diff --git a/Makefile b/Makefile
index 55b9ef9deb..fde4ef6079 100644
--- a/Makefile
+++ b/Makefile
@@ -91,7 +91,7 @@ endif
 REPO?=tigera/operator
 PACKAGE_NAME?=github.com/tigera/operator
 LOCAL_USER_ID?=$(shell id -u $$USER)
-GO_BUILD_VER?=1.24.13-llvm18.1.8-k8s1.32.11
+GO_BUILD_VER?=1.25.9-llvm18.1.8-k8s1.32.13
 CALICO_BUILD?=calico/go-build:$(GO_BUILD_VER)-$(BUILDARCH)
 SRC_FILES=$(shell find ./pkg -name '*.go')
 SRC_FILES+=$(shell find ./api -name '*.go')
diff --git a/api/v1/installation_types.go b/api/v1/installation_types.go
index 306f121dac..d29dc3e999 100644
--- a/api/v1/installation_types.go
+++ b/api/v1/installation_types.go
@@ -806,10 +806,7 @@ func (p *IPPool) FromProjectCalicoV1(crd pcv1.IPPool) {
 	}
 
 	// Configure DisableNewAllocations
-	disableAlloc := false
-	if crd.Spec.Disabled {
-		disableAlloc = true
-	}
+	disableAlloc := crd.Spec.Disabled
 	p.DisableNewAllocations = &disableAlloc
 
 	// Set BlockSize
@@ -820,10 +817,7 @@ func (p *IPPool) FromProjectCalicoV1(crd pcv1.IPPool) {
 	p.NodeSelector = crd.Spec.NodeSelector
 
 	// Set BGP export.
-	disableExport := false
-	if crd.Spec.DisableBGPExport {
-		disableExport = true
-	}
+	disableExport := crd.Spec.DisableBGPExport
 	p.DisableBGPExport = &disableExport
 
 	for _, use := range crd.Spec.AllowedUses {
diff --git a/cmd/main.go b/cmd/main.go
index 65900922f0..d2bd403a7c 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -28,7 +28,6 @@ import (
 
 	v3 "github.com/tigera/api/pkg/apis/projectcalico/v3"
 
-	v1 "github.com/tigera/operator/api/v1"
 	"github.com/tigera/operator/internal/controller"
 	"github.com/tigera/operator/pkg/active"
 	"github.com/tigera/operator/pkg/apis"
@@ -301,7 +300,7 @@ If a value other than 'all' is specified, the first CRD with a prefix of the spe
 
 		// Check if we need to do any cleanup.
 		client := mgr.GetClient()
-		instance := &v1.Installation{}
+		instance := &operatortigeraiov1.Installation{}
 		retries := 0
 		for {
 			if err := client.Get(ctx, utils.DefaultInstanceKey, instance); errors.IsNotFound(err) {
@@ -490,8 +489,12 @@ func setKubernetesServiceEnv(kubeconfigFile string) error {
 	// The kubernetes in-cluster functions don't let you override the apiserver
 	// directly; gotta "pass" it via environment vars.
 	log.Info("Overriding kubernetes api to %s", apiURL)
-	os.Setenv("KUBERNETES_SERVICE_HOST", url.Hostname())
-	os.Setenv("KUBERNETES_SERVICE_PORT", url.Port())
+	if err := os.Setenv("KUBERNETES_SERVICE_HOST", url.Hostname()); err != nil {
+		return err
+	}
+	if err := os.Setenv("KUBERNETES_SERVICE_PORT", url.Port()); err != nil {
+		return err
+	}
 	return nil
 }
 
@@ -528,7 +531,7 @@ func showCRDs(variant operatortigeraiov1.ProductVariant, outputType string) erro
 		}
 		b, err := yaml.Marshal(v)
 		if err != nil {
-			return fmt.Errorf("Failed to Marshal %s: %v", v.Name, err)
+			return fmt.Errorf("failed to marshal %s: %v", v.Name, err)
 		}
 		if !first {
 			fmt.Println("---")
@@ -540,7 +543,7 @@ func showCRDs(variant operatortigeraiov1.ProductVariant, outputType string) erro
 	}
 	// Indicates nothing was printed so we couldn't find the requested outputType
 	if first {
-		return fmt.Errorf("No CRD matching %s", outputType)
+		return fmt.Errorf("no CRD matching %s", outputType)
 	}
 
 	return nil
@@ -573,7 +576,7 @@ func executePreDeleteHook(ctx context.Context, c client.Client) error {
 	for {
 		select {
 		case <-to:
-			return fmt.Errorf("Timeout waiting for pre-delete hook")
+			return fmt.Errorf("timeout waiting for pre-delete hook")
 		default:
 			if err := c.Get(ctx, utils.DefaultInstanceKey, installation); errors.IsNotFound(err) {
 				// It's gone! We can return.
diff --git a/go.mod b/go.mod
index 466fe1bc1b..d2ea41508f 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/tigera/operator
 
-go 1.24.13
+go 1.25.9
 
 require (
 	github.com/aws/aws-sdk-go v1.55.5
diff --git a/hack/gen-versions/components.go b/hack/gen-versions/components.go
index 29838870b9..19be0b4ae5 100644
--- a/hack/gen-versions/components.go
+++ b/hack/gen-versions/components.go
@@ -106,8 +106,8 @@ func GetComponents(versionsPath string) (Release, error) {
 		if component.Image == "" {
 			image := defaultImages[key]
 			if image == "" {
-				return cv, fmt.Errorf("no image nor default image available for component '%s'. "+
-					"Either fill in the 'image' field or update this code with a defaultImage.", key)
+				return cv, fmt.Errorf("no image nor default image available for component '%s': "+
+					"either fill in the 'image' field or update this code with a defaultImage", key)
 			}
 			component.Image = image
 		}
diff --git a/internal/controller/suite_test.go b/internal/controller/suite_test.go
index 7d9f8a3414..598d82ef44 100644
--- a/internal/controller/suite_test.go
+++ b/internal/controller/suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2024-2026 Tigera, Inc. All rights reserved.
 /*
 
 Licensed under the Apache License, Version 2.0 (the "License");
@@ -23,7 +23,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo/v2"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"k8s.io/client-go/kubernetes/scheme"
 	"k8s.io/client-go/rest"
diff --git a/pkg/active/active_suite_test.go b/pkg/active/active_suite_test.go
index a09cb132c7..818d6edcf6 100644
--- a/pkg/active/active_suite_test.go
+++ b/pkg/active/active_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019, 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019, 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/active/active_test.go b/pkg/active/active_test.go
index f0988d5820..4d0e977fb8 100644
--- a/pkg/active/active_test.go
+++ b/pkg/active/active_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2021-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2021-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"context"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	apps "k8s.io/api/apps/v1"
 	batchv1 "k8s.io/api/batch/v1"
diff --git a/pkg/awssgsetup/aws_security_group_setup.go b/pkg/awssgsetup/aws_security_group_setup.go
index cdb0cb9df1..bdb1f31214 100644
--- a/pkg/awssgsetup/aws_security_group_setup.go
+++ b/pkg/awssgsetup/aws_security_group_setup.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2020-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -64,7 +64,7 @@ func SetupAWSSecurityGroups(ctx context.Context, client client.Client, hosted bo
 
 	meta := ec2metadata.New(metaSess)
 	if !meta.Available() {
-		return fmt.Errorf("Instance metadata is not available, unable to configure Security Groups")
+		return fmt.Errorf("instance metadata is not available, unable to configure Security Groups")
 	}
 
 	doc, err := meta.GetInstanceIdentityDocument()
@@ -317,7 +317,7 @@ func allowIngressToSG(cli *ec2.EC2, toSG *ec2.SecurityGroup, sources []ingressSr
 		}})
 		_, err := cli.AuthorizeSecurityGroupIngress(in)
 		if err != nil {
-			return fmt.Errorf("Failed to add to SG '%s' the ingress rule '%s': %v: %v", sgId, s.String(), toSG, err)
+			return fmt.Errorf("failed to add to SG '%s' the ingress rule '%s': %v: %v", sgId, s.String(), toSG, err)
 		}
 		log.V(DEBUG).Info("Added Ingress rule", "toSG.GroupId", sgId, "ingressSrc", s.String())
 	}
diff --git a/pkg/common/autoscale.go b/pkg/common/autoscale.go
index 32b4f8d667..961ab5acc0 100644
--- a/pkg/common/autoscale.go
+++ b/pkg/common/autoscale.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2020-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -30,7 +30,7 @@ package common
 //	...
 //	>3600             20
 func GetExpectedTyphaScale(nodes int) int {
-	var maxNodesPerTypha int = 200
+	var maxNodesPerTypha = 200
 
 	// This gives a count of how many 200s so we need 1+ this number to get at least
 	// 1 typha for every 200 nodes.
diff --git a/pkg/common/common_suite_test.go b/pkg/common/common_suite_test.go
index 56d144c067..0b9e1c8094 100644
--- a/pkg/common/common_suite_test.go
+++ b/pkg/common/common_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2021, 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2021, 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/common/k8svalidation/helper/helper.go b/pkg/common/k8svalidation/helper/helper.go
index 6dcbbf2a43..e4b4b89fea 100644
--- a/pkg/common/k8svalidation/helper/helper.go
+++ b/pkg/common/k8svalidation/helper/helper.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2022-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022-2026 Tigera, Inc. All rights reserved.
 /*
 Copyright 2014 The Kubernetes Authors.
 
@@ -56,10 +56,10 @@ var Semantic = conversion.EqualitiesOrDie(
 		return a.Cmp(b) == 0
 	},
 	func(a, b metav1.MicroTime) bool {
-		return a.UTC() == b.UTC()
+		return a.UTC().Equal(b.UTC())
 	},
 	func(a, b metav1.Time) bool {
-		return a.UTC() == b.UTC()
+		return a.UTC().Equal(b.UTC())
 	},
 	func(a, b labels.Selector) bool {
 		return a.String() == b.String()
diff --git a/pkg/common/kubernetes_version_test.go b/pkg/common/kubernetes_version_test.go
index af5f17322f..4d1c10afc6 100644
--- a/pkg/common/kubernetes_version_test.go
+++ b/pkg/common/kubernetes_version_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2020-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -24,7 +24,7 @@ import (
 	"k8s.io/client-go/kubernetes/fake"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 )
 
 var _ = Describe("Test get Kubernetes version", func() {
diff --git a/pkg/common/operator_serviceaccount_test.go b/pkg/common/operator_serviceaccount_test.go
index 3f1f2b3487..8605bf7013 100644
--- a/pkg/common/operator_serviceaccount_test.go
+++ b/pkg/common/operator_serviceaccount_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2021-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2021-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"os"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 )
 
 var _ = Describe("Operator ServiceAccount name tests", func() {
diff --git a/pkg/common/validation/overrides_test.go b/pkg/common/validation/overrides_test.go
index 757e4d8d06..b6726d22c8 100644
--- a/pkg/common/validation/overrides_test.go
+++ b/pkg/common/validation/overrides_test.go
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	apiserver "github.com/tigera/operator/pkg/common/validation/apiserver"
 	typha "github.com/tigera/operator/pkg/common/validation/typha"
 	"github.com/tigera/operator/pkg/render"
diff --git a/pkg/common/validation/validation_suite_test.go b/pkg/common/validation/validation_suite_test.go
index 654b5cef72..53bea3c63e 100644
--- a/pkg/common/validation/validation_suite_test.go
+++ b/pkg/common/validation/validation_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2022 - 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022 - 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/components/components_suite_test.go b/pkg/components/components_suite_test.go
index 13a4f06b97..f169a91613 100644
--- a/pkg/components/components_suite_test.go
+++ b/pkg/components/components_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019, 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019, 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/components/images_test.go b/pkg/components/images_test.go
index 28b5bc899f..59e313d632 100644
--- a/pkg/components/images_test.go
+++ b/pkg/components/images_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	op "github.com/tigera/operator/api/v1"
 )
diff --git a/pkg/controller/apiserver/apiserver_controller_test.go b/pkg/controller/apiserver/apiserver_controller_test.go
index 459906f53b..6f9d11f175 100644
--- a/pkg/controller/apiserver/apiserver_controller_test.go
+++ b/pkg/controller/apiserver/apiserver_controller_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2020-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -22,7 +22,7 @@ import (
 	kerror "k8s.io/apimachinery/pkg/api/errors"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"github.com/stretchr/testify/mock"
 
 	admregv1 "k8s.io/api/admissionregistration/v1"
diff --git a/pkg/controller/apiserver/apiserver_suite_test.go b/pkg/controller/apiserver/apiserver_suite_test.go
index 3a6753cf15..148185b832 100644
--- a/pkg/controller/apiserver/apiserver_suite_test.go
+++ b/pkg/controller/apiserver/apiserver_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@ import (
 	uzap "go.uber.org/zap"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 
diff --git a/pkg/controller/applicationlayer/applicationlayer_controller.go b/pkg/controller/applicationlayer/applicationlayer_controller.go
index 64f9e8daeb..59ab749735 100644
--- a/pkg/controller/applicationlayer/applicationlayer_controller.go
+++ b/pkg/controller/applicationlayer/applicationlayer_controller.go
@@ -338,13 +338,13 @@ func (r *ReconcileApplicationLayer) Reconcile(ctx context.Context, request recon
 // updateApplicationLayerWithDefaults populates the applicationlayer with defaults.
 func updateApplicationLayerWithDefaults(al *operatorv1.ApplicationLayer) {
 	var (
-		defaultLogIntervalSeconds               int64                                       = 5
-		defaultLogRequestsPerInterval           int64                                       = -1
-		defaultLogCollectionStatusType          operatorv1.LogCollectionStatusType          = operatorv1.L7LogCollectionDisabled
-		defaultWebApplicationFirewallStatusType operatorv1.WAFStatusType                    = operatorv1.WAFDisabled
-		defaultApplicationLayerPolicyStatusType operatorv1.ApplicationLayerPolicyStatusType = operatorv1.ApplicationLayerPolicyDisabled
-		defaultSidecarStatusType                operatorv1.SidecarStatusType                = operatorv1.SidecarDisabled
-		defaultSidecarWebhookStateType          operatorv1.SidecarWebhookStateType          = operatorv1.SidecarWebhookStateDisabled
+		defaultLogIntervalSeconds               int64 = 5
+		defaultLogRequestsPerInterval           int64 = -1
+		defaultLogCollectionStatusType                = operatorv1.L7LogCollectionDisabled
+		defaultWebApplicationFirewallStatusType       = operatorv1.WAFDisabled
+		defaultApplicationLayerPolicyStatusType       = operatorv1.ApplicationLayerPolicyDisabled
+		defaultSidecarStatusType                      = operatorv1.SidecarDisabled
+		defaultSidecarWebhookStateType                = operatorv1.SidecarWebhookStateDisabled
 	)
 
 	if al.Spec.LogCollection == nil {
diff --git a/pkg/controller/applicationlayer/applicationlayer_controller_test.go b/pkg/controller/applicationlayer/applicationlayer_controller_test.go
index 7ecbb830e9..642ea04678 100644
--- a/pkg/controller/applicationlayer/applicationlayer_controller_test.go
+++ b/pkg/controller/applicationlayer/applicationlayer_controller_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2021-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2021-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 	"fmt"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"github.com/stretchr/testify/mock"
 
 	admregv1 "k8s.io/api/admissionregistration/v1"
diff --git a/pkg/controller/applicationlayer/applicationlayer_suit_test.go b/pkg/controller/applicationlayer/applicationlayer_suit_test.go
index b5cb0ff993..2636cf48f3 100644
--- a/pkg/controller/applicationlayer/applicationlayer_suit_test.go
+++ b/pkg/controller/applicationlayer/applicationlayer_suit_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2021, 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2021, 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	"github.com/onsi/ginkgo/reporters"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 )
 
 func TestStatus(t *testing.T) {
diff --git a/pkg/controller/authentication/authentication_controller_test.go b/pkg/controller/authentication/authentication_controller_test.go
index 13a73185e7..726c5861c3 100644
--- a/pkg/controller/authentication/authentication_controller_test.go
+++ b/pkg/controller/authentication/authentication_controller_test.go
@@ -25,7 +25,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"github.com/stretchr/testify/mock"
 	v3 "github.com/tigera/api/pkg/apis/projectcalico/v3"
 	"golang.org/x/net/http/httpproxy"
diff --git a/pkg/controller/authentication/authentication_suite_test.go b/pkg/controller/authentication/authentication_suite_test.go
index d7d88e1f7d..a2e17915cc 100644
--- a/pkg/controller/authentication/authentication_suite_test.go
+++ b/pkg/controller/authentication/authentication_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019, 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019, 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	"github.com/onsi/ginkgo/reporters"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 )
 
 func TestStatus(t *testing.T) {
diff --git a/pkg/controller/certificatemanager/certificatemanager.go b/pkg/controller/certificatemanager/certificatemanager.go
index 9596a19198..b8249a92a3 100644
--- a/pkg/controller/certificatemanager/certificatemanager.go
+++ b/pkg/controller/certificatemanager/certificatemanager.go
@@ -37,7 +37,6 @@ import (
 	"github.com/tigera/operator/pkg/components"
 	"github.com/tigera/operator/pkg/controller/status"
 	"github.com/tigera/operator/pkg/controller/utils/imageset"
-	"github.com/tigera/operator/pkg/render/common/meta"
 	rmeta "github.com/tigera/operator/pkg/render/common/meta"
 	"github.com/tigera/operator/pkg/tls"
 	"github.com/tigera/operator/pkg/tls/certificatemanagement"
@@ -681,7 +680,7 @@ func (a *readOnlyTrustedBundle) MountPath() string {
 	return a.bundle.MountPath()
 }
 
-func (a *readOnlyTrustedBundle) VolumeMounts(osType meta.OSType) []corev1.VolumeMount {
+func (a *readOnlyTrustedBundle) VolumeMounts(osType rmeta.OSType) []corev1.VolumeMount {
 	return a.bundle.VolumeMounts(osType)
 }
 
diff --git a/pkg/controller/certificatemanager/certificatemanager_suite_test.go b/pkg/controller/certificatemanager/certificatemanager_suite_test.go
index 52a5f9d9d3..1587df05f3 100644
--- a/pkg/controller/certificatemanager/certificatemanager_suite_test.go
+++ b/pkg/controller/certificatemanager/certificatemanager_suite_test.go
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	uzap "go.uber.org/zap"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
diff --git a/pkg/controller/certificatemanager/certificatemanager_test.go b/pkg/controller/certificatemanager/certificatemanager_test.go
index 9e27f34663..9339af8149 100644
--- a/pkg/controller/certificatemanager/certificatemanager_test.go
+++ b/pkg/controller/certificatemanager/certificatemanager_test.go
@@ -27,7 +27,7 @@ import (
 	"time"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"k8s.io/apimachinery/pkg/util/sets"
 
