errorf("node readiness status is %s", readinessStatus))
+			return retry.ExpectedErrorf("node readiness status is %s", readinessStatus)
 		}
 
 		return nil
diff --git a/internal/integration/cli/diskusage.go b/internal/integration/cli/diskusage.go
index c940fad024..f9635e879b 100644
--- a/internal/integration/cli/diskusage.go
+++ b/internal/integration/cli/diskusage.go
@@ -7,6 +7,7 @@
 package cli
 
 import (
+	"errors"
 	"fmt"
 	"strconv"
 	"strings"
@@ -80,7 +81,7 @@ func (suite *DiskUsageSuite) TestSuccess() {
 		base.StdoutMatchFunc(func(stdout string) error {
 			lines := strings.Split(strings.TrimSpace(stdout), "\n")
 			if len(lines) == 1 {
-				return fmt.Errorf("expected lines > 0")
+				return errors.New("expected lines > 0")
 			}
 
 			parts := splitLine(lines[1])
@@ -100,7 +101,7 @@ func (suite *DiskUsageSuite) TestSuccess() {
 		base.StdoutMatchFunc(func(stdout string) error {
 			lines := strings.Split(strings.TrimSpace(stdout), "\n")
 			if len(lines) == 1 {
-				return fmt.Errorf("expected lines > 0")
+				return errors.New("expected lines > 0")
 			}
 
 			var totalExpected int64
diff --git a/internal/integration/cli/machineconfig.go b/internal/integration/cli/machineconfig.go
index 8bbaf96336..50bc0bcc27 100644
--- a/internal/integration/cli/machineconfig.go
+++ b/internal/integration/cli/machineconfig.go
@@ -8,6 +8,7 @@ package cli
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -107,11 +108,11 @@ func (suite *MachineConfigSuite) TestPatchPrintStdout() {
 		var matchErr *multierror.Error
 
 		if !strings.Contains(output, "clusterName: replaced") {
-			matchErr = multierror.Append(matchErr, fmt.Errorf("clusterName not replaced"))
+			matchErr = multierror.Append(matchErr, errors.New("clusterName not replaced"))
 		}
 
 		if !strings.Contains(output, "endpoint: replaced") {
-			matchErr = multierror.Append(matchErr, fmt.Errorf("endpoint not replaced"))
+			matchErr = multierror.Append(matchErr, errors.New("endpoint not replaced"))
 		}
 
 		return matchErr.ErrorOrNil()
diff --git a/internal/integration/cli/reboot.go b/internal/integration/cli/reboot.go
index 1581f92c6f..85aae0cb74 100644
--- a/internal/integration/cli/reboot.go
+++ b/internal/integration/cli/reboot.go
@@ -8,6 +8,7 @@
 package cli
 
 import (
+	"errors"
 	"fmt"
 	"path/filepath"
 	"strings"
@@ -102,7 +103,7 @@ func (suite *RebootSuite) TestRebootEarlyFailPrintsOutput() {
 			}
 
 			if !strings.Contains(stdout, "failed to determine endpoints") {
-				return fmt.Errorf("expected to find 'failed to determine endpoints' in stderr")
+				return errors.New("expected to find 'failed to determine endpoints' in stderr")
 			}
 
 			return nil
diff --git a/internal/integration/provision/provision.go b/internal/integration/provision/provision.go
index a0c4c17ed3..a589aa98a5 100644
--- a/internal/integration/provision/provision.go
+++ b/internal/integration/provision/provision.go
@@ -381,13 +381,11 @@ waitLoop:
 
 				if version != options.TargetVersion {
 					// upgrade not finished yet
-					return retry.ExpectedError(
-						fmt.Errorf(
-							"node %q version doesn't match expected: expected %q, got %q",
-							node.IPs[0].String(),
-							options.TargetVersion,
-							version,
-						),
+					return retry.ExpectedErrorf(
+						"node %q version doesn't match expected: expected %q, got %q",
+						node.IPs[0].String(),
+						options.TargetVersion,
+						version,
 					)
 				}
 
diff --git a/internal/pkg/configuration/configuration.go b/internal/pkg/configuration/configuration.go
index e0c9c3eda0..4147abe102 100644
--- a/internal/pkg/configuration/configuration.go
+++ b/internal/pkg/configuration/configuration.go
@@ -7,6 +7,7 @@ package configuration
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net/url"
 	"os"
@@ -32,7 +33,7 @@ func Generate(ctx context.Context, in *machine.GenerateConfigurationRequest) (re
 	var c config.Provider
 
 	if in.MachineConfig == nil || in.ClusterConfig == nil || in.ClusterConfig.ControlPlane == nil {
-		return nil, fmt.Errorf("invalid generate request")
+		return nil, errors.New("invalid generate request")
 	}
 
 	switch in.ConfigVersion {
diff --git a/internal/pkg/containers/container.go b/internal/pkg/containers/container.go
index 206a6a9932..b286a785a5 100644
--- a/internal/pkg/containers/container.go
+++ b/internal/pkg/containers/container.go
@@ -7,6 +7,7 @@ package containers
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -102,7 +103,7 @@ func (c *Container) GetLogChunker(ctx context.Context, follow bool, tailLines in
 	}
 
 	if filename == "" {
-		return nil, nil, fmt.Errorf("no log available")
+		return nil, nil, errors.New("no log available")
 	}
 
 	f, err := os.OpenFile(filename, os.O_RDONLY, 0)
diff --git a/internal/pkg/containers/cri/containerd/hosts.go b/internal/pkg/containers/cri/containerd/hosts.go
index 228a905c55..e2e00c4f3e 100644
--- a/internal/pkg/containers/cri/containerd/hosts.go
+++ b/internal/pkg/containers/cri/containerd/hosts.go
@@ -6,6 +6,7 @@ package containerd
 
 import (
 	"bytes"
+	"errors"
 	"fmt"
 	"net/url"
 	"os"
@@ -185,7 +186,7 @@ func GenerateHosts(cfg config.Registries, basePath string) (*HostsConfig, error)
 
 		if hostname == "*" {
 			// no way to generate TLS config for wildcard host
-			return nil, fmt.Errorf("wildcard host TLS configuration is not supported")
+			return nil, errors.New("wildcard host TLS configuration is not supported")
 		}
 
 		directory := &HostsDirectory{}
diff --git a/internal/pkg/containers/image/resolver_test.go b/internal/pkg/containers/image/resolver_test.go
index 2f7e5365a5..d3b682c547 100644
--- a/internal/pkg/containers/image/resolver_test.go
+++ b/internal/pkg/containers/image/resolver_test.go
@@ -6,7 +6,7 @@ package image_test
 
 import (
 	"context"
-	"fmt"
+	"errors"
 	"net/http"
 	"testing"
 
@@ -44,7 +44,7 @@ func (c *mockConfig) Config() map[string]config.RegistryConfig {
 }
 
 func (c *mockConfig) ExtraFiles() ([]config.File, error) {
-	return nil, fmt.Errorf("not implemented")
+	return nil, errors.New("not implemented")
 }
 
 type ResolverSuite struct {
diff --git a/internal/pkg/dashboard/formdata.go b/internal/pkg/dashboard/formdata.go
index 49e5632470..8b79a75924 100644
--- a/internal/pkg/dashboard/formdata.go
+++ b/internal/pkg/dashboard/formdata.go
@@ -5,6 +5,7 @@
 package dashboard
 
 import (
+	"errors"
 	"fmt"
 	"net/netip"
 	"strings"
@@ -122,7 +123,7 @@ func (formData *NetworkConfigFormData) ToPlatformNetworkConfig() (*runtime.Platf
 			}
 
 			if len(config.Addresses) == 0 {
-				errs = multierror.Append(errs, fmt.Errorf("no addresses specified"))
+				errs = multierror.Append(errs, errors.New("no addresses specified"))
 			}
 
 			config.Routes, err = formData.buildRoutes(formData.Iface)
diff --git a/internal/pkg/discovery/registry/kubernetes.go b/internal/pkg/discovery/registry/kubernetes.go
index 8a6e07cca2..f4f6fbc459 100644
--- a/internal/pkg/discovery/registry/kubernetes.go
+++ b/internal/pkg/discovery/registry/kubernetes.go
@@ -7,6 +7,7 @@ package registry
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/netip"
 	"strconv"
@@ -235,7 +236,7 @@ func (r *Kubernetes) Push(ctx context.Context, affiliate *cluster.Affiliate) err
 // Watch should be called first for the List to return data.
 func (r *Kubernetes) List(localNodeName string) ([]*cluster.AffiliateSpec, error) {
 	if r.nodes == nil {
-		return nil, fmt.Errorf("List() called without Watch() first")
+		return nil, errors.New("List() called without Watch() first")
 	}
 
 	nodes, err := r.nodes.Lister().List(labels.Everything())
diff --git a/internal/pkg/encryption/encryption.go b/internal/pkg/encryption/encryption.go
index 29d09834a5..83c408e70a 100644
--- a/internal/pkg/encryption/encryption.go
+++ b/internal/pkg/encryption/encryption.go
@@ -177,7 +177,7 @@ func (h *Handler) formatAndEncrypt(ctx context.Context, path string, handlers []
 	log.Printf("encrypting the partition %s (%s)", path, h.partition.Name)
 
 	if len(handlers) == 0 {
-		return fmt.Errorf("no encryption keys found")
+		return errors.New("no encryption keys found")
 	}
 
 	var (
diff --git a/internal/pkg/encryption/keys/keys.go b/internal/pkg/encryption/keys/keys.go
index 2642fb24c0..0e38169f4c 100644
--- a/internal/pkg/encryption/keys/keys.go
+++ b/internal/pkg/encryption/keys/keys.go
@@ -7,6 +7,7 @@ package keys
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
 	"github.com/siderolabs/go-blockdevice/blockdevice/encryption"
@@ -15,7 +16,7 @@ import (
 	"github.com/siderolabs/talos/pkg/machinery/config/config"
 )
 
-var errNoSystemInfoGetter = fmt.Errorf("the UUID getter is not set")
+var errNoSystemInfoGetter = errors.New("the UUID getter is not set")
 
 // NewHandler key using provided config.
 func NewHandler(cfg config.EncryptionKey, options ...KeyOption) (Handler, error) {
@@ -30,7 +31,7 @@ func NewHandler(cfg config.EncryptionKey, options ...KeyOption) (Handler, error)
 	case cfg.Static() != nil:
 		k := cfg.Static().Key()
 		if k == nil {
-			return nil, fmt.Errorf("static key must have key data defined")
+			return nil, errors.New("static key must have key data defined")
 		}
 
 		return NewStaticKeyHandler(key, k), nil
@@ -50,7 +51,7 @@ func NewHandler(cfg config.EncryptionKey, options ...KeyOption) (Handler, error)
 		return NewTPMKeyHandler(key)
 	}
 
-	return nil, fmt.Errorf("malformed config: no key handler can be created")
+	return nil, errors.New("malformed config: no key handler can be created")
 }
 
 // Handler manages key lifecycle.
@@ -71,4 +72,4 @@ func (k *KeyHandler) Slot() int {
 }
 