 	"github.com/openshift/library-go/pkg/crypto"
diff --git a/pkg/controller/clusterconnection/clusterconnection_controller_test.go b/pkg/controller/clusterconnection/clusterconnection_controller_test.go
index 841b73940a..0be2e24a98 100644
--- a/pkg/controller/clusterconnection/clusterconnection_controller_test.go
+++ b/pkg/controller/clusterconnection/clusterconnection_controller_test.go
@@ -25,7 +25,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"github.com/stretchr/testify/mock"
 	"github.com/tigera/operator/pkg/render/common/networkpolicy"
 	v1 "k8s.io/api/core/v1"
diff --git a/pkg/controller/clusterconnection/clusterconnection_suite_test.go b/pkg/controller/clusterconnection/clusterconnection_suite_test.go
index 3a61089761..edfbea0aa7 100644
--- a/pkg/controller/clusterconnection/clusterconnection_suite_test.go
+++ b/pkg/controller/clusterconnection/clusterconnection_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019, 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019, 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 
 	"github.com/onsi/ginkgo/reporters"
diff --git a/pkg/controller/compliance/compliance_controller_test.go b/pkg/controller/compliance/compliance_controller_test.go
index 2ac3aa4bdd..40f6e1eee0 100644
--- a/pkg/controller/compliance/compliance_controller_test.go
+++ b/pkg/controller/compliance/compliance_controller_test.go
@@ -26,7 +26,7 @@ import (
 	"github.com/tigera/operator/pkg/tls"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"github.com/stretchr/testify/mock"
 	"github.com/tigera/operator/pkg/common"
 	"github.com/tigera/operator/pkg/components"
diff --git a/pkg/controller/compliance/compliance_suite_test.go b/pkg/controller/compliance/compliance_suite_test.go
index ed8634d931..deac8ac2df 100644
--- a/pkg/controller/compliance/compliance_suite_test.go
+++ b/pkg/controller/compliance/compliance_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2020, 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020, 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 	uzap "go.uber.org/zap"
diff --git a/pkg/controller/csr/csr_controller_suite_test.go b/pkg/controller/csr/csr_controller_suite_test.go
index b53d02251e..3bb3660554 100644
--- a/pkg/controller/csr/csr_controller_suite_test.go
+++ b/pkg/controller/csr/csr_controller_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/controller/csr/csr_controller_test.go b/pkg/controller/csr/csr_controller_test.go
index c9d46e4a67..06da964a06 100644
--- a/pkg/controller/csr/csr_controller_test.go
+++ b/pkg/controller/csr/csr_controller_test.go
@@ -27,7 +27,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	"github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	authv1 "k8s.io/api/authorization/v1"
 	certificatesv1 "k8s.io/api/certificates/v1"
@@ -202,7 +202,7 @@ var _ = Describe("CSR controller tests", func() {
 	)
 
 	table.DescribeTable("csr validation for non-cluster hosts", func(csr *certificatesv1.CertificateSigningRequest, hep *v3.HostEndpoint, expectError, expectRelevant, subjectAccessReviewAllowed bool) {
-		clientset.Fake.PrependReactor("create", "subjectaccessreviews", func(action testing.Action) (handled bool, ret runtime.Object, err error) {
+		clientset.PrependReactor("create", "subjectaccessreviews", func(action testing.Action) (handled bool, ret runtime.Object, err error) {
 			return true, &authv1.SubjectAccessReview{
 				Status: authv1.SubjectAccessReviewStatus{
 					Allowed: subjectAccessReviewAllowed,
@@ -264,7 +264,7 @@ var _ = Describe("CSR controller tests", func() {
 			Expect(cli.Create(ctx, hep)).NotTo(HaveOccurred())
 			// When we list HostEndpoints, we use a field selector to filter host endpoint by their spec.node.
 			// The default fake client's List method does not support filed selectors, so we need to add a reactor to handle this.
-			calicoClientset.Fake.PrependReactor("list", "hostendpoints", func(action testing.Action) (handled bool, ret runtime.Object, err error) {
+			calicoClientset.PrependReactor("list", "hostendpoints", func(action testing.Action) (handled bool, ret runtime.Object, err error) {
 				listAction, ok := action.(testing.ListAction)
 				Expect(ok).To(BeTrue())
 				fieldSelector := listAction.GetListRestrictions().Fields
diff --git a/pkg/controller/egressgateway/egressgateway_controller.go b/pkg/controller/egressgateway/egressgateway_controller.go
index 343208dd43..b10e55dc1d 100644
--- a/pkg/controller/egressgateway/egressgateway_controller.go
+++ b/pkg/controller/egressgateway/egressgateway_controller.go
@@ -441,7 +441,7 @@ func validateEgressGateway(ctx context.Context, cli client.Client, egw *operator
 	// If CIDR is specified, check if CIDR matches with any IPPool.
 	// If Aws.NativeIP is enabled, check if the IPPool is backed by aws-subnet ID.
 	if len(egw.Spec.IPPools) == 0 {
-		return fmt.Errorf("At least one IPPool must be specified")
+		return fmt.Errorf("at least one IPPool must be specified")
 	}
 
 	for _, ippool := range egw.Spec.IPPools {
@@ -469,7 +469,7 @@ func validateEgressGateway(ctx context.Context, cli client.Client, egw *operator
 	if egw.Spec.EgressGatewayFailureDetection != nil {
 		if egw.Spec.EgressGatewayFailureDetection.ICMPProbe == nil &&
 			egw.Spec.EgressGatewayFailureDetection.HTTPProbe == nil {
-			return fmt.Errorf("Either ICMP or HTTP probe must be configured")
+			return fmt.Errorf("either ICMP or HTTP probe must be configured")
 		}
 		// Check if ICMP and HTTP probe timeout is greater than interval.
 		if egw.Spec.EgressGatewayFailureDetection.ICMPProbe != nil {
diff --git a/pkg/controller/egressgateway/egressgateway_controller_test.go b/pkg/controller/egressgateway/egressgateway_controller_test.go
index 30819db243..591eb641cf 100644
--- a/pkg/controller/egressgateway/egressgateway_controller_test.go
+++ b/pkg/controller/egressgateway/egressgateway_controller_test.go
@@ -21,7 +21,7 @@ import (
 
 	"github.com/go-logr/logr"
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"github.com/stretchr/testify/mock"
 
 	ocsv1 "github.com/openshift/api/security/v1"
@@ -29,7 +29,6 @@ import (
 	appsv1 "k8s.io/api/apps/v1"
 	batchv1 "k8s.io/api/batch/v1"
 	corev1 "k8s.io/api/core/v1"
-	v1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -218,12 +217,12 @@ var _ = Describe("Egress Gateway controller tests", func() {
 			for _, elem := range expectedEgwEnvVar {
 				Expect(egwContainer.Env).To(ContainElement(elem))
 			}
-			expectedAffinity := v1.Affinity{}
-			expectedAffinity.PodAntiAffinity = &v1.PodAntiAffinity{
-				PreferredDuringSchedulingIgnoredDuringExecution: []v1.WeightedPodAffinityTerm{
+			expectedAffinity := corev1.Affinity{}
+			expectedAffinity.PodAntiAffinity = &corev1.PodAntiAffinity{
+				PreferredDuringSchedulingIgnoredDuringExecution: []corev1.WeightedPodAffinityTerm{
 					{
 						Weight: 1,
-						PodAffinityTerm: v1.PodAffinityTerm{
+						PodAffinityTerm: corev1.PodAffinityTerm{
 							LabelSelector: &metav1.LabelSelector{
 								MatchLabels: map[string]string{"projectcalico.org/egw": "calico-red"},
 							},
@@ -583,7 +582,7 @@ var _ = Describe("Egress Gateway controller tests", func() {
 
 		It("Should throw an error when failure detection is specified without ICMP and HTTP probes", func() {
 			mockStatus.On("SetDegraded", "Waiting for LicenseKeyAPI to be ready", "").Return().Maybe()
-			mockStatus.On("SetDegraded", operatorv1.ResourceValidationError, "Error validating egress gateway Name = calico-red, Namespace = calico-egress", "Either ICMP or HTTP probe must be configured", mock.Anything, mock.Anything).Return()
+			mockStatus.On("SetDegraded", operatorv1.ResourceValidationError, "Error validating egress gateway Name = calico-red, Namespace = calico-egress", "either ICMP or HTTP probe must be configured", mock.Anything, mock.Anything).Return()
 			Expect(c.Create(ctx, installation)).NotTo(HaveOccurred())
 			var replicas int32 = 2
 			labels := map[string]string{"egress-code": "red"}
@@ -773,7 +772,7 @@ var _ = Describe("Egress Gateway controller tests", func() {
 			installation.Status.CalicoVersion = "3.15"
 			Expect(c.Create(ctx, installation)).NotTo(HaveOccurred())
 
-			var requeueInterval time.Duration = 30 * time.Second
+			var requeueInterval = 30 * time.Second
 
 			labels := map[string]string{"egress-code": "red"}
 			egw := &operatorv1.EgressGateway{
diff --git a/pkg/controller/egressgateway/egressgateway_suite_test.go b/pkg/controller/egressgateway/egressgateway_suite_test.go
index cc8dfa6a4a..dada73d25b 100644
--- a/pkg/controller/egressgateway/egressgateway_suite_test.go
+++ b/pkg/controller/egressgateway/egressgateway_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -23,7 +23,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	"github.com/onsi/ginkgo/reporters"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 )
 
 func TestStatus(t *testing.T) {
diff --git a/pkg/controller/gatewayapi/gatewayapi_controller_suite_test.go b/pkg/controller/gatewayapi/gatewayapi_controller_suite_test.go
index ce308589a1..c1d7382273 100644
--- a/pkg/controller/gatewayapi/gatewayapi_controller_suite_test.go
+++ b/pkg/controller/gatewayapi/gatewayapi_controller_suite_test.go
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	"github.com/onsi/ginkgo/reporters"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 )
 
 func TestStatus(t *testing.T) {
diff --git a/pkg/controller/gatewayapi/gatewayapi_controller_test.go b/pkg/controller/gatewayapi/gatewayapi_controller_test.go
index fdf19bd5e2..6da6d95db7 100644
--- a/pkg/controller/gatewayapi/gatewayapi_controller_test.go
+++ b/pkg/controller/gatewayapi/gatewayapi_controller_test.go
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	. "github.com/onsi/gomega/gstruct"
 	"github.com/stretchr/testify/mock"
 
diff --git a/pkg/controller/installation/bpf.go b/pkg/controller/installation/bpf.go
index d70d21b59d..eb9ddc787d 100644
--- a/pkg/controller/installation/bpf.go
+++ b/pkg/controller/installation/bpf.go
@@ -47,7 +47,7 @@ func bpfValidateAnnotations(fc *crdv1.FelixConfiguration) error {
 	match = match || annotationValue != nil && fc.Spec.BPFEnabled != nil && *annotationValue == *fc.Spec.BPFEnabled
 
 	if !match {
-		return errors.New(`Unable to set bpfEnabled: FelixConfiguration "default" has been modified by someone else, refusing to override potential user configuration.`)
+		return errors.New(`unable to set bpfEnabled: FelixConfiguration "default" has been modified by someone else, refusing to override potential user configuration`)
 	}
 
 	return nil
diff --git a/pkg/controller/installation/bpf_test.go b/pkg/controller/installation/bpf_test.go
index d81e088b2b..ba454caf6c 100644
--- a/pkg/controller/installation/bpf_test.go
+++ b/pkg/controller/installation/bpf_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -23,7 +23,7 @@ import (
 	"github.com/tigera/operator/pkg/render"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
diff --git a/pkg/controller/installation/core_controller.go b/pkg/controller/installation/core_controller.go
index 2ff3b1d2c2..75643ab526 100644
--- a/pkg/controller/installation/core_controller.go
+++ b/pkg/controller/installation/core_controller.go
@@ -58,8 +58,6 @@ import (
 	v3 "github.com/tigera/api/pkg/apis/projectcalico/v3"
 	calicoclient "github.com/tigera/api/pkg/client/clientset_generated/clientset"
 	operator "github.com/tigera/operator/api/v1"
-	operatorv1 "github.com/tigera/operator/api/v1"
-	v1 "github.com/tigera/operator/api/v1"
 	"github.com/tigera/operator/pkg/active"
 	crdv1 "github.com/tigera/operator/pkg/apis/crd.projectcalico.org/v1"
 	"github.com/tigera/operator/pkg/common"
@@ -575,11 +573,8 @@ func fillDefaults(instance *operator.Installation, currentPools *crdv1.IPPoolLis
 		}
 	}
 
-	needIPv4Autodetection := false
-	if *instance.Spec.CalicoNetwork.LinuxDataplane == operator.LinuxDataplaneBPF {
-		// BPF dataplane requires IP autodetection even if we're not using Calico IPAM.
-		needIPv4Autodetection = true
-	}
+	// BPF dataplane requires IP autodetection even if we're not using Calico IPAM.
+	needIPv4Autodetection := *instance.Spec.CalicoNetwork.LinuxDataplane == operator.LinuxDataplaneBPF
 	if currentPools != nil {
 		for _, pool := range currentPools.Items {
 			ip, _, err := net.ParseCIDR(pool.Spec.CIDR)
@@ -1304,11 +1299,11 @@ func (r *ReconcileInstallation) Reconcile(ctx context.Context, request reconcile
 		}))
 
 	// Check if non-cluster host feature is enabled.
-	var nonclusterhost *operatorv1.NonClusterHost
+	var nonclusterhost *operator.NonClusterHost
 	if instance.Spec.Variant == operator.TigeraSecureEnterprise {
 		nonclusterhost, err = utils.GetNonClusterHost(ctx, r.client)
 		if err != nil {
-			r.status.SetDegraded(operatorv1.ResourceReadError, "Failed to query NonClusterHost resource", err, reqLogger)
+			r.status.SetDegraded(operator.ResourceReadError, "Failed to query NonClusterHost resource", err, reqLogger)
 			return reconcile.Result{}, err
 		} else if nonclusterhost != nil {
 			// This is the default common name in CSR from non-cluster hosts.
@@ -1330,7 +1325,7 @@ func (r *ReconcileInstallation) Reconcile(ctx context.Context, request reconcile
 			if r.typhaAutoscalerNonClusterHost == nil {
 				calicoClient, err := calicoclient.NewForConfig(r.config)
 				if err != nil {
-					r.status.SetDegraded(operatorv1.InvalidConfigurationError, "Failed to initialize Calico client", err, reqLogger)
+					r.status.SetDegraded(operator.InvalidConfigurationError, "Failed to initialize Calico client", err, reqLogger)
 					return reconcile.Result{}, err
 				}
 
@@ -1417,7 +1412,7 @@ func (r *ReconcileInstallation) Reconcile(ctx context.Context, request reconcile
 	var goldmaneRunning bool
 	// Goldmane can only be running if the variant is Calico and the Whisker CRD exists.
 	if instance.Spec.Variant == operator.Calico {
-		goldmaneCR, err := utils.GetIfExists[operatorv1.Goldmane](ctx, utils.DefaultInstanceKey, r.client)
+		goldmaneCR, err := utils.GetIfExists[operator.Goldmane](ctx, utils.DefaultInstanceKey, r.client)
 		if err != nil {
 			r.status.SetDegraded(operator.ResourceReadError, "Unable retrieve Goldmane CR", err, reqLogger)
 			return reconcile.Result{}, err
@@ -1771,7 +1766,7 @@ func (r *ReconcileInstallation) setNftablesMode(_ context.Context, install *oper
 	// we don't need to handle upgrades from versions that were previously FelixConfiguration only - nftables mode has always
 	// been controlled by the operator.
 	if install.Spec.CalicoNetwork.LinuxDataplane != nil {
-		if *install.Spec.CalicoNetwork.LinuxDataplane == operatorv1.LinuxDataplaneNftables {
+		if *install.Spec.CalicoNetwork.LinuxDataplane == operator.LinuxDataplaneNftables {
 			// The operator is configured to use the nftables dataplane. Configure Felix to use nftables.
 			nftablesMode := crdv1.NFTablesModeEnabled
 			fc.Spec.NFTablesMode = &nftablesMode
@@ -2096,9 +2091,9 @@ func addCRDWatches(c ctrlruntime.Controller, v operator.ProductVariant) error {
 }
 
 func crdPoolsToOperator(crds []crdv1.IPPool) []operator.IPPool {
-	pools := []v1.IPPool{}
+	pools := []operator.IPPool{}
 	for _, p := range crds {
-		op := v1.IPPool{}
+		op := operator.IPPool{}
 		op.FromProjectCalicoV1(p)
 		pools = append(pools, op)
 	}
diff --git a/pkg/controller/installation/core_controller_test.go b/pkg/controller/installation/core_controller_test.go
index eb6641ed4a..f314cc7079 100644
--- a/pkg/controller/installation/core_controller_test.go
+++ b/pkg/controller/installation/core_controller_test.go
@@ -23,7 +23,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	"github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/go-logr/logr"
 	"github.com/stretchr/testify/mock"
diff --git a/pkg/controller/installation/defaults_test.go b/pkg/controller/installation/defaults_test.go
index 9fa3f56688..258c8c38af 100644
--- a/pkg/controller/installation/defaults_test.go
+++ b/pkg/controller/installation/defaults_test.go
@@ -22,7 +22,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	"github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	operator "github.com/tigera/operator/api/v1"
 	crdv1 "github.com/tigera/operator/pkg/apis/crd.projectcalico.org/v1"
 	"github.com/tigera/operator/pkg/components"
@@ -107,7 +107,7 @@ var _ = Describe("Defaulting logic tests", func() {
 		false_ := false
 		var twentySeven int32 = 27
 		var oneTwoThree int32 = 123
-		var one intstr.IntOrString = intstr.FromInt(1)
+		var one = intstr.FromInt(1)
 		var replicas int32 = 3
 		var logFileMaxCount uint32 = 5
 		var logFileMaxAgeDays uint32 = 10
@@ -199,7 +199,7 @@ var _ = Describe("Defaulting logic tests", func() {
 		var nodeMetricsPort int32 = 9081
 		false_ := false
 		var twentySeven int32 = 27
-		var one intstr.IntOrString = intstr.FromInt(1)
+		var one = intstr.FromInt(1)
 		var replicas int32 = 3
 		var logFileMaxCount uint32 = 5
 		var logFileMaxAgeDays uint32 = 10
diff --git a/pkg/controller/installation/installation_controller_suite_test.go b/pkg/controller/installation/installation_controller_suite_test.go
index 0032006d3d..982aa467ee 100644
--- a/pkg/controller/installation/installation_controller_suite_test.go
+++ b/pkg/controller/installation/installation_controller_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019-2021, 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019-2021, 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 	uzap "go.uber.org/zap"
diff --git a/pkg/controller/installation/typha_autoscaler_test.go b/pkg/controller/installation/typha_autoscaler_test.go
index c9df48746a..57f78001e8 100644
--- a/pkg/controller/installation/typha_autoscaler_test.go
+++ b/pkg/controller/installation/typha_autoscaler_test.go
@@ -20,7 +20,7 @@ import (
 	"time"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"github.com/stretchr/testify/mock"
 
 	operator "github.com/tigera/operator/api/v1"
diff --git a/pkg/controller/installation/validation.go b/pkg/controller/installation/validation.go
index de077e2a35..cb85ba0447 100644
--- a/pkg/controller/installation/validation.go
+++ b/pkg/controller/installation/validation.go
@@ -130,7 +130,7 @@ func validateCustomResource(instance *operatorv1.Installation) error {
 		}
 	default:
 		// The specified CNI plugin is not supported by this version of the operator.
-		return fmt.Errorf("Invalid value '%s' for spec.cni.type, it should be one of %s",
+		return fmt.Errorf("invalid value '%s' for spec.cni.type, it should be one of %s",
 			instance.Spec.CNI.Type, strings.Join(operatorv1.CNIPluginTypesString, ","))
 	}
 
@@ -173,7 +173,7 @@ func validateCustomResource(instance *operatorv1.Installation) error {
 					case operatorv1.EncapsulationNone:
 						// Unencapsulated currently requires BGP to be running in order to program routes.
 						if instance.Spec.CalicoNetwork.BGP == nil || *instance.Spec.CalicoNetwork.BGP == operatorv1.BGPDisabled {
-							return fmt.Errorf("Unencapsulated IP pools require that BGP is enabled")
+							return fmt.Errorf("unencapsulated IP pools require that BGP is enabled")
 						}
 					}
 				case operatorv1.IPAMPluginHostLocal:
@@ -207,10 +207,10 @@ func validateCustomResource(instance *operatorv1.Installation) error {
 		// VPP specific validation
 		if instance.Spec.CalicoNetwork.LinuxDataplane != nil && *instance.Spec.CalicoNetwork.LinuxDataplane == operatorv1.LinuxDataplaneVPP {
 			if instance.Spec.Variant != operatorv1.Calico {
-				return fmt.Errorf("The VPP dataplane only supports the Calico variant (configured: %s)", instance.Spec.Variant)
+				return fmt.Errorf("the VPP dataplane only supports the Calico variant (configured: %s)", instance.Spec.Variant)
 			}
 			if instance.Spec.CNI.Type != operatorv1.PluginCalico {
-				return fmt.Errorf("The VPP dataplane only supports the Calico CNI (configured: %s)", instance.Spec.CNI.Type)
+				return fmt.Errorf("the VPP dataplane only supports the Calico CNI (configured: %s)", instance.Spec.CNI.Type)
 			}
 			if instance.Spec.CalicoNetwork.BGP == nil || *instance.Spec.CalicoNetwork.BGP == operatorv1.BGPDisabled {
 				return fmt.Errorf("VPP requires BGP to be enabled")
@@ -286,33 +286,33 @@ func validateCustomResource(instance *operatorv1.Installation) error {
 
 	// Verify that the flexvolume path is valid - either "None" (to disable) or a valid absolute path.
 	if instance.Spec.FlexVolumePath != "None" && !path.IsAbs(instance.Spec.FlexVolumePath) {
-		return fmt.Errorf("Installation spec.FlexVolumePath '%s' is not an absolute path",
+		return fmt.Errorf("installation spec.FlexVolumePath '%s' is not an absolute path",
 			instance.Spec.FlexVolumePath)
 	}
 
 	// Verify that the kubeletVolumePluginPath is valid - either "None" (to disable) or a valid absolute path.
 	if instance.Spec.KubeletVolumePluginPath != "None" && !path.IsAbs(instance.Spec.KubeletVolumePluginPath) {
-		return fmt.Errorf("Installation spec.KubeletVolumePluginPath '%s' is not an absolute path",
+		return fmt.Errorf("installation spec.KubeletVolumePluginPath '%s' is not an absolute path",
 			instance.Spec.KubeletVolumePluginPath)
 	}
 
 	// We only support RollingUpdate for the node daemonset strategy.
 	if instance.Spec.NodeUpdateStrategy.Type != appsv1.RollingUpdateDaemonSetStrategyType {
-		return fmt.Errorf("Installation spec.NodeUpdateStrategy.type '%s' is not supported",
+		return fmt.Errorf("installation spec.NodeUpdateStrategy.type '%s' is not supported",
 			instance.Spec.NodeUpdateStrategy.RollingUpdate)
 	}
 
 	if instance.Spec.ControlPlaneNodeSelector != nil {
 		if v, ok := instance.Spec.ControlPlaneNodeSelector["beta.kubernetes.io/os"]; ok && v != "linux" {
-			return fmt.Errorf("Installation spec.ControlPlaneNodeSelector 'beta.kubernetes.io/os=%s' is not supported", v)
+			return fmt.Errorf("installation spec.ControlPlaneNodeSelector 'beta.kubernetes.io/os=%s' is not supported", v)
 		}
 		if v, ok := instance.Spec.ControlPlaneNodeSelector["kubernetes.io/os"]; ok && v != "linux" {
-			return fmt.Errorf("Installation spec.ControlPlaneNodeSelector 'kubernetes.io/os=%s' is not supported", v)
+			return fmt.Errorf("installation spec.ControlPlaneNodeSelector 'kubernetes.io/os=%s' is not supported", v)
 		}
 	}
 
 	if instance.Spec.ControlPlaneReplicas != nil && *instance.Spec.ControlPlaneReplicas <= 0 {
-		return fmt.Errorf("Installation spec.ControlPlaneReplicas should be greater than 0")
+		return fmt.Errorf("installation spec.ControlPlaneReplicas should be greater than 0")
 	}
 
 	validComponentNames := map[operatorv1.ComponentName]struct{}{
@@ -323,7 +323,7 @@ func validateCustomResource(instance *operatorv1.Installation) error {
 
 	for _, resource := range instance.Spec.ComponentResources {
 		if _, ok := validComponentNames[resource.ComponentName]; !ok {
-			return fmt.Errorf("Installation spec.ComponentResources.ComponentName %s is not supported", resource.ComponentName)
+			return fmt.Errorf("installation spec.ComponentResources.ComponentName %s is not supported", resource.ComponentName)
 		}
 	}
 
@@ -336,7 +336,7 @@ func validateCustomResource(instance *operatorv1.Installation) error {
 	if ds := instance.Spec.CalicoNodeDaemonSet; ds != nil {
 		err := validation.ValidateReplicatedPodResourceOverrides(ds, node.ValidateCalicoNodeDaemonSetContainer, node.ValidateCalicoNodeDaemonSetInitContainer)
 		if err != nil {
-			return fmt.Errorf("Installation spec.CalicoNodeDaemonSet is not valid: %w", err)
+			return fmt.Errorf("installation spec.CalicoNodeDaemonSet is not valid: %w", err)
 		}
 	}
 
@@ -344,7 +344,7 @@ func validateCustomResource(instance *operatorv1.Installation) error {
 	if ds := instance.Spec.CalicoNodeWindowsDaemonSet; ds != nil {
 		err := validation.ValidateReplicatedPodResourceOverrides(ds, node.ValidateCalicoNodeWindowsDaemonSetContainer, node.ValidateCalicoNodeWindowsDaemonSetInitContainer)
 		if err != nil {
-			return fmt.Errorf("Installation spec.CalicoNodeWindowsDaemonSet is not valid: %w", err)
+			return fmt.Errorf("installation spec.CalicoNodeWindowsDaemonSet is not valid: %w", err)
 		}
 	}
 
@@ -352,7 +352,7 @@ func validateCustomResource(instance *operatorv1.Installation) error {
 	if deploy := instance.Spec.CalicoKubeControllersDeployment; deploy != nil {
 		err := validation.ValidateReplicatedPodResourceOverrides(deploy, kubecontrollers.ValidateCalicoKubeControllersDeploymentContainer, validation.NoContainersDefined)
 		if err != nil {
-			return fmt.Errorf("Installation spec.CalicoKubeControllersDeployment is not valid: %w", err)
+			return fmt.Errorf("installation spec.CalicoKubeControllersDeployment is not valid: %w", err)
 		}
 	}
 
@@ -360,7 +360,7 @@ func validateCustomResource(instance *operatorv1.Installation) error {
 	if deploy := instance.Spec.TyphaDeployment; deploy != nil {
 		err := validation.ValidateReplicatedPodResourceOverrides(deploy, typha.ValidateTyphaDeploymentContainer, typha.ValidateTyphaDeploymentInitContainer)
 		if err != nil {
-			return fmt.Errorf("Installation spec.TyphaDeployment is not valid: %w", err)
+			return fmt.Errorf("installation spec.TyphaDeployment is not valid: %w", err)
 		}
 	}
 
@@ -368,24 +368,24 @@ func validateCustomResource(instance *operatorv1.Installation) error {
 	if ds := instance.Spec.CSINodeDriverDaemonSet; ds != nil {
 		err := validation.ValidateReplicatedPodResourceOverrides(ds, csinodedriver.ValidateCSINodeDriverDaemonSetContainer, validation.NoContainersDefined)
 		if err != nil {
-			return fmt.Errorf("Installation spec.CSINodeDriverDaemonSet is not valid: %w", err)
+			return fmt.Errorf("installation spec.CSINodeDriverDaemonSet is not valid: %w", err)
 		}
 	}
 
 	// Verify CNILogging to not exist for non-calico cni
 	if cni := instance.Spec.CNI.Type; cni != operatorv1.PluginCalico {
 		if instance.Spec.Logging != nil && instance.Spec.Logging.CNI != nil {
-			return fmt.Errorf("Installation spec.Logging.cni is not valid and should not be provided when spec.cni.type is Not Calico")
+			return fmt.Errorf("installation spec.Logging.cni is not valid and should not be provided when spec.cni.type is Not Calico")
 		}
 	}
 
 	if common.WindowsEnabled(instance.Spec) {
 		if k8sapi.Endpoint.Host == "" || k8sapi.Endpoint.Port == "" {
-			return fmt.Errorf("Services endpoint configmap '%s' does not have all required information for Calico Windows daemonset configuration", render.K8sSvcEndpointConfigMapName)
+			return fmt.Errorf("services endpoint configmap '%s' does not have all required information for Calico Windows daemonset configuration", render.K8sSvcEndpointConfigMapName)
 		}
 		if instance.Spec.CNI.Type == operatorv1.PluginCalico {
 			if len(instance.Spec.ServiceCIDRs) == 0 {
-				return fmt.Errorf("Installation spec.ServiceCIDRs must be provided when using Calico CNI on Windows")
+				return fmt.Errorf("installation spec.ServiceCIDRs must be provided when using Calico CNI on Windows")
 			}
 			if instance.Spec.CalicoNetwork != nil {
 				if v4pool := render.GetIPv4Pool(instance.Spec.CalicoNetwork.IPPools); v4pool != nil {
@@ -397,16 +397,16 @@ func validateCustomResource(instance *operatorv1.Installation) error {
 		}
 	} else {
 		if instance.Spec.WindowsNodes != nil {
-			return fmt.Errorf("Installation spec.WindowsNodes is not valid and should not be provided when Calico for Windows is disabled")
+			return fmt.Errorf("installation spec.WindowsNodes is not valid and should not be provided when Calico for Windows is disabled")
 		}
 	}
 
 	if operatorv1.IsFIPSModeEnabled(instance.Spec.FIPSMode) && instance.Spec.Variant == operatorv1.TigeraSecureEnterprise {
-		return fmt.Errorf("Installation spec.FIPSMode=%v combined with spec.Variant=%s is not supported", *instance.Spec.FIPSMode, instance.Spec.Variant)
+		return fmt.Errorf("installation spec.FIPSMode=%v combined with spec.Variant=%s is not supported", *instance.Spec.FIPSMode, instance.Spec.Variant)
 	}
 
 	if instance.Spec.KubernetesProvider != operatorv1.ProviderAKS && instance.Spec.Azure != nil {
-		return fmt.Errorf("Installation spec.Azure should be set only for AKS provider")
+		return fmt.Errorf("installation spec.Azure should be set only for AKS provider")
 	}
 
 	return nil
diff --git a/pkg/controller/installation/validation_test.go b/pkg/controller/installation/validation_test.go
index 57ed3d77e9..2b66f90a76 100644
--- a/pkg/controller/installation/validation_test.go
+++ b/pkg/controller/installation/validation_test.go
@@ -23,7 +23,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	appsv1 "k8s.io/api/apps/v1"
 	v1 "k8s.io/api/core/v1"
 
@@ -74,7 +74,7 @@ var _ = Describe("Installation validation tests", func() {
 	})
 
 	It("should allow dual stack (both IPv4 and IPv6) if BPF is enabled", func() {
-		var enabled operator.BGPOption = operator.BGPEnabled
+		var enabled = operator.BGPEnabled
 		instance.Spec.CalicoNetwork.BGP = &enabled
 		bpf := operator.LinuxDataplaneBPF
 		instance.Spec.CalicoNetwork.LinuxDataplane = &bpf
@@ -980,7 +980,7 @@ var _ = Describe("Installation validation tests", func() {
 					NodeSelector:  "all()",
 				},
 			}
-			var disabled operator.BGPOption = operator.BGPDisabled
+			var disabled = operator.BGPDisabled
 			instance.Spec.CalicoNetwork.BGP = &disabled
 			k8sapi.Endpoint = k8sapi.ServiceEndpoint{
 				Host: "1.2.3.4",
@@ -995,7 +995,7 @@ var _ = Describe("Installation validation tests", func() {
 
 				err := validateCustomResource(instance)
 				Expect(err).To(HaveOccurred())
-				Expect(err.Error()).To(Equal("Installation spec.WindowsNodes is not valid and should not be provided when Calico for Windows is disabled"))
+				Expect(err.Error()).To(Equal("installation spec.WindowsNodes is not valid and should not be provided when Calico for Windows is disabled"))
 			})
 		})
 		Context("Calico CNI", func() {
@@ -1010,19 +1010,19 @@ var _ = Describe("Installation validation tests", func() {
 				k8sapi.Endpoint = k8sapi.ServiceEndpoint{}
 				err := validateCustomResource(instance)
 				Expect(err).To(HaveOccurred())
-				Expect(err.Error()).To(Equal("Services endpoint configmap 'kubernetes-services-endpoint' does not have all required information for Calico Windows daemonset configuration"))
+				Expect(err.Error()).To(Equal("services endpoint configmap 'kubernetes-services-endpoint' does not have all required information for Calico Windows daemonset configuration"))
 			})
 
 			It("should return an error if instance.Spec.ServiceCIDRs is not configured", func() {
 				instance.Spec.ServiceCIDRs = []string{}
 				err := validateCustomResource(instance)
 				Expect(err).To(HaveOccurred())
-				Expect(err.Error()).To(Equal("Installation spec.ServiceCIDRs must be provided when using Calico CNI on Windows"))
+				Expect(err.Error()).To(Equal("installation spec.ServiceCIDRs must be provided when using Calico CNI on Windows"))
 			})
 
 			It("should return an error if IP pool encapsulation is IPIP", func() {
 				instance.Spec.CalicoNetwork.IPPools[0].Encapsulation = operator.EncapsulationIPIP
-				var enabled operator.BGPOption = operator.BGPEnabled
+				var enabled = operator.BGPEnabled
 				instance.Spec.CalicoNetwork.BGP = &enabled
 				err := validateCustomResource(instance)
 				Expect(err).To(HaveOccurred())
@@ -1049,7 +1049,7 @@ var _ = Describe("Installation validation tests", func() {
 				k8sapi.Endpoint = k8sapi.ServiceEndpoint{}
 				err := validateCustomResource(instance)
 				Expect(err).To(HaveOccurred())
-				Expect(err.Error()).To(Equal("Services endpoint configmap 'kubernetes-services-endpoint' does not have all required information for Calico Windows daemonset configuration"))
+				Expect(err.Error()).To(Equal("services endpoint configmap 'kubernetes-services-endpoint' does not have all required information for Calico Windows daemonset configuration"))
 			})
 
 			It("should not return an error if instance.Spec.ServiceCIDRs is not configured", func() {
diff --git a/pkg/controller/installation/version.go b/pkg/controller/installation/version.go
index 0ee52dd2bd..d16253a673 100644
--- a/pkg/controller/installation/version.go
+++ b/pkg/controller/installation/version.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -68,7 +68,7 @@ func versionFromBuildVersion(buildVersion string) (*gv.Version, error) {
 	// Make sure the build version is a valid version.
 	matches := versionRegexp.FindStringSubmatch(buildVersion)
 	if matches == nil {
-		return nil, fmt.Errorf("Invalid build version: %q", buildVersion)
+		return nil, fmt.Errorf("invalid build version: %q", buildVersion)
 	}
 
 	s := gitDescribeSuffixRegexp.ReplaceAllString(buildVersion, "")
diff --git a/pkg/controller/installation/version_test.go b/pkg/controller/installation/version_test.go
index b0d2b824b3..676e075c9b 100644
--- a/pkg/controller/installation/version_test.go
+++ b/pkg/controller/installation/version_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"fmt"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	gv "github.com/hashicorp/go-version"
 	"github.com/onsi/ginkgo/extensions/table"
@@ -65,10 +65,10 @@ var _ = Describe("Version validation logic tests", func() {
 		table.Entry("happy path 3", "v1.0.1-11-ga64", "1.0.1", nil),
 		table.Entry("happy path 4", "v3-11-ga64", "3.0.0", nil),
 		table.Entry("invalid build version", "ga64a5a6", "",
-			fmt.Errorf(`Invalid build version: "ga64a5a6"`)),
+			fmt.Errorf(`invalid build version: "ga64a5a6"`)),
 		table.Entry("dirty build version", "ga64a5a6-dirty", "",
-			fmt.Errorf(`Invalid build version: "ga64a5a6-dirty"`)),
+			fmt.Errorf(`invalid build version: "ga64a5a6-dirty"`)),
 		table.Entry("empty build version", "", "",
-			fmt.Errorf(`Invalid build version: ""`)),
+			fmt.Errorf(`invalid build version: ""`)),
 	)
 })
diff --git a/pkg/controller/installation/windows/windows_suite_test.go b/pkg/controller/installation/windows/windows_suite_test.go
index fed6f18643..c04e07c59f 100644
--- a/pkg/controller/installation/windows/windows_suite_test.go
+++ b/pkg/controller/installation/windows/windows_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019-2026 Tigera, Inc. All rights reserved.
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
@@ -17,7 +17,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 	uzap "go.uber.org/zap"
diff --git a/pkg/controller/installation/windows_controller.go b/pkg/controller/installation/windows_controller.go
index 648fed0923..1335df09fb 100644
--- a/pkg/controller/installation/windows_controller.go
+++ b/pkg/controller/installation/windows_controller.go
@@ -69,7 +69,7 @@ func AddWindowsController(mgr manager.Manager, opts options.AddOptions) error {
 
 	c, err := ctrlruntime.NewController("tigera-windows-controller", mgr, controller.Options{Reconciler: ri})
 	if err != nil {
-		return fmt.Errorf("Failed to create tigera-windows-controller: %w", err)
+		return fmt.Errorf("failed to create tigera-windows-controller: %w", err)
 	}
 
 	// Watch for changes to primary resource Installation
diff --git a/pkg/controller/installation/windows_controller_test.go b/pkg/controller/installation/windows_controller_test.go
index a468173710..d5a1e8efe4 100644
--- a/pkg/controller/installation/windows_controller_test.go
+++ b/pkg/controller/installation/windows_controller_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 	"fmt"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/stretchr/testify/mock"
 
@@ -352,13 +352,13 @@ var _ = Describe("windows-controller installation tests", func() {
 
 				_, err := r.Reconcile(ctx, reconcile.Request{})
 				Expect(err).Should(HaveOccurred())
-				Expect(err.Error()).To(Equal("Services endpoint configmap 'kubernetes-services-endpoint' does not have all required information for Calico Windows daemonset configuration"))
+				Expect(err.Error()).To(Equal("services endpoint configmap 'kubernetes-services-endpoint' does not have all required information for Calico Windows daemonset configuration"))
 
 				// The calico-node-windows daemonset should be rendered, but in a degraded state
 				Expect(test.GetResource(c, &dsWin)).To(HaveOccurred())
 				Expect(dsWin.Spec).To(Equal(appsv1.DaemonSetSpec{}))
 				Expect(degradedMsg).To(ConsistOf([]string{"Invalid Installation provided"}))
-				Expect(degradedErr).To(ConsistOf([]string{"Services endpoint configmap 'kubernetes-services-endpoint' does not have all required information for Calico Windows daemonset configuration"}))
+				Expect(degradedErr).To(ConsistOf([]string{"services endpoint configmap 'kubernetes-services-endpoint' does not have all required information for Calico Windows daemonset configuration"}))
 			})
 
 			It("should not render the Windows daemonset when the encapsulation is VXLANCrossSubnet (not supported)", func() {
@@ -488,7 +488,7 @@ var _ = Describe("windows-controller installation tests", func() {
 
 				_, err := r.Reconcile(ctx, reconcile.Request{})
 				Expect(err).Should(HaveOccurred())
-				Expect(err.Error()).To(Equal("Installation spec.ServiceCIDRs must be provided when using Calico CNI on Windows"))
+				Expect(err.Error()).To(Equal("installation spec.ServiceCIDRs must be provided when using Calico CNI on Windows"))
 
 				Expect(test.GetResource(c, &dsWin)).To(HaveOccurred())
 				Expect(dsWin.Spec).To(Equal(appsv1.DaemonSetSpec{}))
diff --git a/pkg/controller/intrusiondetection/intrusiondetection_controller_test.go b/pkg/controller/intrusiondetection/intrusiondetection_controller_test.go
index b1086b7bae..7646148d24 100644
--- a/pkg/controller/intrusiondetection/intrusiondetection_controller_test.go
+++ b/pkg/controller/intrusiondetection/intrusiondetection_controller_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2020, 2022-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020, 2022-2024,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@ import (
 	"time"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"github.com/stretchr/testify/mock"
 
 	esv1 "github.com/elastic/cloud-on-k8s/v2/pkg/apis/elasticsearch/v1"
diff --git a/pkg/controller/intrusiondetection/intrusiondetection_suite_test.go b/pkg/controller/intrusiondetection/intrusiondetection_suite_test.go
index 4344095edd..97fc75bae5 100644
--- a/pkg/controller/intrusiondetection/intrusiondetection_suite_test.go
+++ b/pkg/controller/intrusiondetection/intrusiondetection_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2020-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/controller/ippool/defaults.go b/pkg/controller/ippool/defaults.go
index ccc37fb7e7..b70782ec09 100644
--- a/pkg/controller/ippool/defaults.go
+++ b/pkg/controller/ippool/defaults.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -71,7 +71,7 @@ func fillDefaults(ctx context.Context, client client.Client, instance *operator.
 	if instance.Spec.CNI == nil || instance.Spec.CNI.IPAM == nil {
 		// These fields are needed for IP pool defaulting but defaulted themselves by the core Installation controller, which this controller waits for before
 		// running. We should never hit this branch, but handle it just in case.
-		return fmt.Errorf("Cannot perform IP pool defaulting until CNI configuration is available")
+		return fmt.Errorf("cannot perform IP pool defaulting until CNI configuration is available")
 	}
 
 	// Only add default CIDRs if there are no existing pools in the cluster. If there are existing pools in the cluster,
@@ -83,12 +83,12 @@ func fillDefaults(ctx context.Context, client client.Client, instance *operator.
 			openshiftConfig := &configv1.Network{}
 			openshiftNetworkConfig := "cluster"
 			if err := client.Get(ctx, types.NamespacedName{Name: openshiftNetworkConfig}, openshiftConfig); err != nil {
-				return fmt.Errorf("Unable to read openshift network configuration: %s", err.Error())
+				return fmt.Errorf("unable to read openshift network configuration: %s", err.Error())
 			}
 