 // ErrTokenInvalid is returned by the keys handler if the supplied token is not valid.
-var ErrTokenInvalid = fmt.Errorf("invalid token")
+var ErrTokenInvalid = errors.New("invalid token")
diff --git a/internal/pkg/etcd/endpoints.go b/internal/pkg/etcd/endpoints.go
index cc0d4136c3..745e311484 100644
--- a/internal/pkg/etcd/endpoints.go
+++ b/internal/pkg/etcd/endpoints.go
@@ -6,6 +6,7 @@ package etcd
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
 	"github.com/cosi-project/runtime/pkg/safe"
@@ -35,7 +36,7 @@ func GetEndpoints(ctx context.Context, resources state.State) ([]string, error)
 	}
 
 	if len(endpointAddrs) == 0 {
-		return nil, fmt.Errorf("no controlplane endpoints discovered yet")
+		return nil, errors.New("no controlplane endpoints discovered yet")
 	}
 
 	endpoints := endpointAddrs.Strings()
diff --git a/internal/pkg/etcd/etcd.go b/internal/pkg/etcd/etcd.go
index e002a3f949..99e8ac516e 100644
--- a/internal/pkg/etcd/etcd.go
+++ b/internal/pkg/etcd/etcd.go
@@ -104,7 +104,7 @@ func (c *Client) ValidateForUpgrade(ctx context.Context, config config.Config, p
 
 	if !preserve {
 		if len(resp.Members) == 1 {
-			return fmt.Errorf("only 1 etcd member found; assuming this is not an HA setup and refusing to upgrade; if this is a single-node cluster, use --preserve to upgrade")
+			return errors.New("only 1 etcd member found; assuming this is not an HA setup and refusing to upgrade; if this is a single-node cluster, use --preserve to upgrade")
 		}
 	}
 
@@ -220,7 +220,7 @@ func (c *Client) ForfeitLeadership(ctx context.Context, memberID string) (string
 	}
 
 	if len(resp.Members) == 1 {
-		return "", fmt.Errorf("cannot forfeit leadership, only one member")
+		return "", errors.New("cannot forfeit leadership, only one member")
 	}
 
 	var member *etcdserverpb.Member
diff --git a/internal/pkg/extensions/discarder.go b/internal/pkg/extensions/discarder.go
index 8bd3c521ee..9c3c707103 100644
--- a/internal/pkg/extensions/discarder.go
+++ b/internal/pkg/extensions/discarder.go
@@ -5,7 +5,7 @@
 package extensions
 
 import (
-	"fmt"
+	"errors"
 	"io"
 )
 
@@ -22,7 +22,7 @@ type discarder struct {
 // It is an error for the offset to be negative.
 func (r *discarder) ReadAt(p []byte, off int64) (int, error) {
 	if off-r.pos < 0 {
-		return 0, fmt.Errorf("negative seek on discarder not allowed")
+		return 0, errors.New("negative seek on discarder not allowed")
 	}
 
 	if off != r.pos {
diff --git a/internal/pkg/extensions/load.go b/internal/pkg/extensions/load.go
index 6dd2515420..fe258ff267 100644
--- a/internal/pkg/extensions/load.go
+++ b/internal/pkg/extensions/load.go
@@ -5,6 +5,7 @@
 package extensions
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -43,11 +44,11 @@ func Load(path string) (*Extension, error) {
 	var zeroManifest extensions.Manifest
 
 	if extension.Manifest == zeroManifest {
-		return nil, fmt.Errorf("extension manifest is missing")
+		return nil, errors.New("extension manifest is missing")
 	}
 
 	if extension.rootfsPath == "" {
-		return nil, fmt.Errorf("extension rootfs is missing")
+		return nil, errors.New("extension rootfs is missing")
 	}
 
 	return extension, nil
diff --git a/internal/pkg/install/pull.go b/internal/pkg/install/pull.go
index 00a3df468f..559a713852 100644
--- a/internal/pkg/install/pull.go
+++ b/internal/pkg/install/pull.go
@@ -6,6 +6,7 @@ package install
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
 	"github.com/containerd/containerd"
@@ -103,7 +104,7 @@ func PullAndValidateInstallerImage(ctx context.Context, reg config.Registries, r
 	}
 
 	if code != 0 {
-		return fmt.Errorf("installer help returned non-zero exit. assuming invalid installer")
+		return errors.New("installer help returned non-zero exit. assuming invalid installer")
 	}
 
 	return nil
diff --git a/internal/pkg/logind/kubelet_mock_test.go b/internal/pkg/logind/kubelet_mock_test.go
index 93ed9dea32..5a28c451b1 100644
--- a/internal/pkg/logind/kubelet_mock_test.go
+++ b/internal/pkg/logind/kubelet_mock_test.go
@@ -5,6 +5,7 @@
 package logind_test
 
 import (
+	"errors"
 	"fmt"
 	"log"
 	"syscall"
@@ -61,7 +62,7 @@ func (bus *DBusCon) CurrentInhibitDelay() (time.Duration, error) {
 
 	delay, ok := res.Value().(uint64)
 	if !ok {
-		return 0, fmt.Errorf("InhibitDelayMaxUSec from logind is not a uint64 as expected")
+		return 0, errors.New("InhibitDelayMaxUSec from logind is not a uint64 as expected")
 	}
 
 	// InhibitDelayMaxUSec is in microseconds
diff --git a/internal/pkg/miniprocfs/processes.go b/internal/pkg/miniprocfs/processes.go
index 5df4dd484b..c10f6ddd18 100644
--- a/internal/pkg/miniprocfs/processes.go
+++ b/internal/pkg/miniprocfs/processes.go
@@ -6,7 +6,7 @@ package miniprocfs
 
 import (
 	"bytes"
-	"fmt"
+	"errors"
 	"io"
 	"os"
 	"strconv"
@@ -124,7 +124,7 @@ func (procs *Processes) readProc(pidString string) (*machine.ProcessInfo, error)
 
 	rbracket := bytes.LastIndexByte(procs.buf, ')')
 	if rbracket == -1 {
-		return nil, fmt.Errorf("unexpected format")
+		return nil, errors.New("unexpected format")
 	}
 
 	fields := bytes.Fields(procs.buf[rbracket+2:])
diff --git a/internal/pkg/ntp/ntp_test.go b/internal/pkg/ntp/ntp_test.go
index a9f95309f9..6d5d479577 100644
--- a/internal/pkg/ntp/ntp_test.go
+++ b/internal/pkg/ntp/ntp_test.go
@@ -6,6 +6,7 @@ package ntp_test
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"log"
 	"sync"
@@ -75,7 +76,7 @@ func (suite *NTPSuite) adjustSystemClock(val *unix.Timex) (status timex.State, e
 func (suite *NTPSuite) fakeQuery(host string) (resp *beevikntp.Response, err error) {
 	switch host {
 	case "127.0.0.1": // error
-		return nil, fmt.Errorf("no response")
+		return nil, errors.New("no response")
 	case "127.0.0.2": // invalid response
 		resp = &beevikntp.Response{}
 
@@ -122,7 +123,7 @@ func (suite *NTPSuite) fakeQuery(host string) (resp *beevikntp.Response, err err
 		suite.failingServer++
 
 		if suite.failingServer%2 == 0 {
-			return nil, fmt.Errorf("failed this time")
+			return nil, errors.New("failed this time")
 		}
 
 		resp = &beevikntp.Response{
@@ -230,7 +231,7 @@ func (suite *NTPSuite) TestSyncContinuous() {
 			defer suite.clockLock.Unlock()
 
 			if len(suite.clockAdjustments) < 3 {
-				return retry.ExpectedError(fmt.Errorf("not enough syncs"))
+				return retry.ExpectedErrorf("not enough syncs")
 			}
 
 			return nil
@@ -277,7 +278,7 @@ func (suite *NTPSuite) TestSyncWithSpikes() {
 			defer suite.clockLock.Unlock()
 
 			if len(suite.clockAdjustments) < 6 {
-				return retry.ExpectedError(fmt.Errorf("not enough syncs"))
+				return retry.ExpectedErrorf("not enough syncs")
 			}
 
 			for _, adj := range suite.clockAdjustments {
@@ -367,7 +368,7 @@ func (suite *NTPSuite) TestSyncIterateTimeservers() {
 			defer suite.clockLock.Unlock()
 
 			if len(suite.clockAdjustments) < 3 {
-				return retry.ExpectedError(fmt.Errorf("not enough syncs"))
+				return retry.ExpectedErrorf("not enough syncs")
 			}
 
 			return nil
@@ -458,7 +459,7 @@ func (suite *NTPSuite) TestSyncSwitchTimeservers() {
 			defer suite.clockLock.Unlock()
 
 			if len(suite.clockAdjustments) < 3 {
-				return retry.ExpectedError(fmt.Errorf("not enough syncs"))
+				return retry.ExpectedErrorf("not enough syncs")
 			}
 
 			return nil
diff --git a/internal/pkg/secureboot/tpm2/keys.go b/internal/pkg/secureboot/tpm2/keys.go
index 1c31c77a61..6c3f43fe46 100644
--- a/internal/pkg/secureboot/tpm2/keys.go
+++ b/internal/pkg/secureboot/tpm2/keys.go
@@ -9,6 +9,7 @@ import (
 	"crypto/rsa"
 	"crypto/x509"
 	"encoding/pem"
+	"errors"
 	"fmt"
 	"os"
 
@@ -24,7 +25,7 @@ func ParsePCRSigningPubKey(file string) (*rsa.PublicKey, error) {
 
 	block, _ := pem.Decode(pcrSigningPubKey)
 	if block == nil {
-		return nil, fmt.Errorf("failed to decode pcr signing public key")
+		return nil, errors.New("failed to decode pcr signing public key")
 	}
 
 	// parse rsa public key
@@ -35,7 +36,7 @@ func ParsePCRSigningPubKey(file string) (*rsa.PublicKey, error) {
 
 	tpm2PubKey, ok := tpm2PubKeyAny.(*rsa.PublicKey)
 	if !ok {
-		return nil, fmt.Errorf("failed to cast pcr signing public key to rsa")
+		return nil, errors.New("failed to cast pcr signing public key to rsa")
 	}
 
 	return tpm2PubKey, nil
diff --git a/internal/pkg/secureboot/tpm2/unseal.go b/internal/pkg/secureboot/tpm2/unseal.go
index 3bae51814e..d2216898c6 100644
--- a/internal/pkg/secureboot/tpm2/unseal.go
+++ b/internal/pkg/secureboot/tpm2/unseal.go
@@ -11,6 +11,7 @@ import (
 	"crypto/x509"
 	"encoding/base64"
 	"encoding/hex"
+	"errors"
 	"fmt"
 
 	"github.com/google/go-tpm/tpm2"
@@ -80,7 +81,7 @@ func Unseal(sealed SealedResponse) ([]byte, error) {
 	if !bytes.Equal(createPrimaryResponse.Name.Buffer, srk.Buffer) {
 		// this means the srk name does not match, possibly due to a different TPM or tpm was reset
 		// could also mean the disk was used on a different machine
-		return nil, fmt.Errorf("srk name does not match")
+		return nil, errors.New("srk name does not match")
 	}
 
 	load := tpm2.Load{
@@ -172,7 +173,7 @@ func Unseal(sealed SealedResponse) ([]byte, error) {
 			signature = bank.Sig
 
 			if hex.EncodeToString(pubKeyFingerprint[:]) != bank.PKFP {
-				return nil, fmt.Errorf("certificate fingerprint does not match")
+				return nil, errors.New("certificate fingerprint does not match")
 			}
 
 			break
@@ -180,7 +181,7 @@ func Unseal(sealed SealedResponse) ([]byte, error) {
 	}
 
 	if signature == "" {
-		return nil, fmt.Errorf("signature not found")
+		return nil, errors.New("signature not found")
 	}
 
 	signatureDecoded, err := base64.StdEncoding.DecodeString(signature)
@@ -242,7 +243,7 @@ func Unseal(sealed SealedResponse) ([]byte, error) {
 	}
 
 	if !bytes.Equal(secureBootStatePolicyDigest.Buffer, sealed.PolicyDigest) {
-		return nil, fmt.Errorf("sealing policy digest does not match")
+		return nil, errors.New("sealing policy digest does not match")
 	}
 
 	unsealOp := tpm2.Unseal{
diff --git a/internal/pkg/secureboot/uki/assemble.go b/internal/pkg/secureboot/uki/assemble.go
index f4b823c71c..62286d2392 100644
--- a/internal/pkg/secureboot/uki/assemble.go
+++ b/internal/pkg/secureboot/uki/assemble.go
@@ -6,6 +6,7 @@ package uki
 
 import (
 	"debug/pe"
+	"errors"
 	"fmt"
 	"os"
 	"os/exec"
@@ -30,7 +31,7 @@ func (builder *Builder) assemble() error {
 
 	header, ok := peFile.OptionalHeader.(*pe.OptionalHeader64)
 	if !ok {
-		return fmt.Errorf("failed to get optional header")
+		return errors.New("failed to get optional header")
 	}
 
 	baseVMA := header.ImageBase + uint64(lastSection.VirtualAddress) + uint64(lastSection.VirtualSize)
diff --git a/internal/pkg/secureboot/uki/kernel.go b/internal/pkg/secureboot/uki/kernel.go
index d9f327cdf2..96e7863a00 100644
--- a/internal/pkg/secureboot/uki/kernel.go
+++ b/internal/pkg/secureboot/uki/kernel.go
@@ -7,7 +7,7 @@ package uki
 import (
 	"bytes"
 	"encoding/binary"
-	"fmt"
+	"errors"
 	"os"
 	"strings"
 )
@@ -34,18 +34,18 @@ func DiscoverKernelVersion(kernelPath string) (string, error) {
 