 			// Merge in OpenShift configuration.
 			if err := updateInstallationForOpenshiftNetwork(instance, openshiftConfig); err != nil {
-				return fmt.Errorf("Could not resolve CalicoNetwork IPPool and OpenShift network: %s", err.Error())
+				return fmt.Errorf("could not resolve CalicoNetwork IPPool and OpenShift network: %s", err.Error())
 			}
 		} else {
 			// Check if we're running on kubeadm by getting the config map.
@@ -98,10 +98,10 @@ func fillDefaults(ctx context.Context, client client.Client, instance *operator.
 			if err := client.Get(ctx, key, kubeadmConfig); err == nil {
 				// We found the configmap - merge in kubeadm configuration.
 				if err := updateInstallationForKubeadm(instance, kubeadmConfig); err != nil {
-					return fmt.Errorf("Could not resolve CalicoNetwork IPPool and kubeadm configuration: %s", err.Error())
+					return fmt.Errorf("could not resolve CalicoNetwork IPPool and kubeadm configuration: %s", err.Error())
 				}
 			} else if !apierrors.IsNotFound(err) {
-				return fmt.Errorf("Unable to read kubeadm config map: %s", err.Error())
+				return fmt.Errorf("unable to read kubeadm config map: %s", err.Error())
 			}
 		}
 
diff --git a/pkg/controller/ippool/kubeadm_test.go b/pkg/controller/ippool/kubeadm_test.go
index c2b693e094..a154d543e3 100644
--- a/pkg/controller/ippool/kubeadm_test.go
+++ b/pkg/controller/ippool/kubeadm_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2020-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ package ippool
 
 import (
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	corev1 "k8s.io/api/core/v1"
 )
 
diff --git a/pkg/controller/ippool/pool_controller.go b/pkg/controller/ippool/pool_controller.go
index fd8877d613..21935e00ac 100644
--- a/pkg/controller/ippool/pool_controller.go
+++ b/pkg/controller/ippool/pool_controller.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -25,7 +25,6 @@ import (
 	v3 "github.com/tigera/api/pkg/apis/projectcalico/v3"
 
 	operator "github.com/tigera/operator/api/v1"
-	v1 "github.com/tigera/operator/api/v1"
 	crdv1 "github.com/tigera/operator/pkg/apis/crd.projectcalico.org/v1"
 	"github.com/tigera/operator/pkg/controller/options"
 	"github.com/tigera/operator/pkg/controller/status"
@@ -33,7 +32,6 @@ import (
 	"github.com/tigera/operator/pkg/ctrlruntime"
 	"github.com/tigera/operator/pkg/render"
 
-	"k8s.io/apimachinery/pkg/api/errors"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -64,7 +62,7 @@ func Add(mgr manager.Manager, opts options.AddOptions) error {
 
 	c, err := ctrlruntime.NewController("tigera-ippool-controller", mgr, controller.Options{Reconciler: r})
 	if err != nil {
-		return fmt.Errorf("Failed to create tigera-ippool-controller: %w", err)
+		return fmt.Errorf("failed to create tigera-ippool-controller: %w", err)
 	}
 
 	// Watch for changes to primary resource Installation
@@ -188,7 +186,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, request reconcile.Request) (
 	// Get all IP pools currently in the cluster.
 	currentPools := &crdv1.IPPoolList{}
 	err := r.client.List(ctx, currentPools)
-	if err != nil && !errors.IsNotFound(err) {
+	if err != nil && !apierrors.IsNotFound(err) {
 		r.status.SetDegraded(operator.ResourceReadError, "error querying IP pools", err, reqLogger)
 		return reconcile.Result{}, err
 	}
@@ -224,7 +222,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, request reconcile.Request) (
 		r.status.SetDegraded(operator.ResourceNotReady, "Error querying APIServer", err, reqLogger)
 		return reconcile.Result{}, err
 	}
-	apiAvailable := apiserver != nil && apiserver.Status.State == v1.TigeraStatusReady
+	apiAvailable := apiserver != nil && apiserver.Status.State == operator.TigeraStatusReady
 
 	// Create a lookup map of pools owned by this controller for easy access.
 	// This controller will only modify IP pools if:
@@ -247,7 +245,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, request reconcile.Request) (
 			// Without this logic, this controller would consider these pools as not owned by itself, resulting in errors
 			// when it attempts to create overlappin IP pools.
 			for _, cnp := range installation.Spec.CalicoNetwork.IPPools {
-				v1p := v1.IPPool{}
+				v1p := operator.IPPool{}
 				v1p.FromProjectCalicoV1(p)
 				reqLogger.V(1).Info("Comparing IP pool", "clusterPool", p, "installationPool", cnp)
 				if !reflect.DeepEqual(cnp, v1p) {
@@ -393,10 +391,10 @@ func (r *Reconciler) Reconcile(ctx context.Context, request reconcile.Request) (
 	return reconcile.Result{}, nil
 }
 
-func CRDPoolsToOperator(crds []crdv1.IPPool) []v1.IPPool {
-	pools := []v1.IPPool{}
+func CRDPoolsToOperator(crds []crdv1.IPPool) []operator.IPPool {
+	pools := []operator.IPPool{}
 	for _, p := range crds {
-		op := v1.IPPool{}
+		op := operator.IPPool{}
 		op.FromProjectCalicoV1(p)
 		pools = append(pools, op)
 	}
diff --git a/pkg/controller/ippool/pool_controller_suite_test.go b/pkg/controller/ippool/pool_controller_suite_test.go
index e4f6192478..6f68bfedc2 100644
--- a/pkg/controller/ippool/pool_controller_suite_test.go
+++ b/pkg/controller/ippool/pool_controller_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 	uzap "go.uber.org/zap"
diff --git a/pkg/controller/ippool/pool_controller_test.go b/pkg/controller/ippool/pool_controller_test.go
index e30c13fa38..f97ffa6ffb 100644
--- a/pkg/controller/ippool/pool_controller_test.go
+++ b/pkg/controller/ippool/pool_controller_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	"github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"github.com/stretchr/testify/mock"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
@@ -800,7 +800,7 @@ var _ = Describe("validate()", func() {
 	It("should not allow blocksize to exceed the pool size", func() {
 		// Try with an invalid block size.
 		var twentySix int32 = 26
-		var enabled operator.BGPOption = operator.BGPEnabled
+		enabled := operator.BGPEnabled
 		instance.Spec.CalicoNetwork.BGP = &enabled
 		instance.Spec.CalicoNetwork.IPPools = []operator.IPPool{
 			{
@@ -827,7 +827,7 @@ var _ = Describe("validate()", func() {
 		var blockSizeJustRight int32 = 32
 
 		// Start with a valid block size - /32 - just on the border.
-		var enabled operator.BGPOption = operator.BGPEnabled
+		enabled := operator.BGPEnabled
 		instance.Spec.CalicoNetwork.BGP = &enabled
 		instance.Spec.CalicoNetwork.IPPools = []operator.IPPool{
 			{
diff --git a/pkg/controller/ippool/pool_conversion_test.go b/pkg/controller/ippool/pool_conversion_test.go
index 045181ff4e..3746732419 100644
--- a/pkg/controller/ippool/pool_conversion_test.go
+++ b/pkg/controller/ippool/pool_conversion_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2024-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ package ippool
 
 import (
 	"github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	operator "github.com/tigera/operator/api/v1"
 )
 
diff --git a/pkg/controller/ippool/validation.go b/pkg/controller/ippool/validation.go
index 75984b357d..a1a72de0ed 100644
--- a/pkg/controller/ippool/validation.go
+++ b/pkg/controller/ippool/validation.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -83,7 +83,7 @@ func ValidatePools(instance *operator.Installation) error {
 		if instance.Spec.CNI == nil {
 			// We expect this to be defaulted by the core Installation controller prior to the IP pool controller
 			// being invoked, but check just in case.
-			return fmt.Errorf("No CNI plugin specified in Installation resource")
+			return fmt.Errorf("no CNI plugin specified in Installation resource")
 		}
 		if instance.Spec.CNI.Type != operator.PluginCalico {
 			if pool.NodeSelector != "all()" {
@@ -115,7 +115,7 @@ func ValidatePools(instance *operator.Installation) error {
 				// Verify that the CIDR contains the blocksize.
 				ones, _ := cidr.Mask.Size()
 				if int32(ones) > *pool.BlockSize {
-					return fmt.Errorf("IP pool size is too small. It must be equal to or greater than the block size.")
+					return fmt.Errorf("IP pool size is too small: it must be equal to or greater than the block size")
 				}
 			}
 		} else {
@@ -128,7 +128,7 @@ func ValidatePools(instance *operator.Installation) error {
 				// Verify that the CIDR contains the blocksize.
 				ones, _ := cidr.Mask.Size()
 				if int32(ones) > *pool.BlockSize {
-					return fmt.Errorf("IP pool size is too small. It must be equal to or greater than the block size.")
+					return fmt.Errorf("IP pool size is too small: it must be equal to or greater than the block size")
 				}
 			}
 		}
diff --git a/pkg/controller/logcollector/logcollector_controller_test.go b/pkg/controller/logcollector/logcollector_controller_test.go
index 404c56b140..a347385a2e 100644
--- a/pkg/controller/logcollector/logcollector_controller_test.go
+++ b/pkg/controller/logcollector/logcollector_controller_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2020-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 	"fmt"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/stretchr/testify/mock"
 
diff --git a/pkg/controller/logcollector/logcollector_suite_test.go b/pkg/controller/logcollector/logcollector_suite_test.go
index 54211f1a1d..40d3d4e25f 100644
--- a/pkg/controller/logcollector/logcollector_suite_test.go
+++ b/pkg/controller/logcollector/logcollector_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2020, 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020, 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/controller/logstorage/dashboards/dashboards_controller.go b/pkg/controller/logstorage/dashboards/dashboards_controller.go
index 9305677eeb..411a0e0c9e 100644
--- a/pkg/controller/logstorage/dashboards/dashboards_controller.go
+++ b/pkg/controller/logstorage/dashboards/dashboards_controller.go
@@ -381,7 +381,7 @@ func parsePort(port string) (uint16, error) {
 		return 0, err
 	}
 	if kibanaPort > math.MaxInt16 {
-		return 0, fmt.Errorf("Kibana port is larger them max %d", math.MaxInt16)
+		return 0, fmt.Errorf("kibana port is larger them max %d", math.MaxInt16)
 	}
 	return uint16(kibanaPort), nil
 }
diff --git a/pkg/controller/logstorage/dashboards/dashboards_controller_test.go b/pkg/controller/logstorage/dashboards/dashboards_controller_test.go
index 40f1f41de3..15ea57afb9 100644
--- a/pkg/controller/logstorage/dashboards/dashboards_controller_test.go
+++ b/pkg/controller/logstorage/dashboards/dashboards_controller_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2024-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -21,7 +21,7 @@ import (
 	"github.com/tigera/operator/pkg/render/logstorage/dashboards"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/stretchr/testify/mock"
 
diff --git a/pkg/controller/logstorage/dashboards/dashboards_suite_test.go b/pkg/controller/logstorage/dashboards/dashboards_suite_test.go
index db60801bcd..0ea4ab3a2b 100644
--- a/pkg/controller/logstorage/dashboards/dashboards_suite_test.go
+++ b/pkg/controller/logstorage/dashboards/dashboards_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2024-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 	uzap "go.uber.org/zap"
diff --git a/pkg/controller/logstorage/elastic/elastic_controller_test.go b/pkg/controller/logstorage/elastic/elastic_controller_test.go
index aa4d51eddf..d679c36e75 100644
--- a/pkg/controller/logstorage/elastic/elastic_controller_test.go
+++ b/pkg/controller/logstorage/elastic/elastic_controller_test.go
@@ -19,7 +19,7 @@ import (
 	"fmt"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/stretchr/testify/mock"
 
diff --git a/pkg/controller/logstorage/elastic/elastic_suite_test.go b/pkg/controller/logstorage/elastic/elastic_suite_test.go
index 5f6fe856b6..a445f4398d 100644
--- a/pkg/controller/logstorage/elastic/elastic_suite_test.go
+++ b/pkg/controller/logstorage/elastic/elastic_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 	uzap "go.uber.org/zap"
diff --git a/pkg/controller/logstorage/elastic/external_elastic_controller_test.go b/pkg/controller/logstorage/elastic/external_elastic_controller_test.go
index b8c648d4a1..75bd1e49f3 100644
--- a/pkg/controller/logstorage/elastic/external_elastic_controller_test.go
+++ b/pkg/controller/logstorage/elastic/external_elastic_controller_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2022-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022-2026 Tigera, Inc. All rights reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -31,7 +31,7 @@ import (
 	"github.com/tigera/operator/pkg/render/common/secret"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	admissionv1beta1 "k8s.io/api/admissionregistration/v1beta1"
 	appsv1 "k8s.io/api/apps/v1"
diff --git a/pkg/controller/logstorage/esmetrics/esmetrics_controller_test.go b/pkg/controller/logstorage/esmetrics/esmetrics_controller_test.go
index 2c848717a4..08543e256c 100644
--- a/pkg/controller/logstorage/esmetrics/esmetrics_controller_test.go
+++ b/pkg/controller/logstorage/esmetrics/esmetrics_controller_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"context"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"github.com/stretchr/testify/mock"
 
 	admissionv1beta1 "k8s.io/api/admissionregistration/v1beta1"
diff --git a/pkg/controller/logstorage/esmetrics/esmetrics_suite_test.go b/pkg/controller/logstorage/esmetrics/esmetrics_suite_test.go
index 797cbee889..e188b83755 100644
--- a/pkg/controller/logstorage/esmetrics/esmetrics_suite_test.go
+++ b/pkg/controller/logstorage/esmetrics/esmetrics_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 	uzap "go.uber.org/zap"
diff --git a/pkg/controller/logstorage/initializer/conditions_controller_test.go b/pkg/controller/logstorage/initializer/conditions_controller_test.go
index 72fe138b9b..5aa0086721 100644
--- a/pkg/controller/logstorage/initializer/conditions_controller_test.go
+++ b/pkg/controller/logstorage/initializer/conditions_controller_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2020-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 	"time"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	admissionv1beta1 "k8s.io/api/admissionregistration/v1beta1"
 	appsv1 "k8s.io/api/apps/v1"
diff --git a/pkg/controller/logstorage/initializer/initializer_suite_test.go b/pkg/controller/logstorage/initializer/initializer_suite_test.go
index 0c7775e5a1..610d7260b9 100644
--- a/pkg/controller/logstorage/initializer/initializer_suite_test.go
+++ b/pkg/controller/logstorage/initializer/initializer_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 	uzap "go.uber.org/zap"
diff --git a/pkg/controller/logstorage/initializer/initializing_controller_test.go b/pkg/controller/logstorage/initializer/initializing_controller_test.go
index 439443756c..091d03277c 100644
--- a/pkg/controller/logstorage/initializer/initializing_controller_test.go
+++ b/pkg/controller/logstorage/initializer/initializing_controller_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2020-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 	"reflect"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"github.com/stretchr/testify/mock"
 
 	admissionv1beta1 "k8s.io/api/admissionregistration/v1beta1"
diff --git a/pkg/controller/logstorage/kubecontrollers/es_kube_controllers_test.go b/pkg/controller/logstorage/kubecontrollers/es_kube_controllers_test.go
index 6fa940c941..26ba883284 100644
--- a/pkg/controller/logstorage/kubecontrollers/es_kube_controllers_test.go
+++ b/pkg/controller/logstorage/kubecontrollers/es_kube_controllers_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -24,7 +24,7 @@ import (
 	v3 "github.com/tigera/api/pkg/apis/projectcalico/v3"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/stretchr/testify/mock"
 
diff --git a/pkg/controller/logstorage/kubecontrollers/kubecontrollers_suite_test.go b/pkg/controller/logstorage/kubecontrollers/kubecontrollers_suite_test.go
index b8d259365a..b1a28b461c 100644
--- a/pkg/controller/logstorage/kubecontrollers/kubecontrollers_suite_test.go
+++ b/pkg/controller/logstorage/kubecontrollers/kubecontrollers_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 	uzap "go.uber.org/zap"
diff --git a/pkg/controller/logstorage/linseed/linseed_controller_test.go b/pkg/controller/logstorage/linseed/linseed_controller_test.go
index 355b4c5cd2..31893ce61c 100644
--- a/pkg/controller/logstorage/linseed/linseed_controller_test.go
+++ b/pkg/controller/logstorage/linseed/linseed_controller_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 	"fmt"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/stretchr/testify/mock"
 
diff --git a/pkg/controller/logstorage/linseed/linseed_suite_test.go b/pkg/controller/logstorage/linseed/linseed_suite_test.go
index c13aaa872b..c9f8bf7075 100644
--- a/pkg/controller/logstorage/linseed/linseed_suite_test.go
+++ b/pkg/controller/logstorage/linseed/linseed_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 	uzap "go.uber.org/zap"
diff --git a/pkg/controller/logstorage/logstorage_controller_suite_test.go b/pkg/controller/logstorage/logstorage_controller_suite_test.go
index 9df170dd63..6d7c7fed2a 100644
--- a/pkg/controller/logstorage/logstorage_controller_suite_test.go
+++ b/pkg/controller/logstorage/logstorage_controller_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 	uzap "go.uber.org/zap"
diff --git a/pkg/controller/logstorage/managedcluster/managed_cluster_controller_test.go b/pkg/controller/logstorage/managedcluster/managed_cluster_controller_test.go
index ac9b0d8139..f7c5bc4efe 100644
--- a/pkg/controller/logstorage/managedcluster/managed_cluster_controller_test.go
+++ b/pkg/controller/logstorage/managedcluster/managed_cluster_controller_test.go
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	admissionv1beta1 "k8s.io/api/admissionregistration/v1beta1"
 	appsv1 "k8s.io/api/apps/v1"
diff --git a/pkg/controller/logstorage/managedcluster/managed_cluster_suite_test.go b/pkg/controller/logstorage/managedcluster/managed_cluster_suite_test.go
index 58275bb883..18c1ea9b6e 100644
--- a/pkg/controller/logstorage/managedcluster/managed_cluster_suite_test.go
+++ b/pkg/controller/logstorage/managedcluster/managed_cluster_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 	uzap "go.uber.org/zap"
diff --git a/pkg/controller/logstorage/secrets/secret_controller_suite_test.go b/pkg/controller/logstorage/secrets/secret_controller_suite_test.go
index aa8393d439..1870cab6a8 100644
--- a/pkg/controller/logstorage/secrets/secret_controller_suite_test.go
+++ b/pkg/controller/logstorage/secrets/secret_controller_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 	uzap "go.uber.org/zap"
diff --git a/pkg/controller/logstorage/secrets/secret_controller_test.go b/pkg/controller/logstorage/secrets/secret_controller_test.go
index b16c14c06d..87fff77639 100644
--- a/pkg/controller/logstorage/secrets/secret_controller_test.go
+++ b/pkg/controller/logstorage/secrets/secret_controller_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@ import (
 	"fmt"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/stretchr/testify/mock"
 
diff --git a/pkg/controller/logstorage/users/users_controller_suite_test.go b/pkg/controller/logstorage/users/users_controller_suite_test.go
index ab898f7d96..81dc04fbac 100644
--- a/pkg/controller/logstorage/users/users_controller_suite_test.go
+++ b/pkg/controller/logstorage/users/users_controller_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 	uzap "go.uber.org/zap"
diff --git a/pkg/controller/logstorage/users/users_controller_test.go b/pkg/controller/logstorage/users/users_controller_test.go
index e9207f93b1..65c1893d9f 100644
--- a/pkg/controller/logstorage/users/users_controller_test.go
+++ b/pkg/controller/logstorage/users/users_controller_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -21,7 +21,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	apiv1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
diff --git a/pkg/controller/manager/manager_controller.go b/pkg/controller/manager/manager_controller.go
index 0abadd0295..4ce3ff48f6 100644
--- a/pkg/controller/manager/manager_controller.go
+++ b/pkg/controller/manager/manager_controller.go
@@ -606,7 +606,7 @@ func (r *ReconcileManager) Reconcile(ctx context.Context, request reconcile.Requ
 
 	// Set replicas to 1 for management or managed clusters.
 	// TODO Remove after MCM tigera-manager HA deployment is supported.
-	var replicas *int32 = installation.ControlPlaneReplicas
+	replicas := installation.ControlPlaneReplicas
 	if managementCluster != nil || managementClusterConnection != nil {
 		var mcmReplicas int32 = 1
 		replicas = &mcmReplicas
diff --git a/pkg/controller/manager/manager_controller_suite_test.go b/pkg/controller/manager/manager_controller_suite_test.go
index 2473bf8727..ee9122dd5a 100644
--- a/pkg/controller/manager/manager_controller_suite_test.go
+++ b/pkg/controller/manager/manager_controller_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019, 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019, 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 	uzap "go.uber.org/zap"
diff --git a/pkg/controller/manager/manager_controller_test.go b/pkg/controller/manager/manager_controller_test.go
index ba28d2d3fb..7c739fb6a0 100644
--- a/pkg/controller/manager/manager_controller_test.go
+++ b/pkg/controller/manager/manager_controller_test.go
@@ -23,7 +23,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/stretchr/testify/mock"
 
@@ -51,7 +51,6 @@ import (
 	"github.com/tigera/operator/pkg/render"
 	relasticsearch "github.com/tigera/operator/pkg/render/common/elasticsearch"
 	"github.com/tigera/operator/pkg/render/common/secret"
-	rsecret "github.com/tigera/operator/pkg/render/common/secret"
 	"github.com/tigera/operator/pkg/render/logstorage/eck"
 	"github.com/tigera/operator/pkg/render/monitor"
 	tigeratls "github.com/tigera/operator/pkg/tls"
@@ -362,14 +361,14 @@ var _ = Describe("Manager controller tests", func() {
 			_, err := r.Reconcile(ctx, reconcile.Request{})
 			Expect(err).ShouldNot(HaveOccurred())
 
-			secret := &corev1.Secret{}
+			s := &corev1.Secret{}
 			// Verify that the operator managed cert secrets exist. These cert
 			// secrets should have the manager service DNS names plus localhost only.
-			Expect(c.Get(ctx, types.NamespacedName{Name: render.ManagerTLSSecretName, Namespace: common.OperatorNamespace()}, secret)).ShouldNot(HaveOccurred())
-			test.VerifyCert(secret, []string{"localhost"}...)
+			Expect(c.Get(ctx, types.NamespacedName{Name: render.ManagerTLSSecretName, Namespace: common.OperatorNamespace()}, s)).ShouldNot(HaveOccurred())
+			test.VerifyCert(s, []string{"localhost"}...)
 
-			Expect(c.Get(ctx, types.NamespacedName{Name: render.ManagerTLSSecretName, Namespace: render.ManagerNamespace}, secret)).ShouldNot(HaveOccurred())
-			test.VerifyCert(secret, []string{"localhost"}...)
+			Expect(c.Get(ctx, types.NamespacedName{Name: render.ManagerTLSSecretName, Namespace: render.ManagerNamespace}, s)).ShouldNot(HaveOccurred())
+			test.VerifyCert(s, []string{"localhost"}...)
 
 			// Check that the internal secret was copied over to the manager namespace
 			internalSecret := &corev1.Secret{}
@@ -378,27 +377,27 @@ var _ = Describe("Manager controller tests", func() {
 			// Create a custom manager cert secret.
 			dnsNames := []string{"manager.example.com", "192.168.10.22"}
 			testCA := test.MakeTestCA("manager-test")
-			customSecret, err := rsecret.CreateTLSSecret(
+			customSecret, err := secret.CreateTLSSecret(
 				testCA, render.ManagerTLSSecretName, common.OperatorNamespace(), corev1.TLSPrivateKeyKey, corev1.TLSCertKey, tigeratls.DefaultCertificateDuration, nil, dnsNames...)
 			Expect(err).ShouldNot(HaveOccurred())
 
 			// Update the existing operator managed cert secret with bytes from
 			// the custom manager cert secret.
-			Expect(c.Get(ctx, types.NamespacedName{Name: render.ManagerTLSSecretName, Namespace: common.OperatorNamespace()}, secret)).ShouldNot(HaveOccurred())
-			secret.Data[corev1.TLSCertKey] = customSecret.Data[corev1.TLSCertKey]
-			secret.Data[corev1.TLSPrivateKeyKey] = customSecret.Data[corev1.TLSPrivateKeyKey]
-			Expect(c.Update(ctx, secret)).NotTo(HaveOccurred())
+			Expect(c.Get(ctx, types.NamespacedName{Name: render.ManagerTLSSecretName, Namespace: common.OperatorNamespace()}, s)).ShouldNot(HaveOccurred())
+			s.Data[corev1.TLSCertKey] = customSecret.Data[corev1.TLSCertKey]
+			s.Data[corev1.TLSPrivateKeyKey] = customSecret.Data[corev1.TLSPrivateKeyKey]
+			Expect(c.Update(ctx, s)).NotTo(HaveOccurred())
 
 			_, err = r.Reconcile(ctx, reconcile.Request{})
 			Expect(err).ShouldNot(HaveOccurred())
 
 			// Verify that the existing certs have changed - check that the
 			// certs have the DNS names in the user-supplied cert.
-			Expect(c.Get(ctx, types.NamespacedName{Name: render.ManagerTLSSecretName, Namespace: common.OperatorNamespace()}, secret)).ShouldNot(HaveOccurred())
-			test.VerifyCert(secret, dnsNames...)
+			Expect(c.Get(ctx, types.NamespacedName{Name: render.ManagerTLSSecretName, Namespace: common.OperatorNamespace()}, s)).ShouldNot(HaveOccurred())
+			test.VerifyCert(s, dnsNames...)
 
-			Expect(c.Get(ctx, types.NamespacedName{Name: render.ManagerTLSSecretName, Namespace: render.ManagerNamespace}, secret)).ShouldNot(HaveOccurred())
-			test.VerifyCert(secret, dnsNames...)
+			Expect(c.Get(ctx, types.NamespacedName{Name: render.ManagerTLSSecretName, Namespace: render.ManagerNamespace}, s)).ShouldNot(HaveOccurred())
+			test.VerifyCert(s, dnsNames...)
 		})
 
 		It("should replace the internal manager TLS cert secret if its DNS names are invalid", func() {
diff --git a/pkg/controller/migration/cni/cni.go b/pkg/controller/migration/cni/cni.go
index 2a37e5a56f..87e3d4c3d6 100644
--- a/pkg/controller/migration/cni/cni.go
+++ b/pkg/controller/migration/cni/cni.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2020-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -114,7 +114,7 @@ func unmarshalCNIConfList(cniConfig string) (*libcni.NetworkConfigList, error) {
 	// __CNI_MTU__ as an integer, e.g. { "mtu": __CNI_MTU__ }
 	// in such cases, replace it with a placeholder, so that we can json load it, and still
 	// know that it should be substituted later during validation.
-	cniConfig = strings.Replace(cniConfig, "__CNI_MTU__", "-1", -1)
+	cniConfig = strings.ReplaceAll(cniConfig, "__CNI_MTU__", "-1")
 
 	confList, err := libcni.ConfListFromBytes([]byte(cniConfig))
 	if err == nil {
diff --git a/pkg/controller/migration/cni/cni_test.go b/pkg/controller/migration/cni/cni_test.go
index d8253d6306..02814dc3e6 100644
--- a/pkg/controller/migration/cni/cni_test.go
+++ b/pkg/controller/migration/cni/cni_test.go
@@ -18,7 +18,7 @@ import (
 	"fmt"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 )
 
 const cniTemplate = `{
diff --git a/pkg/controller/migration/convert/addon_manager_test.go b/pkg/controller/migration/convert/addon_manager_test.go
index a160ba662f..0e39211185 100644
--- a/pkg/controller/migration/convert/addon_manager_test.go
+++ b/pkg/controller/migration/convert/addon_manager_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2022-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ package convert
 
 import (
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	v1 "github.com/tigera/operator/api/v1"
 )
 
diff --git a/pkg/controller/migration/convert/bpf_test.go b/pkg/controller/migration/convert/bpf_test.go
index cdfbf0a28f..48f79ec62f 100644
--- a/pkg/controller/migration/convert/bpf_test.go
+++ b/pkg/controller/migration/convert/bpf_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2022-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ package convert
 
 import (
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
 	operatorv1 "github.com/tigera/operator/api/v1"
@@ -27,7 +27,6 @@ import (
 	"github.com/tigera/operator/pkg/render"
 
 	corev1 "k8s.io/api/core/v1"
-	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	kscheme "k8s.io/client-go/kubernetes/scheme"
@@ -46,7 +45,7 @@ var (
 	}
 )
 
-func getEndPointCM(c *components, ns string) (error, map[string]string) {
+func getEndPointCM(c *components, ns string) (map[string]string, error) {
 	cm := &corev1.ConfigMap{}
 	cmNamespacedName := types.NamespacedName{
 		Name:      cmName,
@@ -54,9 +53,9 @@ func getEndPointCM(c *components, ns string) (error, map[string]string) {
 	}
 	err := c.client.Get(ctx, cmNamespacedName, cm)
 	if err != nil {
-		return err, nil
+		return nil, err
 	}
-	return nil, cm.Data
+	return cm.Data, nil
 }
 
 var _ = Describe("convert bpf config", func() {
@@ -82,7 +81,7 @@ var _ = Describe("convert bpf config", func() {
 		Expect(err).ToNot(HaveOccurred())
 		Expect(*i.Spec.CalicoNetwork.LinuxDataplane).To(BeEquivalentTo(operatorv1.LinuxDataplaneBPF))
 		Expect(i.Spec.CalicoNetwork.HostPorts).To(BeNil())
-		err, data := getEndPointCM(&comps, common.OperatorNamespace())
+		data, err := getEndPointCM(&comps, common.OperatorNamespace())
 		Expect(err).ToNot(HaveOccurred())
 		Expect(data).To(Equal(cmData))
 	})
@@ -94,10 +93,10 @@ var _ = Describe("convert bpf config", func() {
 		err := handleBPF(&comps, i)
 		Expect(err).ToNot(HaveOccurred())
 		Expect(i.Spec.CalicoNetwork).To(BeNil())
-		err, data := getEndPointCM(&comps, "kube-system")
+		data, err := getEndPointCM(&comps, "kube-system")
 		Expect(err).ToNot(HaveOccurred())
 		Expect(data).To(Equal(cmData))
-		err, data = getEndPointCM(&comps, common.OperatorNamespace())
+		data, err = getEndPointCM(&comps, common.OperatorNamespace())
 		Expect(err).To(HaveOccurred())
 		Expect(data).To(BeNil())
 	})
@@ -106,14 +105,14 @@ var _ = Describe("convert bpf config", func() {
 		comps.client = ctrlrfake.DefaultFakeClientBuilder(scheme).WithObjects(endPointCM).Build()
 		err := handleBPF(&comps, i)
 		Expect(err).To(HaveOccurred())
-		err, data := getEndPointCM(&comps, "kube-system")
+		data, err := getEndPointCM(&comps, "kube-system")
 		Expect(err).ToNot(HaveOccurred())
 		Expect(data).To(Equal(cmData))
 	})
 
 	It("converts dataplane to BPF given bpfenabled env var set to true", func() {
 		comps.client = ctrlrfake.DefaultFakeClientBuilder(scheme).WithObjects(endPointCM, f).Build()
-		comps.node.Spec.Template.Spec.Containers[0].Env = []v1.EnvVar{{
+		comps.node.Spec.Template.Spec.Containers[0].Env = []corev1.EnvVar{{
 			Name:  "FELIX_BPFENABLED",
 			Value: "true",
 		}}
@@ -121,24 +120,24 @@ var _ = Describe("convert bpf config", func() {
 		Expect(err).ToNot(HaveOccurred())
 		Expect(*i.Spec.CalicoNetwork.LinuxDataplane).To(BeEquivalentTo(operatorv1.LinuxDataplaneBPF))
 		Expect(i.Spec.CalicoNetwork.HostPorts).To(BeNil())
-		err, data := getEndPointCM(&comps, common.OperatorNamespace())
+		data, err := getEndPointCM(&comps, common.OperatorNamespace())
 		Expect(err).ToNot(HaveOccurred())
 		Expect(data).To(Equal(cmData))
 	})
 
 	It("converts dataplane to empty given bpfenabled env var set to false", func() {
 		comps.client = ctrlrfake.DefaultFakeClientBuilder(scheme).WithObjects(endPointCM, f).Build()
-		comps.node.Spec.Template.Spec.Containers[0].Env = []v1.EnvVar{{
+		comps.node.Spec.Template.Spec.Containers[0].Env = []corev1.EnvVar{{
 			Name:  "FELIX_BPFENABLED",
 			Value: "false",
 		}}
 		err := handleBPF(&comps, i)
 		Expect(err).ToNot(HaveOccurred())
 		Expect(i.Spec.CalicoNetwork).To(BeNil())
-		err, data := getEndPointCM(&comps, "kube-system")
+		data, err := getEndPointCM(&comps, "kube-system")
 		Expect(err).ToNot(HaveOccurred())
 		Expect(data).To(Equal(cmData))
-		err, data = getEndPointCM(&comps, common.OperatorNamespace())
+		data, err = getEndPointCM(&comps, common.OperatorNamespace())
 		Expect(err).To(HaveOccurred())
 		Expect(data).To(BeNil())
 	})
@@ -149,10 +148,10 @@ var _ = Describe("convert bpf config", func() {
 		err := handleBPF(&comps, i)
 		Expect(err).ToNot(HaveOccurred())
 		Expect(i.Spec.CalicoNetwork).To(BeNil())
-		err, data := getEndPointCM(&comps, "kube-system")
+		data, err := getEndPointCM(&comps, "kube-system")
 		Expect(err).ToNot(HaveOccurred())
 		Expect(data).To(Equal(cmData))
-		err, data = getEndPointCM(&comps, common.OperatorNamespace())
+		data, err = getEndPointCM(&comps, common.OperatorNamespace())
 		Expect(err).To(HaveOccurred())
 		Expect(data).To(BeNil())
 	})
diff --git a/pkg/controller/migration/convert/convert_suite_test.go b/pkg/controller/migration/convert/convert_suite_test.go
index cd871b1641..2841843bd7 100644
--- a/pkg/controller/migration/convert/convert_suite_test.go
+++ b/pkg/controller/migration/convert/convert_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2022-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	"github.com/onsi/ginkgo/reporters"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	uzap "go.uber.org/zap"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
diff --git a/pkg/controller/migration/convert/convert_test.go b/pkg/controller/migration/convert/convert_test.go
index 3c5e7cd91f..593c5b7f7c 100644
--- a/pkg/controller/migration/convert/convert_test.go
+++ b/pkg/controller/migration/convert/convert_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2022-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 	"fmt"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/tigera/operator/pkg/apis"
 	crdv1 "github.com/tigera/operator/pkg/apis/crd.projectcalico.org/v1"
diff --git a/pkg/controller/migration/convert/core.go b/pkg/controller/migration/convert/core.go
index 4a10e74db3..9ff8067984 100644
--- a/pkg/controller/migration/convert/core.go
+++ b/pkg/controller/migration/convert/core.go
@@ -331,7 +331,7 @@ func removeExpectedAnnotations(existing, ignoreWithValue map[string]string, toBe
 func handleNodeSelectors(c *components, install *operatorv1.Installation) error {
 	// check calico-node nodeSelectors
 	if c.node.Spec.Template.Spec.Affinity != nil {
-		if !(install.Spec.KubernetesProvider.IsAKS() && reflect.DeepEqual(c.node.Spec.Template.Spec.Affinity, &corev1.Affinity{
+		if (!install.Spec.KubernetesProvider.IsAKS() || !reflect.DeepEqual(c.node.Spec.Template.Spec.Affinity, &corev1.Affinity{
 			NodeAffinity: &corev1.NodeAffinity{
 				RequiredDuringSchedulingIgnoredDuringExecution: &corev1.NodeSelector{
 					NodeSelectorTerms: []corev1.NodeSelectorTerm{{
@@ -343,7 +343,7 @@ func handleNodeSelectors(c *components, install *operatorv1.Installation) error
 					}},
 				},
 			},
-		})) && !(install.Spec.KubernetesProvider.IsEKS() && reflect.DeepEqual(c.node.Spec.Template.Spec.Affinity, &corev1.Affinity{
+		})) && (!install.Spec.KubernetesProvider.IsEKS() || !reflect.DeepEqual(c.node.Spec.Template.Spec.Affinity, &corev1.Affinity{
 			NodeAffinity: &corev1.NodeAffinity{
 				RequiredDuringSchedulingIgnoredDuringExecution: &corev1.NodeSelector{
 					NodeSelectorTerms: []corev1.NodeSelectorTerm{{
diff --git a/pkg/controller/migration/convert/core_test.go b/pkg/controller/migration/convert/core_test.go
index 8ba7d854b4..f133fa9023 100644
--- a/pkg/controller/migration/convert/core_test.go
+++ b/pkg/controller/migration/convert/core_test.go
@@ -18,11 +18,10 @@ import (
 	"time"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
-	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	"k8s.io/apimachinery/pkg/util/intstr"
 
@@ -47,14 +46,14 @@ var _ = Describe("core handler", func() {
 			Expect(i.Spec.ComponentResources).To(BeEmpty())
 		})
 
-		var rqs = v1.ResourceRequirements{
-			Limits: v1.ResourceList{
-				v1.ResourceCPU:    resource.MustParse("500m"),
-				v1.ResourceMemory: resource.MustParse("500Mi"),
+		var rqs = corev1.ResourceRequirements{
+			Limits: corev1.ResourceList{
+				corev1.ResourceCPU:    resource.MustParse("500m"),
+				corev1.ResourceMemory: resource.MustParse("500Mi"),
 			},
-			Requests: v1.ResourceList{
-				v1.ResourceCPU:    resource.MustParse("250m"),
-				v1.ResourceMemory: resource.MustParse("64Mi"),
+			Requests: corev1.ResourceList{
+				corev1.ResourceCPU:    resource.MustParse("250m"),
+				corev1.ResourceMemory: resource.MustParse("64Mi"),
 			},
 		}
 