 	// check header magic
 	if string(header[0x202:0x206]) != "HdrS" {
-		return "", fmt.Errorf("invalid kernel image")
+		return "", errors.New("invalid kernel image")
 	}
 
 	setupSects := header[0x1f1]
 	versionOffset := binary.LittleEndian.Uint16(header[0x20e:0x210])
 
 	if versionOffset == 0 {
-		return "", fmt.Errorf("no kernel version")
+		return "", errors.New("no kernel version")
 	}
 
 	if versionOffset > uint16(setupSects)*0x200 {
-		return "", fmt.Errorf("invalid kernel version offset")
+		return "", errors.New("invalid kernel version offset")
 	}
 
 	versionOffset += 0x200
@@ -59,7 +59,7 @@ func DiscoverKernelVersion(kernelPath string) (string, error) {
 
 	idx := bytes.IndexByte(version, 0)
 	if idx == -1 {
-		return "", fmt.Errorf("invalid kernel version")
+		return "", errors.New("invalid kernel version")
 	}
 
 	versionString := string(version[:idx])
diff --git a/internal/pkg/secureboot/uki/sbat.go b/internal/pkg/secureboot/uki/sbat.go
index d4331ad3d2..75fa5a4e1d 100644
--- a/internal/pkg/secureboot/uki/sbat.go
+++ b/internal/pkg/secureboot/uki/sbat.go
@@ -6,7 +6,7 @@ package uki
 
 import (
 	"debug/pe"
-	"fmt"
+	"errors"
 
 	"github.com/siderolabs/talos/internal/pkg/secureboot"
 )
@@ -31,5 +31,5 @@ func GetSBAT(path string) ([]byte, error) {
 		}
 	}
 
-	return nil, fmt.Errorf("could not find SBAT section")
+	return nil, errors.New("could not find SBAT section")
 }
diff --git a/internal/pkg/tui/components/form.go b/internal/pkg/tui/components/form.go
index 818c39780c..2386e9cd0b 100644
--- a/internal/pkg/tui/components/form.go
+++ b/internal/pkg/tui/components/form.go
@@ -5,6 +5,7 @@
 package components
 
 import (
+	"errors"
 	"fmt"
 	"reflect"
 	"strings"
@@ -114,7 +115,7 @@ func (item *Item) createFormItems() ([]tview.Primitive, error) {
 				numColumns := len(tableHeaders)
 
 				if len(data)%numColumns != 0 {
-					return nil, fmt.Errorf("incorrect amount of data provided for the table")
+					return nil, errors.New("incorrect amount of data provided for the table")
 				}
 
 				selected := -1
@@ -139,7 +140,7 @@ func (item *Item) createFormItems() ([]tview.Primitive, error) {
 				dropdown := tview.NewDropDown()
 
 				if len(item.options)%2 != 0 {
-					return nil, fmt.Errorf("wrong amount of arguments for options: should be even amount of key, value pairs")
+					return nil, errors.New("wrong amount of arguments for options: should be even amount of key, value pairs")
 				}
 
 				for i := 0; i < len(item.options); i += 2 {
diff --git a/internal/pkg/tui/installer/installer.go b/internal/pkg/tui/installer/installer.go
index 3937adc3d2..051fb4662c 100644
--- a/internal/pkg/tui/installer/installer.go
+++ b/internal/pkg/tui/installer/installer.go
@@ -7,6 +7,7 @@ package installer
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"strings"
 
@@ -372,7 +373,7 @@ func (installer *Installer) apply(conn *Connection) error {
 		)
 
 		if conn.dryRun {
-			err = fmt.Errorf("skipped in dry run")
+			err = errors.New("skipped in dry run")
 		}
 
 		s.Stop(err == nil)
diff --git a/pkg/archiver/untar.go b/pkg/archiver/untar.go
index 74ad8c051f..82beec33c2 100644
--- a/pkg/archiver/untar.go
+++ b/pkg/archiver/untar.go
@@ -7,6 +7,7 @@ package archiver
 import (
 	"archive/tar"
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -39,7 +40,7 @@ func Untar(ctx context.Context, r io.Reader, rootPath string) error {
 
 		hdrPath := safepath.CleanPath(hdr.Name)
 		if hdrPath == "" {
-			return fmt.Errorf("empty tar header path")
+			return errors.New("empty tar header path")
 		}
 
 		path := filepath.Join(rootPath, hdrPath)
diff --git a/pkg/cluster/bootstrap.go b/pkg/cluster/bootstrap.go
index 59f91367c8..b053240e4c 100644
--- a/pkg/cluster/bootstrap.go
+++ b/pkg/cluster/bootstrap.go
@@ -42,7 +42,7 @@ func (s *APIBootstrapper) Bootstrap(ctx context.Context, out io.Writer) error {
 	controlPlaneNodes := s.NodesByType(machine.TypeControlPlane)
 
 	if len(controlPlaneNodes) == 0 {
-		return fmt.Errorf("no control plane nodes to bootstrap")
+		return errors.New("no control plane nodes to bootstrap")
 	}
 
 	sort.Slice(controlPlaneNodes, func(i, j int) bool {
diff --git a/pkg/cluster/check/nodes.go b/pkg/cluster/check/nodes.go
index 975ecdae1e..eab66b41d8 100644
--- a/pkg/cluster/check/nodes.go
+++ b/pkg/cluster/check/nodes.go
@@ -56,7 +56,7 @@ func AllNodesMemorySizes(ctx context.Context, cluster ClusterInfo) error {
 
 	for _, msg := range resp.Messages {
 		if msg.Metadata == nil {
-			return fmt.Errorf("no metadata in the response")
+			return errors.New("no metadata in the response")
 		}
 
 		hostname := msg.Metadata.Hostname
@@ -205,7 +205,7 @@ type mountData struct {
 }
 
 // ErrOldTalosVersion is returned when the node is running an old version of Talos.
-var ErrOldTalosVersion = fmt.Errorf("old Talos version")
+var ErrOldTalosVersion = errors.New("old Talos version")
 
 func getEphemeralPartitionData(ctx context.Context, state state.State, nodeIP string) (mountData, error) {
 	items, err := safe.StateListAll[*runtime.MountStatus](client.WithNode(ctx, nodeIP), state)
@@ -244,7 +244,7 @@ func getNodesMounts(ctx context.Context, cl *client.Client) (map[string][]mntDat
 	}
 
 	if len(diskResp.Messages) == 0 {
-		return nil, fmt.Errorf("no nodes with mounts found")
+		return nil, errors.New("no nodes with mounts found")
 	}
 
 	nodesMnts := map[string][]mntData{}
@@ -252,7 +252,7 @@ func getNodesMounts(ctx context.Context, cl *client.Client) (map[string][]mntDat
 	for _, msg := range diskResp.Messages {
 		switch {
 		case msg.Metadata == nil:
-			return nil, fmt.Errorf("no metadata in response")
+			return nil, errors.New("no metadata in response")
 		case len(msg.GetStats()) == 0:
 			return nil, fmt.Errorf("no mounts found for node %q", msg.Metadata.Hostname)
 		}
diff --git a/pkg/cluster/check/service.go b/pkg/cluster/check/service.go
index 157a7ca76d..37a3dac403 100644
--- a/pkg/cluster/check/service.go
+++ b/pkg/cluster/check/service.go
@@ -7,6 +7,7 @@ package check
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"sort"
 
@@ -18,7 +19,7 @@ import (
 )
 
 // ErrServiceNotFound is an error that indicates that a service was not found.
-var ErrServiceNotFound = fmt.Errorf("service not found")
+var ErrServiceNotFound = errors.New("service not found")
 
 // ServiceStateAssertion checks whether service reached some specified state.
 func ServiceStateAssertion(ctx context.Context, cl ClusterInfo, service string, states ...string) error {
diff --git a/pkg/cluster/kubernetes/detect.go b/pkg/cluster/kubernetes/detect.go
index efe4b20b05..842f3d1482 100644
--- a/pkg/cluster/kubernetes/detect.go
+++ b/pkg/cluster/kubernetes/detect.go
@@ -6,6 +6,7 @@ package kubernetes
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"strings"
 
@@ -66,7 +67,7 @@ func DetectLowestVersion(ctx context.Context, cluster UpgradeProvider, options U
 	}
 
 	if version == nil {
-		return "", fmt.Errorf("failed to detect lowest Kubernetes version")
+		return "", errors.New("failed to detect lowest Kubernetes version")
 	}
 
 	return version.String(), nil
diff --git a/pkg/cluster/kubernetes/kubelet.go b/pkg/cluster/kubernetes/kubelet.go
index 14904ef53e..3c25b81f9a 100644
--- a/pkg/cluster/kubernetes/kubelet.go
+++ b/pkg/cluster/kubernetes/kubelet.go
@@ -85,7 +85,7 @@ func upgradeKubeletOnNode(ctx context.Context, cluster UpgradeProvider, options
 	}
 
 	if !initialService.TypedSpec().Running || !initialService.TypedSpec().Healthy {
-		return fmt.Errorf("kubelet is not healthy")
+		return errors.New("kubelet is not healthy")
 	}
 
 	// find out current kubelet version, as the machine config might have a missing image field,
@@ -253,12 +253,10 @@ func checkNodeKubeletVersion(ctx context.Context, cluster UpgradeProvider, nodeT
 		nodeFound = true
 
 		if node.Status.NodeInfo.KubeletVersion != version {
-			return retry.ExpectedError(
-				fmt.Errorf(
-					"node version mismatch: got %q, expected %q",
-					node.Status.NodeInfo.KubeletVersion,
-					version,
-				),
+			return retry.ExpectedErrorf(
+				"node version mismatch: got %q, expected %q",
+				node.Status.NodeInfo.KubeletVersion,
+				version,
 			)
 		}
 