@@ -85,9 +84,9 @@ var _ = Describe("core handler", func() {
 			}))
 		})
 		It("should migrate resources from all 3 components", func() {
-			rqs = v1.ResourceRequirements{
-				Limits: v1.ResourceList{
-					v1.ResourceCPU: resource.MustParse("500m"),
+			rqs = corev1.ResourceRequirements{
+				Limits: corev1.ResourceList{
+					corev1.ResourceCPU: resource.MustParse("500m"),
 				},
 			}
 			expectedCompRsrc := []operatorv1.ComponentResource{operatorv1.ComponentResource{
@@ -95,13 +94,13 @@ var _ = Describe("core handler", func() {
 				ResourceRequirements: rqs.DeepCopy(),
 			}}
 			comps.node.Spec.Template.Spec.Containers[0].Resources = *rqs.DeepCopy()
-			rqs.Limits[v1.ResourceCPU] = resource.MustParse("400m")
+			rqs.Limits[corev1.ResourceCPU] = resource.MustParse("400m")
 			expectedCompRsrc = append(expectedCompRsrc, operatorv1.ComponentResource{
 				ComponentName:        operatorv1.ComponentNameKubeControllers,
 				ResourceRequirements: rqs.DeepCopy(),
 			})
 			comps.kubeControllers.Spec.Template.Spec.Containers[0].Resources = *rqs.DeepCopy()
-			rqs.Limits[v1.ResourceCPU] = resource.MustParse("300m")
+			rqs.Limits[corev1.ResourceCPU] = resource.MustParse("300m")
 			expectedCompRsrc = append(expectedCompRsrc, operatorv1.ComponentResource{
 				ComponentName:        operatorv1.ComponentNameTypha,
 				ResourceRequirements: rqs.DeepCopy(),
@@ -171,17 +170,17 @@ var _ = Describe("core handler", func() {
 				Expect(handleNodeSelectors(&comps, i)).To(HaveOccurred())
 			})
 			It("should error for unexpected affinities", func() {
-				comps.node.Spec.Template.Spec.Affinity = &v1.Affinity{}
+				comps.node.Spec.Template.Spec.Affinity = &corev1.Affinity{}
 				Expect(handleNodeSelectors(&comps, i)).To(HaveOccurred())
 			})
 			It("shouldn't error for aks affinity on aks", func() {
-				comps.node.Spec.Template.Spec.Affinity = &v1.Affinity{
-					NodeAffinity: &v1.NodeAffinity{
-						RequiredDuringSchedulingIgnoredDuringExecution: &v1.NodeSelector{
-							NodeSelectorTerms: []v1.NodeSelectorTerm{{
-								MatchExpressions: []v1.NodeSelectorRequirement{{
+				comps.node.Spec.Template.Spec.Affinity = &corev1.Affinity{
+					NodeAffinity: &corev1.NodeAffinity{
+						RequiredDuringSchedulingIgnoredDuringExecution: &corev1.NodeSelector{
+							NodeSelectorTerms: []corev1.NodeSelectorTerm{{
+								MatchExpressions: []corev1.NodeSelectorRequirement{{
 									Key:      "type",
-									Operator: v1.NodeSelectorOpNotIn,
+									Operator: corev1.NodeSelectorOpNotIn,
 									Values:   []string{"virtual-kubelet"},
 								}},
 							}},
@@ -192,13 +191,13 @@ var _ = Describe("core handler", func() {
 				Expect(handleNodeSelectors(&comps, i)).ToNot(HaveOccurred())
 			})
 			It("shouldn't error for eks fargate affinity on eks ", func() {
-				comps.node.Spec.Template.Spec.Affinity = &v1.Affinity{
-					NodeAffinity: &v1.NodeAffinity{
-						RequiredDuringSchedulingIgnoredDuringExecution: &v1.NodeSelector{
-							NodeSelectorTerms: []v1.NodeSelectorTerm{{
-								MatchExpressions: []v1.NodeSelectorRequirement{{
+				comps.node.Spec.Template.Spec.Affinity = &corev1.Affinity{
+					NodeAffinity: &corev1.NodeAffinity{
+						RequiredDuringSchedulingIgnoredDuringExecution: &corev1.NodeSelector{
+							NodeSelectorTerms: []corev1.NodeSelectorTerm{{
+								MatchExpressions: []corev1.NodeSelectorRequirement{{
 									Key:      "eks.amazonaws.com/compute-type",
-									Operator: v1.NodeSelectorOpNotIn,
+									Operator: corev1.NodeSelectorOpNotIn,
 									Values:   []string{"fargate"},
 								}},
 							}},
@@ -209,13 +208,13 @@ var _ = Describe("core handler", func() {
 				Expect(handleNodeSelectors(&comps, i)).ToNot(HaveOccurred())
 			})
 			It("should error for other affinities on aks", func() {
-				comps.node.Spec.Template.Spec.Affinity = &v1.Affinity{
-					NodeAffinity: &v1.NodeAffinity{
-						RequiredDuringSchedulingIgnoredDuringExecution: &v1.NodeSelector{
-							NodeSelectorTerms: []v1.NodeSelectorTerm{{
-								MatchExpressions: []v1.NodeSelectorRequirement{{
+				comps.node.Spec.Template.Spec.Affinity = &corev1.Affinity{
+					NodeAffinity: &corev1.NodeAffinity{
+						RequiredDuringSchedulingIgnoredDuringExecution: &corev1.NodeSelector{
+							NodeSelectorTerms: []corev1.NodeSelectorTerm{{
+								MatchExpressions: []corev1.NodeSelectorRequirement{{
 									Key:      "type",
-									Operator: v1.NodeSelectorOpExists,
+									Operator: corev1.NodeSelectorOpExists,
 								}},
 							}},
 						},
@@ -225,13 +224,13 @@ var _ = Describe("core handler", func() {
 				Expect(handleNodeSelectors(&comps, i)).To(HaveOccurred())
 			})
 			It("should error for other affinities on eks", func() {
-				comps.node.Spec.Template.Spec.Affinity = &v1.Affinity{
-					NodeAffinity: &v1.NodeAffinity{
-						RequiredDuringSchedulingIgnoredDuringExecution: &v1.NodeSelector{
-							NodeSelectorTerms: []v1.NodeSelectorTerm{{
-								MatchExpressions: []v1.NodeSelectorRequirement{{
+				comps.node.Spec.Template.Spec.Affinity = &corev1.Affinity{
+					NodeAffinity: &corev1.NodeAffinity{
+						RequiredDuringSchedulingIgnoredDuringExecution: &corev1.NodeSelector{
+							NodeSelectorTerms: []corev1.NodeSelectorTerm{{
+								MatchExpressions: []corev1.NodeSelectorRequirement{{
 									Key:      "eks.amazonaws.com/compute-type",
-									Operator: v1.NodeSelectorOpExists,
+									Operator: corev1.NodeSelectorOpExists,
 								}},
 							}},
 						},
@@ -251,18 +250,18 @@ var _ = Describe("core handler", func() {
 					Expect(handleNodeSelectors(&comps, i)).ToNot(HaveOccurred())
 				})
 				It("should migrate a Preferred nodeAffinity", func() {
-					terms := []v1.PreferredSchedulingTerm{{
+					terms := []corev1.PreferredSchedulingTerm{{
 						Weight: 100,
-						Preference: v1.NodeSelectorTerm{
-							MatchExpressions: []v1.NodeSelectorRequirement{{
+						Preference: corev1.NodeSelectorTerm{
+							MatchExpressions: []corev1.NodeSelectorRequirement{{
 								Key:      "foo",
 								Operator: corev1.NodeSelectorOpIn,
 								Values:   []string{"foo", "bar"},
 							}},
 						},
 					}}
-					comps.typha.Spec.Template.Spec.Affinity = &v1.Affinity{
-						NodeAffinity: &v1.NodeAffinity{
+					comps.typha.Spec.Template.Spec.Affinity = &corev1.Affinity{
+						NodeAffinity: &corev1.NodeAffinity{
 							PreferredDuringSchedulingIgnoredDuringExecution: terms,
 						},
 					}
@@ -270,11 +269,11 @@ var _ = Describe("core handler", func() {
 					Expect(i.Spec.TyphaAffinity.NodeAffinity.PreferredDuringSchedulingIgnoredDuringExecution).To(Equal(terms))
 				})
 				It("should error for a Required nodeAffinity", func() {
-					comps.typha.Spec.Template.Spec.Affinity = &v1.Affinity{
-						NodeAffinity: &v1.NodeAffinity{
-							RequiredDuringSchedulingIgnoredDuringExecution: &v1.NodeSelector{
-								NodeSelectorTerms: []v1.NodeSelectorTerm{{
-									MatchFields: []v1.NodeSelectorRequirement{{
+					comps.typha.Spec.Template.Spec.Affinity = &corev1.Affinity{
+						NodeAffinity: &corev1.NodeAffinity{
+							RequiredDuringSchedulingIgnoredDuringExecution: &corev1.NodeSelector{
+								NodeSelectorTerms: []corev1.NodeSelectorTerm{{
+									MatchFields: []corev1.NodeSelectorRequirement{{
 										Key: "foo",
 									}},
 								}},
@@ -284,7 +283,7 @@ var _ = Describe("core handler", func() {
 					Expect(handleNodeSelectors(&comps, i)).To(HaveOccurred())
 				})
 				It("should not error if podAffinity is set", func() {
-					terms := []v1.PodAffinityTerm{{
+					terms := []corev1.PodAffinityTerm{{
 						LabelSelector: &metav1.LabelSelector{
 							MatchExpressions: []metav1.LabelSelectorRequirement{{
 								Key:      "foo",
@@ -293,8 +292,8 @@ var _ = Describe("core handler", func() {
 							}},
 						},
 					}}
-					comps.typha.Spec.Template.Spec.Affinity = &v1.Affinity{
-						PodAffinity: &v1.PodAffinity{
+					comps.typha.Spec.Template.Spec.Affinity = &corev1.Affinity{
+						PodAffinity: &corev1.PodAffinity{
 							RequiredDuringSchedulingIgnoredDuringExecution: terms,
 						},
 					}
@@ -302,7 +301,7 @@ var _ = Describe("core handler", func() {
 					Expect(i.Spec.TyphaDeployment.Spec.Template.Spec.Affinity.PodAffinity.RequiredDuringSchedulingIgnoredDuringExecution).To(Equal(terms))
 				})
 				It("should not error if podAntiAffinity is set", func() {
-					terms := []v1.PodAffinityTerm{{
+					terms := []corev1.PodAffinityTerm{{
 						LabelSelector: &metav1.LabelSelector{
 							MatchExpressions: []metav1.LabelSelectorRequirement{{
 								Key:      "foo",
@@ -311,8 +310,8 @@ var _ = Describe("core handler", func() {
 							}},
 						},
 					}}
-					comps.typha.Spec.Template.Spec.Affinity = &v1.Affinity{
-						PodAntiAffinity: &v1.PodAntiAffinity{
+					comps.typha.Spec.Template.Spec.Affinity = &corev1.Affinity{
+						PodAntiAffinity: &corev1.PodAntiAffinity{
 							RequiredDuringSchedulingIgnoredDuringExecution: terms,
 						},
 					}
@@ -374,18 +373,18 @@ var _ = Describe("core handler", func() {
 			Expect(i.Spec.FlexVolumePath).To(Equal("None"))
 		})
 		It("should carry forward flexvolumepath", func() {
-			hostPathDirectoryOrCreate := v1.HostPathDirectoryOrCreate
+			hostPathDirectoryOrCreate := corev1.HostPathDirectoryOrCreate
 			path := "/foo/bar/"
-			comps.node.Spec.Template.Spec.Volumes = append(comps.node.Spec.Template.Spec.Volumes, v1.Volume{
+			comps.node.Spec.Template.Spec.Volumes = append(comps.node.Spec.Template.Spec.Volumes, corev1.Volume{
 				Name: "flexvol-driver-host",
-				VolumeSource: v1.VolumeSource{
-					HostPath: &v1.HostPathVolumeSource{
+				VolumeSource: corev1.VolumeSource{
+					HostPath: &corev1.HostPathVolumeSource{
 						Path: path,
 						Type: &hostPathDirectoryOrCreate,
 					},
 				},
 			})
-			comps.node.Spec.Template.Spec.InitContainers = append(comps.node.Spec.Template.Spec.InitContainers, v1.Container{
+			comps.node.Spec.Template.Spec.InitContainers = append(comps.node.Spec.Template.Spec.InitContainers, corev1.Container{
 				Name: "flexvol-driver",
 			})
 
@@ -400,12 +399,12 @@ var _ = Describe("core handler", func() {
 		// a different env var name.
 		// the 'setEnvVars' function is used to update the correct container's env vars
 		// for the given test.
-		AssertNodeName := func(nodeNameVarName string, setEnvVars func([]v1.EnvVar)) {
+		AssertNodeName := func(nodeNameVarName string, setEnvVars func([]corev1.EnvVar)) {
 			It("should not throw an error if set to noderef", func() {
-				setEnvVars([]v1.EnvVar{{
+				setEnvVars([]corev1.EnvVar{{
 					Name: nodeNameVarName,
-					ValueFrom: &v1.EnvVarSource{
-						FieldRef: &v1.ObjectFieldSelector{
+					ValueFrom: &corev1.EnvVarSource{
+						FieldRef: &corev1.ObjectFieldSelector{
 							FieldPath: "spec.nodeName",
 						},
 					},
@@ -413,10 +412,10 @@ var _ = Describe("core handler", func() {
 				Expect(handleCore(&comps, i)).ToNot(HaveOccurred())
 			})
 			It("should throw an error if set to a different fieldPath", func() {
-				setEnvVars([]v1.EnvVar{{
+				setEnvVars([]corev1.EnvVar{{
 					Name: nodeNameVarName,
-					ValueFrom: &v1.EnvVarSource{
-						FieldRef: &v1.ObjectFieldSelector{
+					ValueFrom: &corev1.EnvVarSource{
+						FieldRef: &corev1.ObjectFieldSelector{
 							FieldPath: "metadata.name",
 						},
 					},
@@ -424,7 +423,7 @@ var _ = Describe("core handler", func() {
 				Expect(handleCore(&comps, i)).To(HaveOccurred())
 			})
 			It("should throw an error if hardcoded to a value", func() {
-				setEnvVars([]v1.EnvVar{{
+				setEnvVars([]corev1.EnvVar{{
 					Name:  nodeNameVarName,
 					Value: "foobar",
 				}})
@@ -437,18 +436,18 @@ var _ = Describe("core handler", func() {
 		})
 
 		It("should not throw an error if both are set correctly", func() {
-			comps.node.Spec.Template.Spec.Containers[0].Env = []v1.EnvVar{{
+			comps.node.Spec.Template.Spec.Containers[0].Env = []corev1.EnvVar{{
 				Name: "NODENAME",
-				ValueFrom: &v1.EnvVarSource{
-					FieldRef: &v1.ObjectFieldSelector{
+				ValueFrom: &corev1.EnvVarSource{
+					FieldRef: &corev1.ObjectFieldSelector{
 						FieldPath: "spec.nodeName",
 					},
 				},
 			}}
-			comps.node.Spec.Template.Spec.InitContainers[0].Env = []v1.EnvVar{{
+			comps.node.Spec.Template.Spec.InitContainers[0].Env = []corev1.EnvVar{{
 				Name: "KUBERNETES_NODE_NAME",
-				ValueFrom: &v1.EnvVarSource{
-					FieldRef: &v1.ObjectFieldSelector{
+				ValueFrom: &corev1.EnvVarSource{
+					FieldRef: &corev1.ObjectFieldSelector{
 						FieldPath: "spec.nodeName",
 					},
 				},
@@ -457,12 +456,12 @@ var _ = Describe("core handler", func() {
 		})
 
 		Context("on the calico/node container", func() {
-			AssertNodeName("NODENAME", func(envVars []v1.EnvVar) {
+			AssertNodeName("NODENAME", func(envVars []corev1.EnvVar) {
 				comps.node.Spec.Template.Spec.Containers[0].Env = envVars
 			})
 		})
 		Context("on the install-cni container", func() {
-			AssertNodeName("KUBERNETES_NODE_NAME", func(envVars []v1.EnvVar) {
+			AssertNodeName("KUBERNETES_NODE_NAME", func(envVars []corev1.EnvVar) {
 				comps.node.Spec.Template.Spec.InitContainers[0].Env = envVars
 			})
 		})
@@ -473,12 +472,12 @@ var _ = Describe("core handler", func() {
 			// function initializes all components with the expected, valid tolerations (which it does).
 			// the first parameter is the existing tolerations, so that they can be adjusted.
 			// the second parameter is a function which updates the tolerations of the desired component.
-			TestTolerations := func(existingTolerations []v1.Toleration, setTolerations func([]v1.Toleration)) {
+			TestTolerations := func(existingTolerations []corev1.Toleration, setTolerations func([]corev1.Toleration)) {
 				It("should not error if only expected tolerations are set", func() {
 					Expect(handleCore(&comps, i)).ToNot(HaveOccurred())
 				})
 				It("should not error if no tolerations set", func() {
-					setTolerations([]v1.Toleration{})
+					setTolerations([]corev1.Toleration{})
 					Expect(handleCore(&comps, i)).NotTo(HaveOccurred())
 				})
 				It("should not error if missing just one toleration", func() {
@@ -486,7 +485,7 @@ var _ = Describe("core handler", func() {
 					Expect(handleCore(&comps, i)).NotTo(HaveOccurred())
 				})
 				It("should not error if additional toleration exists", func() {
-					setTolerations(append(existingTolerations, v1.Toleration{
+					setTolerations(append(existingTolerations, corev1.Toleration{
 						Key:    "foo",
 						Effect: "bar",
 					}))
@@ -494,17 +493,17 @@ var _ = Describe("core handler", func() {
 				})
 			}
 			Describe("calico-node", func() {
-				TestTolerations(comps.node.Spec.Template.Spec.Tolerations, func(t []v1.Toleration) {
+				TestTolerations(comps.node.Spec.Template.Spec.Tolerations, func(t []corev1.Toleration) {
 					comps.node.Spec.Template.Spec.Tolerations = t
 				})
 			})
 			Describe("kube-controllers", func() {
-				TestTolerations(comps.kubeControllers.Spec.Template.Spec.Tolerations, func(t []v1.Toleration) {
+				TestTolerations(comps.kubeControllers.Spec.Template.Spec.Tolerations, func(t []corev1.Toleration) {
 					comps.kubeControllers.Spec.Template.Spec.Tolerations = t
 				})
 			})
 			Describe("typha", func() {
-				TestTolerations(comps.typha.Spec.Template.Spec.Tolerations, func(t []v1.Toleration) {
+				TestTolerations(comps.typha.Spec.Template.Spec.Tolerations, func(t []corev1.Toleration) {
 					comps.typha.Spec.Template.Spec.Tolerations = t
 				})
 			})
@@ -567,14 +566,14 @@ var _ = Describe("core handler", func() {
 
 	Context("cni", func() {
 		It("should not raise an error if CNI_CONF_NAME is 10-calico.conflist", func() {
-			comps.node.Spec.Template.Spec.InitContainers[0].Env = []v1.EnvVar{{
+			comps.node.Spec.Template.Spec.InitContainers[0].Env = []corev1.EnvVar{{
 				Name:  "CNI_CONF_NAME",
 				Value: "10-calico.conflist",
 			}}
 			Expect(handleCore(&comps, i)).ToNot(HaveOccurred())
 		})
 		It("should raise error if CNI_CONF_NAME isn't 10-calico.conflist", func() {
-			comps.node.Spec.Template.Spec.InitContainers[0].Env = []v1.EnvVar{{
+			comps.node.Spec.Template.Spec.InitContainers[0].Env = []corev1.EnvVar{{
 				Name:  "CNI_CONF_NAME",
 				Value: "2-calico.conflist",
 			}}
@@ -584,21 +583,21 @@ var _ = Describe("core handler", func() {
 	Context("kube-controllers", func() {
 		Context("ENABLED_CONTROLLERS", func() {
 			It("should not error if ENABLED_CONTROLLERS is expected value", func() {
-				comps.kubeControllers.Spec.Template.Spec.Containers[0].Env = []v1.EnvVar{{
+				comps.kubeControllers.Spec.Template.Spec.Containers[0].Env = []corev1.EnvVar{{
 					Name:  "ENABLED_CONTROLLERS",
 					Value: "node",
 				}}
 				Expect(handleCore(&comps, i)).ToNot(HaveOccurred())
 			})
 			It("should not error if ENABLED_CONTROLLERS is expected value", func() {
-				comps.kubeControllers.Spec.Template.Spec.Containers[0].Env = []v1.EnvVar{{
+				comps.kubeControllers.Spec.Template.Spec.Containers[0].Env = []corev1.EnvVar{{
 					Name:  "ENABLED_CONTROLLERS",
 					Value: "node,loadbalancer",
 				}}
 				Expect(handleCore(&comps, i)).ToNot(HaveOccurred())
 			})
 			It("should error if ENABLED_CONTROLLERS is not expected value", func() {
-				comps.kubeControllers.Spec.Template.Spec.Containers[0].Env = []v1.EnvVar{{
+				comps.kubeControllers.Spec.Template.Spec.Containers[0].Env = []corev1.EnvVar{{
 					Name:  "ENABLED_CONTROLLERS",
 					Value: "hep",
 				}}
@@ -607,14 +606,14 @@ var _ = Describe("core handler", func() {
 		})
 		Context("AUTO_HOST_ENDPOINTS", func() {
 			It("should not error if AUTO_HOST_ENDPOINTS is expected value", func() {
-				comps.kubeControllers.Spec.Template.Spec.Containers[0].Env = []v1.EnvVar{{
+				comps.kubeControllers.Spec.Template.Spec.Containers[0].Env = []corev1.EnvVar{{
 					Name:  "AUTO_HOST_ENDPOINTS",
 					Value: "disabled",
 				}}
 				Expect(handleCore(&comps, i)).ToNot(HaveOccurred())
 			})
 			It("should error if AUTO_HOST_ENDPOINTS is not expected value", func() {
-				comps.kubeControllers.Spec.Template.Spec.Containers[0].Env = []v1.EnvVar{{
+				comps.kubeControllers.Spec.Template.Spec.Containers[0].Env = []corev1.EnvVar{{
 					Name:  "AUTO_HOST_ENDPOINTS",
 					Value: "enabled",
 				}}
diff --git a/pkg/controller/migration/convert/felix_vars_test.go b/pkg/controller/migration/convert/felix_vars_test.go
index de8300e59a..a577d05971 100644
--- a/pkg/controller/migration/convert/felix_vars_test.go
+++ b/pkg/controller/migration/convert/felix_vars_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2022-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"time"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
diff --git a/pkg/controller/migration/convert/ippools_test.go b/pkg/controller/migration/convert/ippools_test.go
index 7c37ad4882..1815642a14 100644
--- a/pkg/controller/migration/convert/ippools_test.go
+++ b/pkg/controller/migration/convert/ippools_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2022-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	operatorv1 "github.com/tigera/operator/api/v1"
 	"github.com/tigera/operator/pkg/apis"
diff --git a/pkg/controller/migration/convert/k8s.go b/pkg/controller/migration/convert/k8s.go
index 5a589a4204..56ef5df09a 100644
--- a/pkg/controller/migration/convert/k8s.go
+++ b/pkg/controller/migration/convert/k8s.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2022-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -21,7 +21,6 @@ import (
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
-	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
@@ -168,7 +167,7 @@ func (r *CheckedDaemonSet) ignoreEnv(container, key string) {
 }
 
 // getEnv gets the value of an environment variable.
-func getEnv(ctx context.Context, client client.Client, pts v1.PodSpec, component, container, key string) (*string, error) {
+func getEnv(ctx context.Context, client client.Client, pts corev1.PodSpec, component, container, key string) (*string, error) {
 	c := getContainer(pts, container)
 	if c == nil {
 		return nil, ErrIncompatibleCluster{
@@ -184,9 +183,9 @@ func getEnv(ctx context.Context, client client.Client, pts v1.PodSpec, component
 				return &e.Value, nil
 			}
 			if e.ValueFrom.ConfigMapKeyRef != nil {
-				cm := v1.ConfigMap{}
+				cm := corev1.ConfigMap{}
 				err := client.Get(ctx, types.NamespacedName{
-					Name:      e.ValueFrom.ConfigMapKeyRef.LocalObjectReference.Name,
+					Name:      e.ValueFrom.ConfigMapKeyRef.Name,
 					Namespace: "kube-system",
 				}, &cm)
 				if err != nil {
diff --git a/pkg/controller/migration/convert/mtu_test.go b/pkg/controller/migration/convert/mtu_test.go
index d75b7fd6fe..2e85f0f622 100644
--- a/pkg/controller/migration/convert/mtu_test.go
+++ b/pkg/controller/migration/convert/mtu_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2020-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -21,7 +21,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	"github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 )
 
 var _ = Describe("mtu handler", func() {
diff --git a/pkg/controller/migration/convert/network.go b/pkg/controller/migration/convert/network.go
index 8028fac678..87083f40c2 100644
--- a/pkg/controller/migration/convert/network.go
+++ b/pkg/controller/migration/convert/network.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -22,7 +22,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	operatorv1 "github.com/tigera/operator/api/v1"
-	v1 "github.com/tigera/operator/api/v1"
 	"github.com/tigera/operator/pkg/controller/migration/cni"
 	"github.com/tigera/operator/pkg/controller/utils"
 )
@@ -135,7 +134,8 @@ func handleCalicoCNI(c *components, install *operatorv1.Installation) error {
 	}
 	// IP6 can be 'autodetect', 'none', or not defined.
 	if ip6 != nil {
-		if *ip6 == "none" {
+		switch *ip6 {
+		case "none":
 			// If IP6=none then if FELIX_IPV6SUPPORT is set it must be false.
 			if err := c.node.assertEnv(ctx, c.client, containerCalicoNode, "FELIX_IPV6SUPPORT", "false"); err != nil {
 				return err
@@ -145,7 +145,7 @@ func handleCalicoCNI(c *components, install *operatorv1.Installation) error {
 			if err := c.node.assertEnv(ctx, c.client, containerCalicoNode, "IP6_AUTODETECTION_METHOD", "none"); err != nil {
 				return err
 			}
-		} else if *ip6 == "autodetect" {
+		case "autodetect":
 			if err := handleIPv6AutoDetectionMethod(c, install); err != nil {
 				return err
 			}
@@ -153,7 +153,7 @@ func handleCalicoCNI(c *components, install *operatorv1.Installation) error {
 			if err := c.node.assertEnv(ctx, c.client, containerCalicoNode, "FELIX_IPV6SUPPORT", "true"); err != nil {
 				return err
 			}
-		} else {
+		default:
 			return ErrIncompatibleCluster{
 				err:       fmt.Sprintf("IP6=%s is not supported", *ip),
 				component: ComponentCalicoNode,
@@ -193,10 +193,10 @@ func handleCalicoCNI(c *components, install *operatorv1.Installation) error {
 
 	// CNI portmap plugin
 	if _, ok := c.cni.Plugins["portmap"]; ok {
-		hp := v1.HostPortsEnabled
+		hp := operatorv1.HostPortsEnabled
 		install.Spec.CalicoNetwork.HostPorts = &hp
 	} else {
-		hp := v1.HostPortsDisabled
+		hp := operatorv1.HostPortsDisabled
 		install.Spec.CalicoNetwork.HostPorts = &hp
 	}
 
@@ -265,7 +265,7 @@ func handleCalicoCNI(c *components, install *operatorv1.Installation) error {
 	}
 
 	if c.cni.CalicoConfig.ContainerSettings.AllowIPForwarding {
-		containerIPForward := v1.ContainerIPForwardingEnabled
+		containerIPForward := operatorv1.ContainerIPForwardingEnabled
 		install.Spec.CalicoNetwork.ContainerIPForwarding = &containerIPForward
 	}
 
diff --git a/pkg/controller/migration/convert/network_test.go b/pkg/controller/migration/convert/network_test.go
index 924b16892a..5743ee7c88 100644
--- a/pkg/controller/migration/convert/network_test.go
+++ b/pkg/controller/migration/convert/network_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
diff --git a/pkg/controller/migration/convert/typha_test.go b/pkg/controller/migration/convert/typha_test.go
index 7448fc0418..6d6eb8a16a 100644
--- a/pkg/controller/migration/convert/typha_test.go
+++ b/pkg/controller/migration/convert/typha_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2022-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 	"fmt"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
diff --git a/pkg/controller/migration/namespace_migration.go b/pkg/controller/migration/namespace_migration.go
index 3c83792715..7fa54ac8b2 100644
--- a/pkg/controller/migration/namespace_migration.go
+++ b/pkg/controller/migration/namespace_migration.go
@@ -545,8 +545,8 @@ func (m *CoreNamespaceMigration) ensureKubeSysNodeDaemonSetHasNodeSelectorAndIsR
 		if err != nil {
 			return false, err
 		}
-		if ds.Status.ObservedGeneration != ds.ObjectMeta.Generation {
-			log.Info(fmt.Sprintf("waiting for observed generation (%d) to match object generation (%d)", ds.Status.ObservedGeneration, ds.ObjectMeta.Generation))
+		if ds.Status.ObservedGeneration != ds.Generation {
+			log.Info(fmt.Sprintf("waiting for observed generation (%d) to match object generation (%d)", ds.Status.ObservedGeneration, ds.Generation))
 			return false, nil
 		}
 		if ds.Status.DesiredNumberScheduled != ds.Status.NumberReady {
@@ -565,7 +565,7 @@ func (m *CoreNamespaceMigration) addNodeSelectorToDaemonSet(ctx context.Context,
 	if _, ok := ds.Spec.Template.Spec.NodeSelector[key]; !ok {
 		var patchBytes []byte
 		if len(ds.Spec.Template.Spec.NodeSelector) > 0 {
-			k := strings.Replace(key, "/", "~1", -1)
+			k := strings.ReplaceAll(key, "/", "~1")
 
 			// This patch does not work when NodeSelectors don't already exist, only use it when some already exist.
 			p := []StringPatch{
@@ -665,7 +665,7 @@ func (m *CoreNamespaceMigration) waitUntilNodeCanBeMigrated(ctx context.Context,
 			return false, err
 		}
 
-		var maxUnavailable int32 = defaultMaxUnavailable
+		var maxUnavailable = defaultMaxUnavailable
 
 		if csMaxUnavailable != nil {
 			numNodesMaxUnavailable, err := intstr.GetValueFromIntOrPercent(csMaxUnavailable, int(ksD+csD), false)
@@ -730,7 +730,7 @@ func (m *CoreNamespaceMigration) addNodeLabel(ctx context.Context, nodeName, key
 			needUpdate = false
 		}
 
-		k := strings.Replace(key, "/", "~1", -1)
+		k := strings.ReplaceAll(key, "/", "~1")
 
 		lp := []StringPatch{{
 			Op:    "add",
@@ -783,7 +783,7 @@ func (m *CoreNamespaceMigration) removeNodeLabel(ctx context.Context, nodeName,
 		}
 
 		// With JSONPatch '/' must be escaped as '~1' http://jsonpatch.com/
-		k := strings.Replace(key, "/", "~1", -1)
+		k := strings.ReplaceAll(key, "/", "~1")
 		lp := []StringPatch{{
 			Op:   "remove",
 			Path: fmt.Sprintf("/metadata/labels/%s", k),
diff --git a/pkg/controller/monitor/monitor_controller_suite_test.go b/pkg/controller/monitor/monitor_controller_suite_test.go
index a52889423e..b5f3c05ff8 100644
--- a/pkg/controller/monitor/monitor_controller_suite_test.go
+++ b/pkg/controller/monitor/monitor_controller_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2021, 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2021, 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 	uzap "go.uber.org/zap"
diff --git a/pkg/controller/monitor/monitor_controller_test.go b/pkg/controller/monitor/monitor_controller_test.go
index 28c403ce45..0ec768bc3e 100644
--- a/pkg/controller/monitor/monitor_controller_test.go
+++ b/pkg/controller/monitor/monitor_controller_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2021-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2021-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 	"context"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"github.com/stretchr/testify/mock"
 
 	v3 "github.com/tigera/api/pkg/apis/projectcalico/v3"
diff --git a/pkg/controller/nonclusterhost/nonclusterhost_controller_suite_test.go b/pkg/controller/nonclusterhost/nonclusterhost_controller_suite_test.go
index 2eb15641b3..3c18d567b5 100644
--- a/pkg/controller/nonclusterhost/nonclusterhost_controller_suite_test.go
+++ b/pkg/controller/nonclusterhost/nonclusterhost_controller_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2024-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 	uzap "go.uber.org/zap"
diff --git a/pkg/controller/nonclusterhost/nonclusterhost_controller_test.go b/pkg/controller/nonclusterhost/nonclusterhost_controller_test.go
index e85a058a50..134ca0cddd 100644
--- a/pkg/controller/nonclusterhost/nonclusterhost_controller_test.go
+++ b/pkg/controller/nonclusterhost/nonclusterhost_controller_test.go
@@ -18,7 +18,7 @@ import (
 	"context"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"github.com/stretchr/testify/mock"
 
 	appsv1 "k8s.io/api/apps/v1"
diff --git a/pkg/controller/packetcapture/packetcapture_controller_test.go b/pkg/controller/packetcapture/packetcapture_controller_test.go
index 4d7353bb7c..b0f6f593cc 100644
--- a/pkg/controller/packetcapture/packetcapture_controller_test.go
+++ b/pkg/controller/packetcapture/packetcapture_controller_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2024-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in policy recommendation with the License.
@@ -20,7 +20,7 @@ import (
 	"time"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"github.com/stretchr/testify/mock"
 
 	appsv1 "k8s.io/api/apps/v1"
diff --git a/pkg/controller/packetcapture/packetcapture_suite_test.go b/pkg/controller/packetcapture/packetcapture_suite_test.go
index 418e43e389..daa0ae5eff 100644
--- a/pkg/controller/packetcapture/packetcapture_suite_test.go
+++ b/pkg/controller/packetcapture/packetcapture_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2024-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 	uzap "go.uber.org/zap"
diff --git a/pkg/controller/policyrecommendation/policyrecommendation_controller.go b/pkg/controller/policyrecommendation/policyrecommendation_controller.go
index a7aae21982..c0e5e57f14 100644
--- a/pkg/controller/policyrecommendation/policyrecommendation_controller.go
+++ b/pkg/controller/policyrecommendation/policyrecommendation_controller.go
@@ -511,7 +511,7 @@ func (r *ReconcilePolicyRecommendation) createDefaultPolicyRecommendationScope(c
 		prs = &v3.PolicyRecommendationScope{}
 	}
 
-	prs.ObjectMeta.Name = "default"
+	prs.Name = "default"
 	prs.Spec.NamespaceSpec.RecStatus = "Disabled"
 	prs.Spec.NamespaceSpec.Selector = "!(projectcalico.org/name starts with 'tigera-') && !(projectcalico.org/name starts with 'calico-') && !(projectcalico.org/name starts with 'kube-')"
 	if r.provider.IsOpenShift() {
diff --git a/pkg/controller/policyrecommendation/policyrecommendation_controller_test.go b/pkg/controller/policyrecommendation/policyrecommendation_controller_test.go
index 84cb241031..ba538058e0 100644
--- a/pkg/controller/policyrecommendation/policyrecommendation_controller_test.go
+++ b/pkg/controller/policyrecommendation/policyrecommendation_controller_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -22,7 +22,7 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"github.com/stretchr/testify/mock"
 	"github.com/tigera/operator/pkg/common"
 
diff --git a/pkg/controller/policyrecommendation/policyrecommendation_suite_test.go b/pkg/controller/policyrecommendation/policyrecommendation_suite_test.go
index 64b953b0f0..644758455d 100644
--- a/pkg/controller/policyrecommendation/policyrecommendation_suite_test.go
+++ b/pkg/controller/policyrecommendation/policyrecommendation_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 	uzap "go.uber.org/zap"
diff --git a/pkg/controller/secrets/cluster_ca_controller_test.go b/pkg/controller/secrets/cluster_ca_controller_test.go
index 14e301ffe9..55056189c4 100644
--- a/pkg/controller/secrets/cluster_ca_controller_test.go
+++ b/pkg/controller/secrets/cluster_ca_controller_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 	"fmt"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	operatorv1 "github.com/tigera/operator/api/v1"
 	admissionv1beta1 "k8s.io/api/admissionregistration/v1beta1"
diff --git a/pkg/controller/secrets/secrets_suite_test.go b/pkg/controller/secrets/secrets_suite_test.go
index 96b8161de8..97074e8f3b 100644
--- a/pkg/controller/secrets/secrets_suite_test.go
+++ b/pkg/controller/secrets/secrets_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 	uzap "go.uber.org/zap"
diff --git a/pkg/controller/secrets/tenant_controller_test.go b/pkg/controller/secrets/tenant_controller_test.go
index 8ce9cbb0a4..5ffe8ad61f 100644
--- a/pkg/controller/secrets/tenant_controller_test.go
+++ b/pkg/controller/secrets/tenant_controller_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 	"context"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"github.com/stretchr/testify/mock"
 
 	operatorv1 "github.com/tigera/operator/api/v1"
diff --git a/pkg/controller/status/status.go b/pkg/controller/status/status.go
index 0fb7c02aac..4411aec3a1 100644
--- a/pkg/controller/status/status.go
+++ b/pkg/controller/status/status.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2020-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -32,7 +32,6 @@ import (
 	certV1 "k8s.io/api/certificates/v1"
 	certV1beta1 "k8s.io/api/certificates/v1beta1"
 	corev1 "k8s.io/api/core/v1"
-	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
@@ -695,9 +694,10 @@ func (m *statusManager) podsFailing(selector *metav1.LabelSelector, namespace st
 func (m *statusManager) containerErrorMessage(p corev1.Pod, c corev1.ContainerStatus) string {
 	if c.State.Waiting != nil {
 		// Check well-known error states here and report an appropriate mesage to the end user.
-		if c.State.Waiting.Reason == "CrashLoopBackOff" {
+		switch c.State.Waiting.Reason {
+		case "CrashLoopBackOff":
 			return fmt.Sprintf("Pod %s/%s has crash looping container: %s", p.Namespace, p.Name, c.Name)
-		} else if c.State.Waiting.Reason == "ImagePullBackOff" || c.State.Waiting.Reason == "ErrImagePull" {
+		case "ImagePullBackOff", "ErrImagePull":
 			return fmt.Sprintf("Pod %s/%s failed to pull container image for: %s", p.Namespace, p.Name, c.Name)
 		}
 	}
@@ -939,7 +939,7 @@ func hasPendingCSRUsingCertV1(ctx context.Context, cli client.Client, labelMap m
 		}
 		// no condition approved, means it is pending.
 		for _, condition := range csr.Status.Conditions {
-			if condition.Status == v1.ConditionUnknown {
+			if condition.Status == corev1.ConditionUnknown {
 				return true, nil
 			} else if condition.Type == certV1.CertificateApproved && csr.Status.Certificate == nil {
 				return true, nil
@@ -968,7 +968,7 @@ func hasPendingCSRUsingCertV1beta1(ctx context.Context, cli client.Client, label
 		}
 		// no condition approved, means it is pending.
 		for _, condition := range csr.Status.Conditions {
-			if condition.Status == v1.ConditionUnknown {
+			if condition.Status == corev1.ConditionUnknown {
 				return true, nil
 			} else if condition.Type == certV1beta1.CertificateApproved && csr.Status.Certificate == nil {
 				return true, nil
@@ -993,9 +993,10 @@ func UpdateStatusCondition(statuscondition []metav1.Condition, conditions []oper
 		}
 
 		status := metav1.ConditionUnknown
-		if condition.Status == operator.ConditionTrue {
+		switch condition.Status {
+		case operator.ConditionTrue:
 			status = metav1.ConditionTrue
-		} else if condition.Status == operator.ConditionFalse {
+		case operator.ConditionFalse:
 			status = metav1.ConditionFalse
 		}
 		ic := metav1.Condition{
diff --git a/pkg/controller/status/status_suite_test.go b/pkg/controller/status/status_suite_test.go
index 8927e08ac8..619c0801f5 100644
--- a/pkg/controller/status/status_suite_test.go
+++ b/pkg/controller/status/status_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019, 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019, 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/controller/status/status_test.go b/pkg/controller/status/status_test.go
index 172c234230..b5d5c635fe 100644
--- a/pkg/controller/status/status_test.go
+++ b/pkg/controller/status/status_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	appsv1 "k8s.io/api/apps/v1"
 	certV1 "k8s.io/api/certificates/v1"
diff --git a/pkg/controller/tenancy/tenancy_test.go b/pkg/controller/tenancy/tenancy_test.go
index 1d82653e8e..e502890b46 100644
--- a/pkg/controller/tenancy/tenancy_test.go
+++ b/pkg/controller/tenancy/tenancy_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ package tenancy
 
 import (
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"github.com/tigera/operator/pkg/common"
 )
 
diff --git a/pkg/controller/tiers/tiers_controller_suite_test.go b/pkg/controller/tiers/tiers_controller_suite_test.go
index 24159b5717..18d861ba2a 100644
--- a/pkg/controller/tiers/tiers_controller_suite_test.go
+++ b/pkg/controller/tiers/tiers_controller_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2022 - 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022 - 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/controller/tiers/tiers_controller_test.go b/pkg/controller/tiers/tiers_controller_test.go
index d202840917..068f10e8a5 100644
--- a/pkg/controller/tiers/tiers_controller_test.go
+++ b/pkg/controller/tiers/tiers_controller_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2022-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"context"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"github.com/stretchr/testify/mock"
 
 	appsv1 "k8s.io/api/apps/v1"
diff --git a/pkg/controller/utils/auth_test.go b/pkg/controller/utils/auth_test.go
index d313a37ddb..86ea223ebe 100644
--- a/pkg/controller/utils/auth_test.go
+++ b/pkg/controller/utils/auth_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2024-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
diff --git a/pkg/controller/utils/component.go b/pkg/controller/utils/component.go
index fcec327008..2a87c423e5 100644
--- a/pkg/controller/utils/component.go
+++ b/pkg/controller/utils/component.go
@@ -217,7 +217,7 @@ func (c *componentHandler) createOrUpdateObject(ctx context.Context, obj client.
 			// Secret types are immutable, we need to delete the old version if the type has changed. If the
 			// object type is unset, it will result in SecretTypeOpaque, so this difference can be excluded.
 			if objSecret.Type != curSecret.Type &&
-				!(len(objSecret.Type) == 0 && curSecret.Type == v1.SecretTypeOpaque) {
+				(len(objSecret.Type) != 0 || curSecret.Type != v1.SecretTypeOpaque) {
 				if err := c.client.Delete(ctx, obj); err != nil {
 					logCtx.WithValues("key", key).Info("Failed to delete secret for recreation.")
 					return err
@@ -797,12 +797,12 @@ func setStandardSelectorAndLabels(obj client.Object) {
 	switch obj := obj.(type) {
 	case *apps.Deployment:
 		d := obj
-		name = d.ObjectMeta.Name
-		if d.ObjectMeta.Labels == nil {
-			d.ObjectMeta.Labels = make(map[string]string)
+		name = d.Name
+		if d.Labels == nil {
+			d.Labels = make(map[string]string)
 		}
-		d.ObjectMeta.Labels["k8s-app"] = name
-		d.ObjectMeta.Labels["app.kubernetes.io/name"] = name
+		d.Labels["k8s-app"] = name
+		d.Labels["app.kubernetes.io/name"] = name
 		if d.Spec.Selector == nil {
 			d.Spec.Selector = &metav1.LabelSelector{
 				MatchLabels: map[string]string{
@@ -813,7 +813,7 @@ func setStandardSelectorAndLabels(obj client.Object) {
 		podTemplate = &d.Spec.Template
 	case *apps.DaemonSet:
 		d := obj
-		name = d.ObjectMeta.Name
+		name = d.Name
 		if d.Spec.Selector == nil {
 			d.Spec.Selector = &metav1.LabelSelector{
 				MatchLabels: map[string]string{
@@ -826,14 +826,14 @@ func setStandardSelectorAndLabels(obj client.Object) {
 		return
 	}
 