@@ -277,14 +275,14 @@ func checkNodeKubeletVersion(ctx context.Context, cluster UpgradeProvider, nodeT
 		}
 
 		if !ready {
-			return retry.ExpectedError(fmt.Errorf("node is not ready"))
+			return retry.ExpectedErrorf("node is not ready")
 		}
 
 		break
 	}
 
 	if !nodeFound {
-		return retry.ExpectedError(fmt.Errorf("node %q not found", nodeToCheck))
+		return retry.ExpectedErrorf("node %q not found", nodeToCheck)
 	}
 
 	return nil
diff --git a/pkg/cluster/kubernetes/patch.go b/pkg/cluster/kubernetes/patch.go
index ccab07201c..e731c25f1e 100644
--- a/pkg/cluster/kubernetes/patch.go
+++ b/pkg/cluster/kubernetes/patch.go
@@ -6,6 +6,7 @@ package kubernetes
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
 	"github.com/cosi-project/runtime/pkg/safe"
@@ -34,7 +35,7 @@ func patchNodeConfig(ctx context.Context, cluster UpgradeProvider, node string,
 
 	cfg := mc.Container().RawV1Alpha1()
 	if cfg == nil {
-		return fmt.Errorf("config is not v1alpha1 config")
+		return errors.New("config is not v1alpha1 config")
 	}
 
 	if err = patchFunc(cfg); err != nil {
diff --git a/pkg/cluster/kubernetes/talos_managed.go b/pkg/cluster/kubernetes/talos_managed.go
index e2149412d6..d89e7f4a0e 100644
--- a/pkg/cluster/kubernetes/talos_managed.go
+++ b/pkg/cluster/kubernetes/talos_managed.go
@@ -61,7 +61,7 @@ func Upgrade(ctx context.Context, cluster UpgradeProvider, options UpgradeOption
 	}
 
 	if len(options.controlPlaneNodes) == 0 {
-		return fmt.Errorf("no controlplane nodes discovered")
+		return errors.New("no controlplane nodes discovered")
 	}
 
 	options.Log("discovered controlplane nodes %q", options.controlPlaneNodes)
@@ -302,7 +302,7 @@ func upgradeStaticPodOnNode(ctx context.Context, cluster UpgradeProvider, option
 	return nil
 }
 
-var errUpdateSkipped = fmt.Errorf("update skipped")
+var errUpdateSkipped = errors.New("update skipped")
 
 //nolint:gocyclo,cyclop
 func upgradeStaticPodPatcher(options UpgradeOptions, service string, configResource resource.Resource) func(config *v1alpha1config.Config) error {
diff --git a/pkg/cluster/local.go b/pkg/cluster/local.go
index ddfa86cda9..f44cafa41a 100644
--- a/pkg/cluster/local.go
+++ b/pkg/cluster/local.go
@@ -6,7 +6,7 @@ package cluster
 
 import (
 	"context"
-	"fmt"
+	"errors"
 
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
@@ -26,7 +26,7 @@ type LocalClientProvider struct {
 // Client implements ClientProvider interface.
 func (c *LocalClientProvider) Client(endpoints ...string) (*client.Client, error) {
 	if len(endpoints) > 0 {
-		return nil, fmt.Errorf("custom endpoints not supported with LocalClientProvider")
+		return nil, errors.New("custom endpoints not supported with LocalClientProvider")
 	}
 
 	var err error
diff --git a/pkg/cluster/sonobuoy/sonobuoy.go b/pkg/cluster/sonobuoy/sonobuoy.go
index 7a2b9e24b6..705f0ab6bd 100644
--- a/pkg/cluster/sonobuoy/sonobuoy.go
+++ b/pkg/cluster/sonobuoy/sonobuoy.go
@@ -9,6 +9,7 @@ import (
 	"archive/tar"
 	"compress/gzip"
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -237,7 +238,7 @@ func Run(ctx context.Context, cluster cluster.K8sProvider, options *Options) err
 	}
 
 	if !e2ePassed {
-		return fmt.Errorf("missing e2e plugin status")
+		return errors.New("missing e2e plugin status")
 	}
 
 	if options.RetrieveResults {
@@ -250,7 +251,7 @@ func Run(ctx context.Context, cluster cluster.K8sProvider, options *Options) err
 		}
 
 		if resultR == nil {
-			return fmt.Errorf("no result reader")
+			return errors.New("no result reader")
 		}
 
 		gzipR, err := gzip.NewReader(resultR)
diff --git a/pkg/download/download.go b/pkg/download/download.go
index c06ca607c7..d9e28658bc 100644
--- a/pkg/download/download.go
+++ b/pkg/download/download.go
@@ -221,7 +221,7 @@ func download(req *http.Request, options *downloadOptions) (data []byte, err err
 
 		localTCPAddr, tcperr := net.ResolveTCPAddr("tcp", ":"+strconv.Itoa(port))
 		if tcperr != nil {
-			return nil, retry.ExpectedError(fmt.Errorf("resolving source tcp address: %s", tcperr.Error()))
+			return nil, retry.ExpectedErrorf("resolving source tcp address: %s", tcperr.Error())
 		}
 
 		d := (&net.Dialer{
@@ -255,12 +255,12 @@ func download(req *http.Request, options *downloadOptions) (data []byte, err err
 		data, _ = io.ReadAll(io.LimitReader(resp.Body, 32)) //nolint:errcheck // as error already happened, we don't care much about this one
 		data = bytes.ToValidUTF8(data, nil)
 
-		return data, retry.ExpectedError(fmt.Errorf("failed to download config, status code %d, body %q", resp.StatusCode, string(data)))
+		return data, retry.ExpectedErrorf("failed to download config, status code %d, body %q", resp.StatusCode, string(data))
 	}
 
 	data, err = io.ReadAll(resp.Body)
 	if err != nil {
-		return data, retry.ExpectedError(fmt.Errorf("read config: %s", err.Error()))
+		return data, retry.ExpectedErrorf("read config: %s", err.Error())
 	}
 
 	if len(data) == 0 && options.ErrorOnEmptyResponse != nil {
diff --git a/pkg/download/download_test.go b/pkg/download/download_test.go
index da0169aa29..0c0064c358 100644
--- a/pkg/download/download_test.go
+++ b/pkg/download/download_test.go
@@ -6,6 +6,7 @@ package download_test
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net/http"
 	"net/http/httptest"
@@ -97,13 +98,13 @@ func TestDownload(t *testing.T) {
 		{
 			name:          "empty error",
 			path:          "/empty",
-			opts:          []download.Option{download.WithErrorOnEmptyResponse(fmt.Errorf("empty response"))},
+			opts:          []download.Option{download.WithErrorOnEmptyResponse(errors.New("empty response"))},
 			expectedError: "empty response",
 		},
 		{
 			name:          "not found error",
 			path:          "/404",
-			opts:          []download.Option{download.WithErrorOnNotFound(fmt.Errorf("gone forever"))},
+			opts:          []download.Option{download.WithErrorOnNotFound(errors.New("gone forever"))},
 			expectedError: "gone forever",
 		},
 		{
diff --git a/pkg/follow/follow.go b/pkg/follow/follow.go
index 58d732931c..12c3b8341a 100644
--- a/pkg/follow/follow.go
+++ b/pkg/follow/follow.go
@@ -7,6 +7,7 @@ package follow
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -160,7 +161,7 @@ func (r *Reader) notify() {
 				}
 			case fsnotify.Remove:
 				select {
-				case r.notifyCh <- fmt.Errorf("file was removed while watching"):
+				case r.notifyCh <- errors.New("file was removed while watching"):
 				case <-r.ctx.Done():
 				}
 
diff --git a/pkg/grpc/gen/remote.go b/pkg/grpc/gen/remote.go
index d7feac86ca..1797c65803 100644
--- a/pkg/grpc/gen/remote.go
+++ b/pkg/grpc/gen/remote.go
@@ -6,6 +6,7 @@ package gen
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"strings"
 	"time"
@@ -29,7 +30,7 @@ type RemoteGenerator struct {
 // NewRemoteGenerator initializes a RemoteGenerator with a preconfigured grpc.ClientConn.
 func NewRemoteGenerator(token string, endpoints []string, ca *x509.PEMEncodedCertificateAndKey) (g *RemoteGenerator, err error) {
 	if len(endpoints) == 0 {
-		return nil, fmt.Errorf("at least one root of trust endpoint is required")
+		return nil, errors.New("at least one root of trust endpoint is required")
 	}
 
 	endpoints = resolver.EnsureEndpointsHavePorts(endpoints, constants.TrustdPort)
diff --git a/pkg/imager/profile/input.go b/pkg/imager/profile/input.go
index 84a689fa37..67f84ee9f8 100644
--- a/pkg/imager/profile/input.go
+++ b/pkg/imager/profile/input.go
@@ -6,6 +6,7 @@ package profile
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -119,7 +120,7 @@ func (key SigningKey) GetSigner(ctx context.Context) (measure.RSAKey, error) {
 	case key.AzureVaultURL != "" && key.AzureKeyID != "":
 		return azure.NewPCRSigner(ctx, key.AzureVaultURL, key.AzureKeyID, key.AzureKeyVersion)
 	default:
-		return nil, fmt.Errorf("unsupported PCR signer")
+		return nil, errors.New("unsupported PCR signer")
 	}
 }
 
@@ -131,7 +132,7 @@ func (keyAndCert SigningKeyAndCertificate) GetSigner(ctx context.Context) (pesig
 	case keyAndCert.AzureVaultURL != "" && keyAndCert.AzureCertificateID != "":
 		return azure.NewSecureBootSigner(ctx, keyAndCert.AzureVaultURL, keyAndCert.AzureCertificateID, keyAndCert.AzureCertificateID)
 	default:
-		return nil, fmt.Errorf("unsupported PCR signer")
+		return nil, errors.New("unsupported PCR signer")
 	}
 }
 
@@ -223,7 +224,7 @@ func fileExists(path string) bool {
 // Pull the container asset to the path.
 func (c *ContainerAsset) Pull(ctx context.Context, arch string, printf func(string, ...any)) (v1.Image, error) {
 	if c.TarballPath != "" {
-		return nil, fmt.Errorf("pulling tarball container image is not supported")
+		return nil, errors.New("pulling tarball container image is not supported")
 	}
 
 	if c.OCIPath != "" {
diff --git a/pkg/imager/profile/internal/signer/azure/azure.go b/pkg/imager/profile/internal/signer/azure/azure.go
index a501818593..c131574fc0 100644
--- a/pkg/imager/profile/internal/signer/azure/azure.go
+++ b/pkg/imager/profile/internal/signer/azure/azure.go
@@ -7,6 +7,7 @@ package azure
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"os"
 	"strings"
@@ -115,7 +116,7 @@ func getAzureCredential(method authenticationMethod) (azureCredential, error) {
 	case unknownAuthenticationMethod:
 		break
 	default:
-		return nil, fmt.Errorf("you should never reach this")
+		return nil, errors.New("you should never reach this")
 	}
 
 	envCreds, err := azidentity.NewEnvironmentCredential(&azidentity.EnvironmentCredentialOptions{ClientOptions: clientOpts})
diff --git a/pkg/imager/profile/internal/signer/azure/pcr.go b/pkg/imager/profile/internal/signer/azure/pcr.go
index e96c066331..28c0a868cf 100644
--- a/pkg/imager/profile/internal/signer/azure/pcr.go
+++ b/pkg/imager/profile/internal/signer/azure/pcr.go
@@ -86,21 +86,21 @@ func NewPCRSigner(ctx context.Context, vaultURL, keyID, keyVersion string) (*Key
 	}
 
 	if keyResponse.Key.Kty == nil {
-		return nil, fmt.Errorf("key type is nil")
+		return nil, errors.New("key type is nil")
 	}
 
 	switch *keyResponse.Key.Kty { //nolint:exhaustive
 	case azkeys.KeyTypeRSA, azkeys.KeyTypeRSAHSM:
 		// expected, continue
 	default:
-		return nil, fmt.Errorf("key type is not RSA")
+		return nil, errors.New("key type is not RSA")
 	}
 
 	var publicKey rsa.PublicKey
 
 	// N = modulus
 	if len(keyResponse.Key.N) == 0 {
-		return nil, fmt.Errorf("property N is empty")
+		return nil, errors.New("property N is empty")
 	}
 
 	publicKey.N = &big.Int{}
@@ -108,7 +108,7 @@ func NewPCRSigner(ctx context.Context, vaultURL, keyID, keyVersion string) (*Key
 
 	// e = public exponent
 	if len(keyResponse.Key.E) == 0 {
-		return nil, fmt.Errorf("property e is empty")
+		return nil, errors.New("property e is empty")
 	}
 
 	publicKey.E = int(big.NewInt(0).SetBytes(keyResponse.Key.E).Uint64())
diff --git a/pkg/imager/profile/internal/signer/file/pcr.go b/pkg/imager/profile/internal/signer/file/pcr.go
index 3815ea6389..8a8b58bd63 100644
--- a/pkg/imager/profile/internal/signer/file/pcr.go
+++ b/pkg/imager/profile/internal/signer/file/pcr.go
@@ -10,6 +10,7 @@ import (
 	"crypto/rsa"
 	"crypto/x509"
 	"encoding/pem"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -50,7 +51,7 @@ func NewPCRSigner(keyPath string) (*PCRSigner, error) {
 	// convert private key to rsa.PrivateKey
 	rsaPrivateKeyBlock, _ := pem.Decode(keyData)
 	if rsaPrivateKeyBlock == nil {
-		return nil, fmt.Errorf("failed to decode private key")
+		return nil, errors.New("failed to decode private key")
 	}
 
 	rsaKey, err := x509.ParsePKCS1PrivateKey(rsaPrivateKeyBlock.Bytes)
diff --git a/pkg/imager/profile/internal/signer/file/secureboot.go b/pkg/imager/profile/internal/signer/file/secureboot.go
index c8baaf73bc..322d223563 100644
--- a/pkg/imager/profile/internal/signer/file/secureboot.go
+++ b/pkg/imager/profile/internal/signer/file/secureboot.go
@@ -9,6 +9,7 @@ import (
 	"crypto/rsa"
 	"crypto/x509"
 	"encoding/pem"
+	"errors"
 	"fmt"
 	"os"
 
@@ -44,7 +45,7 @@ func NewSecureBootSigner(certPath, keyPath string) (*SecureBootSigner, error) {
 	// convert private key to rsa.PrivateKey
 	rsaPrivateKeyBlock, _ := pem.Decode(keyData)
 	if rsaPrivateKeyBlock == nil {
-		return nil, fmt.Errorf("failed to decode private key")
+		return nil, errors.New("failed to decode private key")
 	}
 
 	rsaKey, err := x509.ParsePKCS1PrivateKey(rsaPrivateKeyBlock.Bytes)
@@ -59,7 +60,7 @@ func NewSecureBootSigner(certPath, keyPath string) (*SecureBootSigner, error) {
 
 	certBlock, _ := pem.Decode(certData)
 	if certBlock == nil {
-		return nil, fmt.Errorf("failed to decode certificate")
+		return nil, errors.New("failed to decode certificate")
 	}
 
 	cert, err := x509.ParseCertificate(certBlock.Bytes)
diff --git a/pkg/imager/profile/profile.go b/pkg/imager/profile/profile.go
index b4c483b148..fdafc8a925 100644
--- a/pkg/imager/profile/profile.go
+++ b/pkg/imager/profile/profile.go
@@ -6,6 +6,7 @@
 package profile
 
 import (
+	"errors"
 	"fmt"
 	"io"
 
@@ -62,18 +63,18 @@ func (p *Profile) Validate() error {
 	}
 
 	if p.Platform == "" {
-		return fmt.Errorf("platform is required")
+		return errors.New("platform is required")
 	}
 
 	if p.Board != "" {
 		if !(p.Arch == arm64 && p.Platform == "metal") {
-			return fmt.Errorf("board is only supported for metal arm64")
+			return errors.New("board is only supported for metal arm64")
 		}
 	}
 
 	switch p.Output.Kind {
 	case OutKindUnknown:
-		return fmt.Errorf("unknown output kind")
+		return errors.New("unknown output kind")
 	case OutKindISO:
 		// ISO supports all kinds of customization
 	case OutKindCmdline:
@@ -81,7 +82,7 @@ func (p *Profile) Validate() error {
 	case OutKindImage:
 		// Image supports all kinds of customization
 		if p.Output.ImageOptions.DiskSize == 0 {
-			return fmt.Errorf("disk size is required for image output")
+			return errors.New("disk size is required for image output")
 		}
 	case OutKindInstaller:
 		if !p.SecureBootEnabled() && len(p.Customization.ExtraKernelArgs) > 0 {
diff --git a/pkg/kubernetes/kubernetes.go b/pkg/kubernetes/kubernetes.go
index dae999f042..6be8f31957 100644
--- a/pkg/kubernetes/kubernetes.go
+++ b/pkg/kubernetes/kubernetes.go
@@ -6,7 +6,6 @@ package kubernetes
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"log"
 	"net/url"
@@ -294,6 +293,6 @@ func (h *Client) waitForPodDeleted(ctx context.Context, p *corev1.Pod) error {
 			return nil
 		}
 
-		return retry.ExpectedError(errors.New("pod is still running on the node"))
+		return retry.ExpectedErrorf("pod is still running on the node")
 	})
 }
diff --git a/pkg/machinery/client/client.go b/pkg/machinery/client/client.go
index 304fd0184e..afb19c85c3 100644
--- a/pkg/machinery/client/client.go
+++ b/pkg/machinery/client/client.go
@@ -79,7 +79,7 @@ func (c *Client) resolveConfigContext() error {
 	c.options.configContext, ok = c.options.config.Contexts[c.options.config.Context]
 	if !ok {
 		if c.options.config.Context == "" && len(c.options.config.Contexts) == 0 {
-			return fmt.Errorf("talos config file is empty")
+			return errors.New("talos config file is empty")
 		}
 
 		return fmt.Errorf("default context %q not found in config", c.options.config.Context)
diff --git a/pkg/machinery/client/config/path.go b/pkg/machinery/client/config/path.go
index 516d62da2d..3ebeae8aa9 100644
--- a/pkg/machinery/client/config/path.go
+++ b/pkg/machinery/client/config/path.go
@@ -5,7 +5,7 @@
 package config
 
 import (
-	"fmt"
+	"errors"
 	"os"
 	"path/filepath"
 
@@ -84,7 +84,7 @@ func firstValidPath() (Path, error) {
 	}
 
 	if firstWriteAllowed.Path == "" {
-		return Path{}, fmt.Errorf("no valid config paths found")
+		return Path{}, errors.New("no valid config paths found")
 	}
 
 	err = ensure(firstWriteAllowed.Path)
diff --git a/pkg/machinery/client/connection.go b/pkg/machinery/client/connection.go
index 19a88f41c5..94d5c11a7a 100644
--- a/pkg/machinery/client/connection.go
+++ b/pkg/machinery/client/connection.go
@@ -9,6 +9,7 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/base64"
+	"errors"
 	"fmt"
 	"net"
 	"net/url"
@@ -117,7 +118,7 @@ func buildTLSConfig(configContext *clientconfig.Context) (*tls.Config, error) {
 		tlsConfig.RootCAs = x509.NewCertPool()
 
 		if ok := tlsConfig.RootCAs.AppendCertsFromPEM(caBytes); !ok {
-			return nil, fmt.Errorf("failed to append CA certificate to RootCAs pool")
+			return nil, errors.New("failed to append CA certificate to RootCAs pool")
 		}
 	}
 
diff --git a/pkg/machinery/client/events.go b/pkg/machinery/client/events.go
index 3179bc335d..6d50ff7b20 100644
--- a/pkg/machinery/client/events.go
+++ b/pkg/machinery/client/events.go
@@ -6,6 +6,7 @@ package client
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"log"
@@ -20,7 +21,7 @@ import (
 )
 
 // ErrEventNotSupported is returned from the event decoder when we encounter an unknown event.
-var ErrEventNotSupported = fmt.Errorf("event is not supported")
+var ErrEventNotSupported = errors.New("event is not supported")
 
 // EventsOptionFunc defines the options for the Events API.
 type EventsOptionFunc func(opts *machineapi.EventsRequest)
@@ -186,7 +187,7 @@ func (c *Client) EventsWatchV2(ctx context.Context, ch chan<- EventResult, opts
 					if event.GetMetadata().GetStatus() != nil {
 						mdErr = status.FromProto(event.GetMetadata().GetStatus()).Err()
 					} else {
-						mdErr = fmt.Errorf(event.GetMetadata().GetError())
+						mdErr = errors.New(event.GetMetadata().GetError())
 					}
 
 					return fmt.Errorf("%s: %w", event.GetMetadata().GetHostname(), mdErr)
diff --git a/pkg/machinery/config/bundle/bundle.go b/pkg/machinery/config/bundle/bundle.go
index 5135da9eff..ca4fff0aac 100644
--- a/pkg/machinery/config/bundle/bundle.go
+++ b/pkg/machinery/config/bundle/bundle.go
@@ -6,6 +6,7 @@
 package bundle
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -45,7 +46,7 @@ func NewBundle(opts ...Option) (*Bundle, error) {
 	// Configs already exist, we'll pull them in.
 	if options.ExistingConfigs != "" {
 		if options.InputOptions != nil {
-			return bundle, fmt.Errorf("both existing config path and input options specified")
+			return bundle, errors.New("both existing config path and input options specified")
 		}
 
 		// Pull existing machine configs of each type
@@ -103,7 +104,7 @@ func NewBundle(opts ...Option) (*Bundle, error) {
 	}
 
 	if options.InputOptions == nil {
-		return nil, fmt.Errorf("no WithInputOptions is defined")
+		return nil, errors.New("no WithInputOptions is defined")
 	}
 
 	input, err := generate.NewInput(
diff --git a/pkg/machinery/config/configloader/internal/decoder/decoder.go b/pkg/machinery/config/configloader/internal/decoder/decoder.go
index 70d67d2065..bbfa712c7a 100644
--- a/pkg/machinery/config/configloader/internal/decoder/decoder.go
+++ b/pkg/machinery/config/configloader/internal/decoder/decoder.go
@@ -74,7 +74,7 @@ func parse(r io.Reader) (decoded []config.Document, err error) {
 		}
 
 		if manifests.Kind != yaml.DocumentNode {
-			return nil, fmt.Errorf("expected a document")
+			return nil, errors.New("expected a document")
 		}
 
 		for _, manifest := range manifests.Content {
@@ -100,7 +100,7 @@ func decode(manifest *yaml.Node) (target config.Document, err error) {
 		switch node.Value {
 		case ManifestKindKey:
 			if len(manifest.Content) < i+1 {
-				return nil, fmt.Errorf("missing manifest content")
+				return nil, errors.New("missing manifest content")
 			}
 
 			if err = manifest.Content[i+1].Decode(&kind); err != nil {
@@ -108,7 +108,7 @@ func decode(manifest *yaml.Node) (target config.Document, err error) {
 			}
 		case ManifestAPIVersionKey:
 			if len(manifest.Content) < i+1 {
-				return nil, fmt.Errorf("missing manifest content")
+				return nil, errors.New("missing manifest content")
 			}
 
 			if err = manifest.Content[i+1].Decode(&version); err != nil {
diff --git a/pkg/machinery/config/configloader/internal/decoder/unknown_keys.go b/pkg/machinery/config/configloader/internal/decoder/unknown_keys.go
index 1e37ab08c6..8f86d54c01 100644
--- a/pkg/machinery/config/configloader/internal/decoder/unknown_keys.go
+++ b/pkg/machinery/config/configloader/internal/decoder/unknown_keys.go
@@ -5,6 +5,7 @@
 package decoder
 
 import (
+	"errors"
 	"fmt"
 	"reflect"
 	"strings"
@@ -111,7 +112,7 @@ func internalCheckUnknownKeys(typ reflect.Type, spec *yaml.Node) (unknown interf
 			keyNode := spec.Content[i]
 
 			if keyNode.Kind != yaml.ScalarNode {
-				return unknown, fmt.Errorf("unexpected mapping key type")
+				return unknown, errors.New("unexpected mapping key type")
 			}
 
 			key := keyNode.Value
diff --git a/pkg/machinery/config/configpatcher/json6902.go b/pkg/machinery/config/configpatcher/json6902.go
index 9da23f08d0..1c0c0e62d8 100644
--- a/pkg/machinery/config/configpatcher/json6902.go
+++ b/pkg/machinery/config/configpatcher/json6902.go
@@ -6,6 +6,7 @@ package configpatcher
 
 import (
 	"bytes"
+	"errors"
 	"fmt"
 	"io"
 
@@ -23,7 +24,7 @@ func JSON6902(talosMachineConfig []byte, patch jsonpatch.Patch) ([]byte, error)
 	}
 
 	if numDocuments != 1 {
-		return nil, fmt.Errorf("JSON6902 patches are not supported for multi-document machine configuration")
+		return nil, errors.New("JSON6902 patches are not supported for multi-document machine configuration")
 	}
 
 	// apply JSON patch
@@ -63,7 +64,7 @@ func countYAMLDocuments(talosMachineConfig []byte) (int, error) {
 		}
 
 		if docs.Kind != yaml.DocumentNode {
-			return 0, fmt.Errorf("talos machine config is not a yaml document")
+			return 0, errors.New("talos machine config is not a yaml document")
 		}
 
 		numDocuments++
diff --git a/pkg/machinery/config/container/container.go b/pkg/machinery/config/container/container.go
index ddb754dff9..36d9288d84 100644
--- a/pkg/machinery/config/container/container.go
+++ b/pkg/machinery/config/container/container.go
@@ -7,6 +7,7 @@ package container
 
 import (
 	"bytes"
+	"errors"
 	"fmt"
 	"slices"
 
@@ -42,7 +43,7 @@ func New(documents ...config.Document) (*Container, error) {
 		switch d := doc.(type) {
 		case *v1alpha1.Config:
 			if container.v1alpha1Config != nil {
-				return nil, fmt.Errorf("duplicate v1alpha1.Config")
+				return nil, errors.New("duplicate v1alpha1.Config")
 			}
 
 			container.v1alpha1Config = d
diff --git a/pkg/machinery/config/encoder/markdown.go b/pkg/machinery/config/encoder/markdown.go
index 3427ecfffb..c4968c37e2 100644
--- a/pkg/machinery/config/encoder/markdown.go
+++ b/pkg/machinery/config/encoder/markdown.go
@@ -7,6 +7,7 @@ package encoder
 import (
 	"bytes"
 	_ "embed"
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -68,7 +69,7 @@ func (fd *FileDoc) Encode(root *Doc, frontmatter func(title, description string)
 func (fd *FileDoc) Write(path string, frontmatter func(title, description string) string) error {
 	if stat, err := os.Stat(path); !os.IsNotExist(err) {
 		if !stat.IsDir() {
-			return fmt.Errorf("destination path should be a directory")
+			return errors.New("destination path should be a directory")
 		}
 	} else {
 		if err := os.MkdirAll(path, 0o777); err != nil {
diff --git a/pkg/machinery/config/generate/secrets/bundle.go b/pkg/machinery/config/generate/secrets/bundle.go
index 7925925b26..08d1acbd30 100644
--- a/pkg/machinery/config/generate/secrets/bundle.go
+++ b/pkg/machinery/config/generate/secrets/bundle.go
@@ -6,6 +6,7 @@ package secrets
 
 import (
 	"encoding/base64"
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -103,7 +104,7 @@ func NewBundleFromKubernetesPKI(pkiDir, bootstrapToken string, versionContract *
 
 	aggregatorCAFound := err == nil
 	if aggregatorCAFound && !versionContract.SupportsAggregatorCA() {
-		return nil, fmt.Errorf("aggregator CA found in pki dir but is not supported by the requested version")
+		return nil, errors.New("aggregator CA found in pki dir but is not supported by the requested version")
 	}
 
 	if versionContract.SupportsAggregatorCA() {
@@ -123,7 +124,7 @@ func NewBundleFromKubernetesPKI(pkiDir, bootstrapToken string, versionContract *
 
 	saKeyFound := err == nil
 	if saKeyFound && !versionContract.SupportsServiceAccount() {
-		return nil, fmt.Errorf("service account key found in pki dir but is not supported by the requested version")
+		return nil, errors.New("service account key found in pki dir but is not supported by the requested version")
 	}
 
 	if versionContract.SupportsServiceAccount() {
diff --git a/pkg/machinery/config/types/extensionservicesconfig/extension_services_config.go b/pkg/machinery/config/types/extensionservicesconfig/extension_services_config.go
index 421d6a2837..87d9acf3e7 100644
--- a/pkg/machinery/config/types/extensionservicesconfig/extension_services_config.go
+++ b/pkg/machinery/config/types/extensionservicesconfig/extension_services_config.go
@@ -6,6 +6,7 @@
 package extensionservicesconfig
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/siderolabs/gen/xslices"
@@ -75,12 +76,12 @@ func (e *V1Alpha1) Clone() config.Document {
 // Validate implements config.Validatator interface.
 func (e *V1Alpha1) Validate(validation.RuntimeMode, ...validation.Option) ([]string, error) {
 	if len(e.Config) == 0 {
-		return nil, fmt.Errorf("no extensions config found")
+		return nil, errors.New("no extensions config found")
 	}
 
 	for _, ext := range e.Config {
 		if ext.ExtensionName == "" {
-			return nil, fmt.Errorf("extension name is required")
+			return nil, errors.New("extension name is required")
 		}
 
 		if len(ext.ExtensionServiceConfigFiles) == 0 {
diff --git a/pkg/machinery/config/types/network/rule_config.go b/pkg/machinery/config/types/network/rule_config.go
index 9ca0b25419..084ab7f586 100644
--- a/pkg/machinery/config/types/network/rule_config.go
+++ b/pkg/machinery/config/types/network/rule_config.go
@@ -7,6 +7,7 @@ package network
 //docgen:jsonschema
 
 import (
+	"errors"
 	"fmt"
 	"net/netip"
 
@@ -171,11 +172,11 @@ func (s *RuleConfigV1Alpha1) Clone() config.Document {
 // Validate implements config.Validator interface.
 func (s *RuleConfigV1Alpha1) Validate(validation.RuntimeMode, ...validation.Option) ([]string, error) {
 	if s.MetaName == "" {
-		return nil, fmt.Errorf("name is required")
+		return nil, errors.New("name is required")
 	}
 
 	if len(s.PortSelector.Ports) == 0 {
-		return nil, fmt.Errorf("portSelector.ports is required")
+		return nil, errors.New("portSelector.ports is required")
 	}
 
 	if err := s.PortSelector.Ports.Validate(); err != nil {
diff --git a/pkg/machinery/config/types/runtime/kmsg_log.go b/pkg/machinery/config/types/runtime/kmsg_log.go
index 44de631dee..70deb5a4c3 100644
--- a/pkg/machinery/config/types/runtime/kmsg_log.go
+++ b/pkg/machinery/config/types/runtime/kmsg_log.go
@@ -7,7 +7,7 @@ package runtime
 //docgen:jsonschema
 
 import (
-	"fmt"
+	"errors"
 	"net/url"
 
 	"github.com/siderolabs/gen/ensure"
@@ -111,29 +111,29 @@ func (s *KmsgLogV1Alpha1) KmsgLogURLs() []*url.URL {
 // Validate implements config.Validator interface.
 func (s *KmsgLogV1Alpha1) Validate(validation.RuntimeMode, ...validation.Option) ([]string, error) {
 	if s.MetaName == "" {
-		return nil, fmt.Errorf("name is required")
+		return nil, errors.New("name is required")
 	}
 
 	if s.KmsgLogURL.URL == nil {
-		return nil, fmt.Errorf("url is required")
+		return nil, errors.New("url is required")
 	}
 
 	switch s.KmsgLogURL.URL.Scheme {
 	case "tcp":
 	case "udp":
 	default:
-		return nil, fmt.Errorf("url scheme must be tcp:// or udp://")
+		return nil, errors.New("url scheme must be tcp:// or udp://")
 	}
 
 	switch s.KmsgLogURL.URL.Path {
 	case "/":
 	case "":
 	default:
-		return nil, fmt.Errorf("url path must be empty")
+		return nil, errors.New("url path must be empty")
 	}
 
 	if s.KmsgLogURL.URL.Port() == "" {
-		return nil, fmt.Errorf("url port is required")
+		return nil, errors.New("url port is required")
 	}
 
 	return nil, nil
diff --git a/pkg/machinery/config/types/siderolink/siderolink.go b/pkg/machinery/config/types/siderolink/siderolink.go
index 34f89704fc..e6324f1128 100644
--- a/pkg/machinery/config/types/siderolink/siderolink.go
+++ b/pkg/machinery/config/types/siderolink/siderolink.go
@@ -8,7 +8,7 @@ package siderolink
 //docgen:jsonschema
 
 import (
-	"fmt"
+	"errors"
 	"net/url"
 
 	"github.com/siderolabs/gen/ensure"
@@ -115,21 +115,21 @@ func (s *ConfigV1Alpha1) APIUrl() *url.URL {
 // Validate implements config.Validator interface.
 func (s *ConfigV1Alpha1) Validate(validation.RuntimeMode, ...validation.Option) ([]string, error) {
 	if s.APIUrlConfig.URL == nil {
-		return nil, fmt.Errorf("apiUrl is required")
+		return nil, errors.New("apiUrl is required")
 	}
 
 	switch s.APIUrlConfig.URL.Scheme {
 	case "https":
 	case "grpc":
 	default:
-		return nil, fmt.Errorf("apiUrl scheme must be https:// or grpc://")
+		return nil, errors.New("apiUrl scheme must be https:// or grpc://")
 	}
 
 	switch s.APIUrlConfig.URL.Path {
 	case "/":
 	case "":
 	default:
-		return nil, fmt.Errorf("apiUrl path must be empty")
+		return nil, errors.New("apiUrl path must be empty")
 	}
 
 	return nil, nil
diff --git a/pkg/machinery/config/types/v1alpha1/v1alpha1_logging.go b/pkg/machinery/config/types/v1alpha1/v1alpha1_logging.go
index 75f799c0a4..de05589baa 100644
--- a/pkg/machinery/config/types/v1alpha1/v1alpha1_logging.go
+++ b/pkg/machinery/config/types/v1alpha1/v1alpha1_logging.go
@@ -5,6 +5,7 @@
 package v1alpha1
 
 import (
+	"errors"
 	"fmt"
 	"net/url"
 
@@ -26,10 +27,10 @@ func (lc *LoggingConfig) Validate() error {
 		}
 
 		if endpoint == nil {
-			errs = multierror.Append(errs, fmt.Errorf("empty logging endpoint"))
+			errs = multierror.Append(errs, errors.New("empty logging endpoint"))
 		} else {
 			if endpoint.Host == "" {
-				errs = multierror.Append(errs, fmt.Errorf("empty logging endpoint's host"))
+				errs = multierror.Append(errs, errors.New("empty logging endpoint's host"))
 			}
 
 			if endpoint.Scheme != "tcp" && endpoint.Scheme != "udp" {
diff --git a/pkg/machinery/config/types/v1alpha1/v1alpha1_provider.go b/pkg/machinery/config/types/v1alpha1/v1alpha1_provider.go
index 432f338605..19b30b4651 100644
--- a/pkg/machinery/config/types/v1alpha1/v1alpha1_provider.go
+++ b/pkg/machinery/config/types/v1alpha1/v1alpha1_provider.go
@@ -7,6 +7,7 @@ package v1alpha1
 import (
 	"crypto/tls"
 	stdx509 "crypto/x509"
+	"errors"
 	"fmt"
 	"os"
 	"slices"
@@ -1186,7 +1187,7 @@ func (i *InstallConfig) Disk() (string, error) {
 			return d.DeviceName, nil
 		}
 
-		return "", fmt.Errorf("no disk found matching provided parameters")
+		return "", errors.New("no disk found matching provided parameters")
 	}
 
 	return i.InstallDisk, nil
diff --git a/pkg/machinery/config/types/v1alpha1/v1alpha1_validation.go b/pkg/machinery/config/types/v1alpha1/v1alpha1_validation.go
index 5907e00883..737cc50909 100644
--- a/pkg/machinery/config/types/v1alpha1/v1alpha1_validation.go
+++ b/pkg/machinery/config/types/v1alpha1/v1alpha1_validation.go
@@ -96,7 +96,7 @@ func (c *Config) Validate(mode validation.RuntimeMode, options ...validation.Opt
 		} else {
 			if opts.Local {
 				if c.MachineConfig.MachineInstall.InstallDisk == "" && len(c.MachineConfig.MachineInstall.DiskMatchers()) == 0 {
-					result = multierror.Append(result, fmt.Errorf("either install disk or diskSelector should be defined"))
+					result = multierror.Append(result, errors.New("either install disk or diskSelector should be defined"))
 				}
 			} else {
 				disk, err := c.MachineConfig.MachineInstall.Disk()
@@ -241,15 +241,15 @@ func (c *Config) Validate(mode validation.RuntimeMode, options ...validation.Opt
 
 	if c.Machine().Network().KubeSpan().Enabled() {
 		if !c.Cluster().Discovery().Enabled() {
-			result = multierror.Append(result, fmt.Errorf(".cluster.discovery should be enabled when .machine.network.kubespan is enabled"))
+			result = multierror.Append(result, errors.New(".cluster.discovery should be enabled when .machine.network.kubespan is enabled"))
 		}
 
 		if c.Cluster().ID() == "" {
-			result = multierror.Append(result, fmt.Errorf(".cluster.id should be set when .machine.network.kubespan is enabled"))
+			result = multierror.Append(result, errors.New(".cluster.id should be set when .machine.network.kubespan is enabled"))
 		}
 
 		if c.Cluster().Secret() == "" {
-			result = multierror.Append(result, fmt.Errorf(".cluster.secret should be set when .machine.network.kubespan is enabled"))
+			result = multierror.Append(result, errors.New(".cluster.secret should be set when .machine.network.kubespan is enabled"))
 		}
 
 		for _, cidr := range c.Machine().Network().KubeSpan().Filters().Endpoints() {
@@ -292,11 +292,11 @@ func (c *Config) Validate(mode validation.RuntimeMode, options ...validation.Opt
 
 	if c.Machine().Features().KubernetesTalosAPIAccess().Enabled() {
 		if !c.Machine().Features().RBACEnabled() {
-			result = multierror.Append(result, fmt.Errorf("feature API RBAC should be enabled when Kubernetes Talos API Access feature is enabled"))
+			result = multierror.Append(result, errors.New("feature API RBAC should be enabled when Kubernetes Talos API Access feature is enabled"))
 		}
 
 		if !c.Machine().Type().IsControlPlane() {
-			result = multierror.Append(result, fmt.Errorf("feature Kubernetes Talos API Access can only be enabled on control plane machines"))
+			result = multierror.Append(result, errors.New("feature Kubernetes Talos API Access can only be enabled on control plane machines"))
 		}
 
 		for _, r := range c.Machine().Features().KubernetesTalosAPIAccess().AllowedRoles() {
@@ -307,7 +307,7 @@ func (c *Config) Validate(mode validation.RuntimeMode, options ...validation.Opt
 	}
 
 	if c.ConfigPersist != nil && !*c.ConfigPersist {
-		result = multierror.Append(result, fmt.Errorf(".persist should be enabled"))
+		result = multierror.Append(result, errors.New(".persist should be enabled"))
 	}
 
 	if opts.Strict {
@@ -338,11 +338,11 @@ func (c *ClusterConfig) Validate() error {
 	var result *multierror.Error
 
 	if c == nil {
-		return fmt.Errorf("cluster instructions are required")
+		return errors.New("cluster instructions are required")
 	}
 
 	if c.ControlPlane == nil || c.ControlPlane.Endpoint == nil {
-		return fmt.Errorf("cluster controlplane endpoint is required")
+		return errors.New("cluster controlplane endpoint is required")
 	}
 
 	if err := sideronet.ValidateEndpointURI(c.ControlPlane.Endpoint.URL.String()); err != nil {
@@ -428,7 +428,7 @@ func ValidateCNI(cni config.CNI) ([]string, error) {
 // Validate validates external cloud provider configuration.
 func (ecp *ExternalCloudProviderConfig) Validate() error {
 	if !ecp.Enabled() && (len(ecp.ExternalManifests) != 0) {
-		return fmt.Errorf("external cloud provider is disabled, but manifests are provided")
+		return errors.New("external cloud provider is disabled, but manifests are provided")
 	}
 
 	var result *multierror.Error
@@ -451,7 +451,7 @@ func (manifests ClusterInlineManifests) Validate() error {
 
 	for _, manifest := range manifests {
 		if strings.TrimSpace(manifest.InlineManifestName) == "" {
-			result = multierror.Append(result, fmt.Errorf("inline manifest name can't be empty"))
+			result = multierror.Append(result, errors.New("inline manifest name can't be empty"))
 		}
 
 		if _, ok := manifestNames[manifest.InlineManifestName]; ok {
@@ -477,15 +477,15 @@ func (c *ClusterDiscoveryConfig) Validate(clusterCfg *ClusterConfig) error {
 		if err != nil {
 			result = multierror.Append(result, fmt.Errorf("cluster discovery service registry endpoint is invalid: %w", err))
 		} else if url.Path != "" && url.Path != "/" {
-			result = multierror.Append(result, fmt.Errorf("cluster discovery service path should be empty"))
+			result = multierror.Append(result, errors.New("cluster discovery service path should be empty"))
 		}
 
 		if clusterCfg.ID() == "" {
-			result = multierror.Append(result, fmt.Errorf("cluster discovery service requires .cluster.id"))
+			result = multierror.Append(result, errors.New("cluster discovery service requires .cluster.id"))
 		}
 
 		if clusterCfg.Secret() == "" {
-			result = multierror.Append(result, fmt.Errorf("cluster discovery service requires .cluster.secret"))
+			result = multierror.Append(result, errors.New("cluster discovery service requires .cluster.secret"))
 		}
 	}
 
@@ -498,7 +498,7 @@ func ValidateNetworkDevices(d *Device, pairedInterfaces map[string]string, check
 	var result *multierror.Error
 
 	if d == nil {
-		return nil, fmt.Errorf("empty device")
+		return nil, errors.New("empty device")
 	}
 
 	if d.Ignore() {
@@ -523,7 +523,7 @@ func CheckDeviceInterface(d *Device, _ map[string]string) ([]string, error) {
 	var result *multierror.Error
 
 	if d == nil {
-		return nil, fmt.Errorf("empty device")
+		return nil, errors.New("empty device")
 	}
 
 	if d.DeviceInterface == "" && d.DeviceSelector == nil {
@@ -597,32 +597,32 @@ func checkBond(b *Bond) error {
 
 	if b.BondMIIMon == 0 {
 		if b.BondUpDelay != 0 {
-			result = multierror.Append(result, fmt.Errorf("bond.upDelay can't be set if miiMon is zero"))
+			result = multierror.Append(result, errors.New("bond.upDelay can't be set if miiMon is zero"))
 		}
 
 		if b.BondDownDelay != 0 {
-			result = multierror.Append(result, fmt.Errorf("bond.downDelay can't be set if miiMon is zero"))
+			result = multierror.Append(result, errors.New("bond.downDelay can't be set if miiMon is zero"))
 		}
 	} else {
 		if b.BondUpDelay%b.BondMIIMon != 0 {
-			result = multierror.Append(result, fmt.Errorf("bond.upDelay should be a multiple of miiMon"))
+			result = multierror.Append(result, errors.New("bond.upDelay should be a multiple of miiMon"))
 		}
 
 		if b.BondDownDelay%b.BondMIIMon != 0 {
-			result = multierror.Append(result, fmt.Errorf("bond.downDelay should be a multiple of miiMon"))
+			result = multierror.Append(result, errors.New("bond.downDelay should be a multiple of miiMon"))
 		}
 	}
 
 	if len(b.BondARPIPTarget) > 0 {
-		result = multierror.Append(result, fmt.Errorf("bond.arpIPTarget is not supported"))
+		result = multierror.Append(result, errors.New("bond.arpIPTarget is not supported"))
 	}
 
 	if b.BondLACPRate != "" && bondMode != nethelpers.BondMode8023AD {
-		result = multierror.Append(result, fmt.Errorf("bond.lacpRate is only available in 802.3ad mode"))
+		result = multierror.Append(result, errors.New("bond.lacpRate is only available in 802.3ad mode"))
 	}
 
 	if b.BondADActorSystem != "" {
-		result = multierror.Append(result, fmt.Errorf("bond.adActorSystem is not supported"))
+		result = multierror.Append(result, errors.New("bond.adActorSystem is not supported"))
 	}
 
 	if (bondMode == nethelpers.BondMode8023AD || bondMode == nethelpers.BondModeALB || bondMode == nethelpers.BondModeTLB) && b.BondARPValidate != "" {
@@ -646,11 +646,11 @@ func checkBond(b *Bond) error {
 	}
 
 	if bondMode != nethelpers.BondMode8023AD && b.BondADActorSysPrio > 0 {
-		result = multierror.Append(result, fmt.Errorf("bond.adActorSysPrio is only available in 802.3ad mode"))
+		result = multierror.Append(result, errors.New("bond.adActorSysPrio is only available in 802.3ad mode"))
 	}
 
 	if bondMode != nethelpers.BondMode8023AD && b.BondADUserPortKey > 0 {
-		result = multierror.Append(result, fmt.Errorf("bond.adUserPortKey is only available in 802.3ad mode"))
+		result = multierror.Append(result, errors.New("bond.adUserPortKey is only available in 802.3ad mode"))
 	}
 
 	return result.ErrorOrNil()
@@ -745,7 +745,7 @@ func CheckDeviceAddressing(d *Device, bondedInterfaces map[string]string) ([]str
 	var result *multierror.Error
 
 	if d == nil {
-		return nil, fmt.Errorf("empty device")
+		return nil, errors.New("empty device")
 	}
 
 	var warnings []string
@@ -794,7 +794,7 @@ func CheckDeviceRoutes(d *Device, _ map[string]string) ([]string, error) {
 	var result *multierror.Error
 
 	if d == nil {
-		return nil, fmt.Errorf("empty device")
+		return nil, errors.New("empty device")
 	}
 
 	if len(d.DeviceRoutes) == 0 {
@@ -860,7 +860,7 @@ func (e *EtcdConfig) Validate() error {
 	}
 
 	if e.EtcdSubnet != "" && len(e.EtcdAdvertisedSubnets) > 0 {
-		result = multierror.Append(result, fmt.Errorf("etcd subnet can't be set when advertised subnets are set"))
+		result = multierror.Append(result, errors.New("etcd subnet can't be set when advertised subnets are set"))
 	}
 
 	for _, cidr := range e.AdvertisedSubnets() {
diff --git a/pkg/machinery/extensions/services/services.go b/pkg/machinery/extensions/services/services.go
index ce2a8fd9ad..11faa22949 100644
--- a/pkg/machinery/extensions/services/services.go
+++ b/pkg/machinery/extensions/services/services.go
@@ -6,6 +6,7 @@
 package services
 
 import (
+	"errors"
 	"fmt"
 	"path/filepath"
 	"regexp"
@@ -108,7 +109,7 @@ func (ctr *Container) Validate() error {
 	var multiErr *multierror.Error
 
 	if ctr.Entrypoint == "" {
-		multiErr = multierror.Append(multiErr, fmt.Errorf("container endpoint can't be empty"))
+		multiErr = multierror.Append(multiErr, errors.New("container endpoint can't be empty"))
 	}
 
 	return multiErr.ErrorOrNil()
@@ -153,11 +154,11 @@ func (dep *Dependency) Validate() error {
 	}
 
 	if nonZeroDeps == 0 {
-		multiErr = multierror.Append(multiErr, fmt.Errorf("no dependency specified"))
+		multiErr = multierror.Append(multiErr, errors.New("no dependency specified"))
 	}
 
 	if nonZeroDeps > 1 {
-		multiErr = multierror.Append(multiErr, fmt.Errorf("more than a single dependency is set"))
+		multiErr = multierror.Append(multiErr, errors.New("more than a single dependency is set"))
 	}
 
 	return multiErr.ErrorOrNil()
diff --git a/pkg/machinery/resources/network/probe_spec.go b/pkg/machinery/resources/network/probe_spec.go
index 3d4d61dfe9..daf3703ea9 100644
--- a/pkg/machinery/resources/network/probe_spec.go
+++ b/pkg/machinery/resources/network/probe_spec.go
@@ -5,6 +5,7 @@
 package network
 
 import (
+	"errors"
 	"fmt"
 	"time"
 
@@ -41,7 +42,7 @@ func (spec *ProbeSpecSpec) ID() (resource.ID, error) {
 	var zeroTCP TCPProbeSpec
 
 	if spec.TCP == zeroTCP {
-		return "", fmt.Errorf("no probe type specified")
+		return "", errors.New("no probe type specified")
 	}
 
 	return fmt.Sprintf("tcp:%s", spec.TCP.Endpoint), nil
diff --git a/pkg/makefs/xfs.go b/pkg/makefs/xfs.go
index 58d8891ec4..50f93c53a8 100644
--- a/pkg/makefs/xfs.go
+++ b/pkg/makefs/xfs.go
@@ -5,6 +5,7 @@
 package makefs
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/siderolabs/go-cmd/pkg/cmd"
@@ -37,7 +38,7 @@ func XFSRepair(partname, fsType string) error {
 // XFS creates a XFS filesystem on the specified partition.
 func XFS(partname string, setters ...Option) error {
 	if partname == "" {
-		return fmt.Errorf("missing path to disk")
+		return errors.New("missing path to disk")
 	}
 
 	opts := NewDefaultOptions(setters...)
diff --git a/pkg/provision/providers/docker/result.go b/pkg/provision/providers/docker/result.go
index 3f44709e8d..2523cdde0e 100644
--- a/pkg/provision/providers/docker/result.go
+++ b/pkg/provision/providers/docker/result.go
@@ -5,7 +5,7 @@
 package docker
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/siderolabs/talos/pkg/provision"
 )
@@ -23,5 +23,5 @@ func (res *result) Info() provision.ClusterInfo {
 }
 
 func (res *result) StatePath() (string, error) {
-	return "", fmt.Errorf("state path is not used for docker provisioner")
+	return "", errors.New("state path is not used for docker provisioner")
 }
diff --git a/pkg/provision/providers/qemu/launch.go b/pkg/provision/providers/qemu/launch.go
index a9bfc7388e..b8908a4177 100644
--- a/pkg/provision/providers/qemu/launch.go
+++ b/pkg/provision/providers/qemu/launch.go
@@ -157,10 +157,9 @@ func withCNI(ctx context.Context, config *LaunchConfig, f func(config *LaunchCon
 
 	vmIface, tapIface, err := cniutils.VMTapPair(currentResult, containerID)
 	if err != nil {
-		return fmt.Errorf(
+		return errors.New(
 			"failed to parse VM network configuration from CNI output, ensure CNI is configured with a plugin " +
-				"that supports automatic VM network configuration such as tc-redirect-tap",
-		)
+				"that supports automatic VM network configuration such as tc-redirect-tap")
 	}
 
 	cniChain := utils.FormatChainName(config.NetworkConfig.Name, containerID)
@@ -396,7 +395,7 @@ func launchVM(config *LaunchConfig) error {
 
 			<-done
 
-			return fmt.Errorf("process stopped")
+			return errors.New("process stopped")
 		case err := <-done:
 			if err != nil {
 				return fmt.Errorf("process exited with error %s", err)
@@ -464,7 +463,7 @@ func Launch() error {
 				case sig := <-config.c:
 					fmt.Fprintf(os.Stderr, "exiting stopped launcher as signal %s was received\n", sig)
 
-					return fmt.Errorf("process stopped")
+					return errors.New("process stopped")
 				}
 			}
 
diff --git a/pkg/provision/providers/qemu/preflight.go b/pkg/provision/providers/qemu/preflight.go
index 904f5b91a7..cd98ef0224 100644
--- a/pkg/provision/providers/qemu/preflight.go
+++ b/pkg/provision/providers/qemu/preflight.go
@@ -6,6 +6,7 @@ package qemu
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"os"
 	"os/exec"
@@ -53,7 +54,7 @@ type preflightCheckContext struct {
 
 func (check *preflightCheckContext) verifyRoot(ctx context.Context) error {
 	if os.Geteuid() != 0 {
-		return fmt.Errorf("error: please run as root user (CNI requirement), we recommend running with `sudo -E`")
+		return errors.New("error: please run as root user (CNI requirement), we recommend running with `sudo -E`")
 	}
 
 	return nil
diff --git a/pkg/provision/providers/qemu_other.go b/pkg/provision/providers/qemu_other.go
index 5488dc5d8a..eaf9ba4505 100644
--- a/pkg/provision/providers/qemu_other.go
+++ b/pkg/provision/providers/qemu_other.go
@@ -8,11 +8,11 @@ package providers
 
 import (
 	"context"
-	"fmt"
+	"errors"
 
 	"github.com/siderolabs/talos/pkg/provision"
 )
 
 func newQemu(ctx context.Context) (provision.Provisioner, error) {
-	return nil, fmt.Errorf("qemu provisioner is not supported on this platform")
+	return nil, errors.New("qemu provisioner is not supported on this platform")
 }
diff --git a/pkg/provision/providers/vm/disk.go b/pkg/provision/providers/vm/disk.go
index f0bcc82f5d..71c3becc45 100644
--- a/pkg/provision/providers/vm/disk.go
+++ b/pkg/provision/providers/vm/disk.go
@@ -5,6 +5,7 @@
 package vm
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"syscall"
@@ -49,7 +50,7 @@ func (p *Provisioner) CreateDisks(state *State, nodeReq provision.NodeRequest) (
 	}
 
 	if len(diskPaths) == 0 {
-		return nil, fmt.Errorf("node request must have at least one disk defined to be used as primary disk")
+		return nil, errors.New("node request must have at least one disk defined to be used as primary disk")
 	}
 
 	return diskPaths, nil
diff --git a/pkg/provision/providers/vm/internal/ipxe/ipxe.go b/pkg/provision/providers/vm/internal/ipxe/ipxe.go
index bd16a5ff2d..678194d3f2 100644
--- a/pkg/provision/providers/vm/internal/ipxe/ipxe.go
+++ b/pkg/provision/providers/vm/internal/ipxe/ipxe.go
@@ -8,6 +8,7 @@ package ipxe
 import (
 	"bytes"
 	"embed"
+	"errors"
 	"fmt"
 	"io"
 	"log"
@@ -126,16 +127,16 @@ var (
 func patchScript(contents, script []byte) ([]byte, error) {
 	start := bytes.Index(contents, placeholderStart)
 	if start == -1 {
-		return nil, fmt.Errorf("placeholder start not found")
+		return nil, errors.New("placeholder start not found")
 	}
 
 	end := bytes.Index(contents, placeholderEnd)
 	if end == -1 {
-		return nil, fmt.Errorf("placeholder end not found")
+		return nil, errors.New("placeholder end not found")
 	}
 
 	if end < start {
-		return nil, fmt.Errorf("placeholder end before start")
+		return nil, errors.New("placeholder end before start")
 	}
 
 	end += len(placeholderEnd)
diff --git a/pkg/provision/providers/vm/launch.go b/pkg/provision/providers/vm/launch.go
index fecc704fb7..127132b3ba 100644
--- a/pkg/provision/providers/vm/launch.go
+++ b/pkg/provision/providers/vm/launch.go
@@ -6,6 +6,7 @@ package vm
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -26,7 +27,7 @@ func ReadConfig(config interface{}) error {
 	}
 
 	if d.More() {
-		return fmt.Errorf("extra unexpected input on stdin")
+		return errors.New("extra unexpected input on stdin")
 	}
 
 	return os.Stdin.Close()
diff --git a/pkg/provision/providers/vm/network.go b/pkg/provision/providers/vm/network.go
index 2800051bfd..b9d13cf799 100644
--- a/pkg/provision/providers/vm/network.go
+++ b/pkg/provision/providers/vm/network.go
@@ -9,6 +9,7 @@ import (
 	"context"
 	"crypto/sha256"
 	"encoding/hex"
+	"errors"
 	"fmt"
 	"net"
 	"net/netip"
@@ -199,7 +200,7 @@ func (p *Provisioner) dropBridgeTrafficRule(bridgeName string) error {
 //nolint:gocyclo
 func (p *Provisioner) configureNetworkChaos(network provision.NetworkRequest, state *State, options provision.Options) error {
 	if (network.Bandwidth != 0) && (network.Latency != 0 || network.Jitter != 0 || network.PacketLoss != 0 || network.PacketReorder != 0 || network.PacketCorrupt != 0) {
-		return fmt.Errorf("bandwidth and other chaos options cannot be used together")
+		return errors.New("bandwidth and other chaos options cannot be used together")
 	}
 
 	link, err := netlink.LinkByName(state.BridgeName)
diff --git a/pkg/provision/providers/vm/state.go b/pkg/provision/providers/vm/state.go
index c92037c795..1b6c55a99a 100644
--- a/pkg/provision/providers/vm/state.go
+++ b/pkg/provision/providers/vm/state.go
@@ -5,6 +5,7 @@
 package vm
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -68,7 +69,7 @@ func (s *State) Info() provision.ClusterInfo {
 // StatePath get state config file path.
 func (s *State) StatePath() (string, error) {
 	if s.statePath == "" {
-		return "", fmt.Errorf("state path is not set")
+		return "", errors.New("state path is not set")
 	}
 
 	return s.statePath, nil
diff --git a/pkg/provision/request.go b/pkg/provision/request.go
index bb245551f0..4956774b46 100644
--- a/pkg/provision/request.go
+++ b/pkg/provision/request.go
@@ -5,7 +5,7 @@
 package provision
 
 import (
-	"fmt"
+	"errors"
 	"net/netip"
 	"time"
 
@@ -96,7 +96,7 @@ func (reqs NodeRequests) FindInitNode() (req NodeRequest, err error) {
 
 		if reqs[i].Config.Machine().Type() == machine.TypeInit {
 			if found {
-				err = fmt.Errorf("duplicate init node in requests")
+				err = errors.New("duplicate init node in requests")
 
 				return
 			}
@@ -107,7 +107,7 @@ func (reqs NodeRequests) FindInitNode() (req NodeRequest, err error) {
 	}
 
 	if !found {
-		err = fmt.Errorf("no init node found in requests")
+		err = errors.New("no init node found in requests")
 	}
 
 	return