-	if podTemplate.ObjectMeta.Labels == nil {
-		podTemplate.ObjectMeta.Labels = make(map[string]string)
+	if podTemplate.Labels == nil {
+		podTemplate.Labels = make(map[string]string)
 	}
-	if podTemplate.ObjectMeta.Labels["k8s-app"] == "" {
-		podTemplate.ObjectMeta.Labels["k8s-app"] = name
+	if podTemplate.Labels["k8s-app"] == "" {
+		podTemplate.Labels["k8s-app"] = name
 	}
-	if podTemplate.ObjectMeta.Labels["app.kubernetes.io/name"] == "" {
-		podTemplate.ObjectMeta.Labels["app.kubernetes.io/name"] = name
+	if podTemplate.Labels["app.kubernetes.io/name"] == "" {
+		podTemplate.Labels["app.kubernetes.io/name"] = name
 	}
 }
 
diff --git a/pkg/controller/utils/component_test.go b/pkg/controller/utils/component_test.go
index 37f877d6d4..0b0c8e8d2a 100644
--- a/pkg/controller/utils/component_test.go
+++ b/pkg/controller/utils/component_test.go
@@ -22,7 +22,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	esv1 "github.com/elastic/cloud-on-k8s/v2/pkg/apis/elasticsearch/v1"
 	kbv1 "github.com/elastic/cloud-on-k8s/v2/pkg/apis/kibana/v1"
@@ -430,7 +430,7 @@ var _ = Describe("Component handler tests", func() {
 		labels := map[string]string{
 			"extra": "extra-value",
 		}
-		ns.ObjectMeta.Labels = labels
+		ns.Labels = labels
 		Expect(c.Update(ctx, ns)).NotTo(HaveOccurred())
 
 		By("checking that the namespace is updated with extra label")
@@ -479,7 +479,7 @@ var _ = Describe("Component handler tests", func() {
 			"cattle-not-pets":     "indeed",
 			fakeComponentLabelKey: "not-present",
 		}
-		ns.ObjectMeta.Labels = labels
+		ns.Labels = labels
 		err = c.Update(ctx, ns)
 		Expect(err).To(BeNil())
 
diff --git a/pkg/controller/utils/discovery.go b/pkg/controller/utils/discovery.go
index 9332ba318d..9283a5995c 100644
--- a/pkg/controller/utils/discovery.go
+++ b/pkg/controller/utils/discovery.go
@@ -20,7 +20,6 @@ import (
 	"strings"
 
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	kerrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"
@@ -121,7 +120,7 @@ func AutoDiscoverProvider(ctx context.Context, clientset kubernetes.Interface) (
 func isOpenshift(c kubernetes.Interface) (bool, error) {
 	resources, err := c.Discovery().ServerResourcesForGroupVersion("config.openshift.io/v1")
 	if err != nil {
-		if errors.IsNotFound(err) {
+		if kerrors.IsNotFound(err) {
 			return false, nil
 		}
 		return false, err
diff --git a/pkg/controller/utils/discovery_test.go b/pkg/controller/utils/discovery_test.go
index 384abe62e5..57cc29916f 100644
--- a/pkg/controller/utils/discovery_test.go
+++ b/pkg/controller/utils/discovery_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2022-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"context"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
diff --git a/pkg/controller/utils/elasticsearch.go b/pkg/controller/utils/elasticsearch.go
index db4f001379..21ca6765c1 100644
--- a/pkg/controller/utils/elasticsearch.go
+++ b/pkg/controller/utils/elasticsearch.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2020,2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020,2024,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -28,7 +28,6 @@ import (
 
 	"github.com/olivere/elastic/v7"
 
-	operator "github.com/tigera/operator/api/v1"
 	operatorv1 "github.com/tigera/operator/api/v1"
 	"github.com/tigera/operator/pkg/common"
 	"github.com/tigera/operator/pkg/render"
@@ -613,7 +612,7 @@ func getClientCredentials(ctx context.Context, client client.Client, externalEla
 
 // getESRoots returns the root certificates used to validate the Elasticsearch server certificate.
 func getESRoots(ctx context.Context, client client.Client, secretName string) (*x509.CertPool, error) {
-	instance := &operator.Installation{}
+	instance := &operatorv1.Installation{}
 	if err := client.Get(ctx, DefaultInstanceKey, instance); err != nil {
 		return nil, err
 	}
diff --git a/pkg/controller/utils/elasticsearch_test.go b/pkg/controller/utils/elasticsearch_test.go
index 4982aaeb62..05d9738982 100644
--- a/pkg/controller/utils/elasticsearch_test.go
+++ b/pkg/controller/utils/elasticsearch_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2020-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -25,7 +25,7 @@ import (
 	"strings"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/olivere/elastic/v7"
 	apps "k8s.io/api/apps/v1"
@@ -274,7 +274,7 @@ func (t *testRoundTripper) RoundTrip(req *http.Request) (*http.Response, error)
 
 				jsonFile, err := os.Open("test_files/01_put_policy.json")
 				Expect(err).To(BeNil())
-				defer jsonFile.Close()
+				defer func() { _ = jsonFile.Close() }()
 				expectedBody, _ := io.ReadAll(jsonFile)
 				Expect(actualBody).To(MatchJSON(expectedBody))
 
@@ -292,7 +292,7 @@ func (t *testRoundTripper) RoundTrip(req *http.Request) (*http.Response, error)
 				jsonFile, err = os.Open("test_files/02_put_policy_readonly.json")
 			}
 			Expect(err).To(BeNil())
-			defer jsonFile.Close()
+			defer func() { _ = jsonFile.Close() }()
 			expectedBody, _ := io.ReadAll(jsonFile)
 			Expect(actualBody).To(MatchJSON(expectedBody))
 
diff --git a/pkg/controller/utils/felix_configuration.go b/pkg/controller/utils/felix_configuration.go
index 4c100d764c..beba9b82d9 100644
--- a/pkg/controller/utils/felix_configuration.go
+++ b/pkg/controller/utils/felix_configuration.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -43,7 +43,7 @@ func PatchFelixConfiguration(ctx context.Context, c client.Client, patchFn func(
 	if updated {
 		// Apply the patch.
 		if fc.ResourceVersion == "" {
-			fc.ObjectMeta.Name = "default"
+			fc.Name = "default"
 			if err := c.Create(ctx, fc); err != nil {
 				return nil, err
 			}
diff --git a/pkg/controller/utils/imageset/imageset.go b/pkg/controller/utils/imageset/imageset.go
index 42c3bf3df6..af1af30f2d 100644
--- a/pkg/controller/utils/imageset/imageset.go
+++ b/pkg/controller/utils/imageset/imageset.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2021-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2021-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -205,5 +205,5 @@ func ResolveImages(is *operator.ImageSet, comps ...render.Component) error {
 		return nil
 	}
 
-	return fmt.Errorf("Invalid ImageSet: %s", strings.Join(errMsgs, ", "))
+	return fmt.Errorf("invalid ImageSet: %s", strings.Join(errMsgs, ", "))
 }
diff --git a/pkg/controller/utils/imageset/imageset_suite_test.go b/pkg/controller/utils/imageset/imageset_suite_test.go
index 4c3f12acfa..9d627ff9e1 100644
--- a/pkg/controller/utils/imageset/imageset_suite_test.go
+++ b/pkg/controller/utils/imageset/imageset_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019, 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019, 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/controller/utils/imageset/imageset_test.go b/pkg/controller/utils/imageset/imageset_test.go
index b749637406..7235211adc 100644
--- a/pkg/controller/utils/imageset/imageset_test.go
+++ b/pkg/controller/utils/imageset/imageset_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2021-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2021-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	//"k8s.io/client-go/kubernetes/fake"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
diff --git a/pkg/controller/utils/merge_test.go b/pkg/controller/utils/merge_test.go
index 874d7fc2cf..f073325925 100644
--- a/pkg/controller/utils/merge_test.go
+++ b/pkg/controller/utils/merge_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2020-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	diff "github.com/r3labs/diff/v2"
 	appsv1 "k8s.io/api/apps/v1"
diff --git a/pkg/controller/utils/utils_suite_test.go b/pkg/controller/utils/utils_suite_test.go
index b330755e5d..4f63861499 100644
--- a/pkg/controller/utils/utils_suite_test.go
+++ b/pkg/controller/utils/utils_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2020, 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020, 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/controller/utils/utils_test.go b/pkg/controller/utils/utils_test.go
index bc2aea8f84..98590a239e 100644
--- a/pkg/controller/utils/utils_test.go
+++ b/pkg/controller/utils/utils_test.go
@@ -25,14 +25,13 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/stretchr/testify/mock"
 
 	apps "k8s.io/api/apps/v1"
 	batchv1 "k8s.io/api/batch/v1"
 	corev1 "k8s.io/api/core/v1"
-	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/client-go/discovery"
@@ -65,7 +64,7 @@ var _ = Describe("Utils elasticsearch license type tests", func() {
 		err := apis.AddToScheme(scheme)
 		Expect(err).NotTo(HaveOccurred())
 
-		Expect(v1.SchemeBuilder.AddToScheme(scheme)).ShouldNot(HaveOccurred())
+		Expect(corev1.SchemeBuilder.AddToScheme(scheme)).ShouldNot(HaveOccurred())
 		Expect(apps.SchemeBuilder.AddToScheme(scheme)).ShouldNot(HaveOccurred())
 		Expect(batchv1.SchemeBuilder.AddToScheme(scheme)).ShouldNot(HaveOccurred())
 
@@ -144,7 +143,7 @@ var _ = Describe("Utils APIServer type tests", func() {
 		err := apis.AddToScheme(scheme)
 		Expect(err).NotTo(HaveOccurred())
 
-		Expect(v1.SchemeBuilder.AddToScheme(scheme)).ShouldNot(HaveOccurred())
+		Expect(corev1.SchemeBuilder.AddToScheme(scheme)).ShouldNot(HaveOccurred())
 		Expect(apps.SchemeBuilder.AddToScheme(scheme)).ShouldNot(HaveOccurred())
 		Expect(batchv1.SchemeBuilder.AddToScheme(scheme)).ShouldNot(HaveOccurred())
 
@@ -239,7 +238,7 @@ var _ = Describe("PopulateK8sServiceEndPoint", func() {
 		err := apis.AddToScheme(scheme)
 		Expect(err).NotTo(HaveOccurred())
 
-		Expect(v1.SchemeBuilder.AddToScheme(scheme)).ShouldNot(HaveOccurred())
+		Expect(corev1.SchemeBuilder.AddToScheme(scheme)).ShouldNot(HaveOccurred())
 		Expect(apps.SchemeBuilder.AddToScheme(scheme)).ShouldNot(HaveOccurred())
 		Expect(batchv1.SchemeBuilder.AddToScheme(scheme)).ShouldNot(HaveOccurred())
 
@@ -250,8 +249,8 @@ var _ = Describe("PopulateK8sServiceEndPoint", func() {
 	It("reads a ConfigMap with KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT.", func() {
 		cmName := render.K8sSvcEndpointConfigMapName
 		cm := &corev1.ConfigMap{}
-		cm.ObjectMeta.Name = cmName
-		cm.ObjectMeta.Namespace = common.OperatorNamespace()
+		cm.Name = cmName
+		cm.Namespace = common.OperatorNamespace()
 		cm.Data = map[string]string{}
 		cm.Data["KUBERNETES_SERVICE_HOST"] = "1.2.3.4"
 		cm.Data["KUBERNETES_SERVICE_PORT"] = "5678"
@@ -345,8 +344,8 @@ var _ = Describe("CreatePredicateForObject", func() {
 		It("should match everything", func() {
 			p := createPredicateForObject(objMeta)
 			Expect(p.Create(event.CreateEvent{})).To(BeTrue())
-			Expect(p.Update(event.UpdateEvent{ObjectOld: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "", Generation: 0}}, ObjectNew: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "", Generation: 0}}})).To(BeTrue())
-			Expect(p.Update(event.UpdateEvent{ObjectOld: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "", Generation: 1}}, ObjectNew: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "", Generation: 2}}})).To(BeTrue())
+			Expect(p.Update(event.UpdateEvent{ObjectOld: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "", Generation: 0}}, ObjectNew: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "", Generation: 0}}})).To(BeTrue())
+			Expect(p.Update(event.UpdateEvent{ObjectOld: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "", Generation: 1}}, ObjectNew: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "", Generation: 2}}})).To(BeTrue())
 			Expect(p.Delete(event.DeleteEvent{})).To(BeTrue())
 		})
 	})
@@ -361,19 +360,19 @@ var _ = Describe("CreatePredicateForObject", func() {
 
 		It("should match if the object name matches", func() {
 			p := createPredicateForObject(objMeta)
-			Expect(p.Create(event.CreateEvent{Object: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: ""}}})).To(BeTrue())
-			Expect(p.Update(event.UpdateEvent{ObjectOld: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "", Generation: 0}}, ObjectNew: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "", Generation: 0}}})).To(BeTrue()) // Generation was not specified.
-			Expect(p.Update(event.UpdateEvent{ObjectOld: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "", Generation: 2}}, ObjectNew: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "", Generation: 3}}})).To(BeTrue())
-			Expect(p.Delete(event.DeleteEvent{Object: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: ""}}})).To(BeTrue())
+			Expect(p.Create(event.CreateEvent{Object: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: ""}}})).To(BeTrue())
+			Expect(p.Update(event.UpdateEvent{ObjectOld: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "", Generation: 0}}, ObjectNew: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "", Generation: 0}}})).To(BeTrue()) // Generation was not specified.
+			Expect(p.Update(event.UpdateEvent{ObjectOld: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "", Generation: 2}}, ObjectNew: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "", Generation: 3}}})).To(BeTrue())
+			Expect(p.Delete(event.DeleteEvent{Object: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: ""}}})).To(BeTrue())
 		})
 
 		It("should not match if the object name does not match, or the generation hasn't changed", func() {
 			p := createPredicateForObject(objMeta)
-			Expect(p.Create(event.CreateEvent{Object: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: ""}}})).To(BeFalse())
-			Expect(p.Update(event.UpdateEvent{ObjectOld: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "", Generation: 0}}, ObjectNew: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "", Generation: 0}}})).To(BeFalse()) // Generation was not specified.
-			Expect(p.Update(event.UpdateEvent{ObjectOld: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "", Generation: 2}}, ObjectNew: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "", Generation: 3}}})).To(BeFalse())
-			Expect(p.Update(event.UpdateEvent{ObjectOld: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "", Generation: 2}}, ObjectNew: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "", Generation: 2}}})).To(BeFalse()) // Generation didn't change.
-			Expect(p.Delete(event.DeleteEvent{Object: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: ""}}})).To(BeFalse())
+			Expect(p.Create(event.CreateEvent{Object: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: ""}}})).To(BeFalse())
+			Expect(p.Update(event.UpdateEvent{ObjectOld: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "", Generation: 0}}, ObjectNew: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "", Generation: 0}}})).To(BeFalse()) // Generation was not specified.
+			Expect(p.Update(event.UpdateEvent{ObjectOld: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "", Generation: 2}}, ObjectNew: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "", Generation: 3}}})).To(BeFalse())
+			Expect(p.Update(event.UpdateEvent{ObjectOld: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "", Generation: 2}}, ObjectNew: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "", Generation: 2}}})).To(BeFalse()) // Generation didn't change.
+			Expect(p.Delete(event.DeleteEvent{Object: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: ""}}})).To(BeFalse())
 		})
 	})
 
@@ -387,19 +386,19 @@ var _ = Describe("CreatePredicateForObject", func() {
 
 		It("should match if the object namespace matches", func() {
 			p := createPredicateForObject(objMeta)
-			Expect(p.Create(event.CreateEvent{Object: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "test-namespace"}}})).To(BeTrue())
-			Expect(p.Update(event.UpdateEvent{ObjectOld: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "test-namespace", Generation: 0}}, ObjectNew: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "test-namespace", Generation: 0}}})).To(BeTrue()) // Generation was not specified.
-			Expect(p.Update(event.UpdateEvent{ObjectOld: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "test-namespace", Generation: 2}}, ObjectNew: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "test-namespace", Generation: 3}}})).To(BeTrue())
-			Expect(p.Delete(event.DeleteEvent{Object: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "test-namespace"}}})).To(BeTrue())
+			Expect(p.Create(event.CreateEvent{Object: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "test-namespace"}}})).To(BeTrue())
+			Expect(p.Update(event.UpdateEvent{ObjectOld: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "test-namespace", Generation: 0}}, ObjectNew: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "test-namespace", Generation: 0}}})).To(BeTrue()) // Generation was not specified.
+			Expect(p.Update(event.UpdateEvent{ObjectOld: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "test-namespace", Generation: 2}}, ObjectNew: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "test-namespace", Generation: 3}}})).To(BeTrue())
+			Expect(p.Delete(event.DeleteEvent{Object: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "test-namespace"}}})).To(BeTrue())
 		})
 
 		It("should not match if the object namespace does not match", func() {
 			p := createPredicateForObject(objMeta)
-			Expect(p.Create(event.CreateEvent{Object: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "other-namespace"}}})).To(BeFalse())
-			Expect(p.Update(event.UpdateEvent{ObjectOld: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "other-namespace", Generation: 0}}, ObjectNew: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "other-namespace", Generation: 0}}})).To(BeFalse()) // Generation was not specified.
-			Expect(p.Update(event.UpdateEvent{ObjectOld: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "other-namespace", Generation: 2}}, ObjectNew: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "other-namespace", Generation: 3}}})).To(BeFalse())
-			Expect(p.Update(event.UpdateEvent{ObjectOld: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "test-namespace", Generation: 2}}, ObjectNew: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "test-namespace", Generation: 2}}})).To(BeFalse()) // Generation didn't change.
-			Expect(p.Delete(event.DeleteEvent{Object: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "other-namespace"}}})).To(BeFalse())
+			Expect(p.Create(event.CreateEvent{Object: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "other-namespace"}}})).To(BeFalse())
+			Expect(p.Update(event.UpdateEvent{ObjectOld: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "other-namespace", Generation: 0}}, ObjectNew: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "other-namespace", Generation: 0}}})).To(BeFalse()) // Generation was not specified.
+			Expect(p.Update(event.UpdateEvent{ObjectOld: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "other-namespace", Generation: 2}}, ObjectNew: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "other-namespace", Generation: 3}}})).To(BeFalse())
+			Expect(p.Update(event.UpdateEvent{ObjectOld: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "test-namespace", Generation: 2}}, ObjectNew: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "test-namespace", Generation: 2}}})).To(BeFalse()) // Generation didn't change.
+			Expect(p.Delete(event.DeleteEvent{Object: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "", Namespace: "other-namespace"}}})).To(BeFalse())
 		})
 	})
 
@@ -413,24 +412,24 @@ var _ = Describe("CreatePredicateForObject", func() {
 
 		It("should match if the object name and namespace match", func() {
 			p := createPredicateForObject(objMeta)
-			Expect(p.Create(event.CreateEvent{Object: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "test-namespace"}}})).To(BeTrue())
-			Expect(p.Update(event.UpdateEvent{ObjectOld: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "test-namespace", Generation: 0}}, ObjectNew: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "test-namespace", Generation: 0}}})).To(BeTrue()) // Generation was not specified.
-			Expect(p.Update(event.UpdateEvent{ObjectOld: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "test-namespace", Generation: 2}}, ObjectNew: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "test-namespace", Generation: 3}}})).To(BeTrue())
-			Expect(p.Delete(event.DeleteEvent{Object: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "test-namespace"}}})).To(BeTrue())
+			Expect(p.Create(event.CreateEvent{Object: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "test-namespace"}}})).To(BeTrue())
+			Expect(p.Update(event.UpdateEvent{ObjectOld: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "test-namespace", Generation: 0}}, ObjectNew: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "test-namespace", Generation: 0}}})).To(BeTrue()) // Generation was not specified.
+			Expect(p.Update(event.UpdateEvent{ObjectOld: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "test-namespace", Generation: 2}}, ObjectNew: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "test-namespace", Generation: 3}}})).To(BeTrue())
+			Expect(p.Delete(event.DeleteEvent{Object: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "test-namespace"}}})).To(BeTrue())
 		})
 
 		It("should not match if the object name or namespace do not match", func() {
 			p := createPredicateForObject(objMeta)
-			Expect(p.Create(event.CreateEvent{Object: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "other-namespace"}}})).To(BeFalse())
-			Expect(p.Update(event.UpdateEvent{ObjectOld: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "other-namespace", Generation: 0}}, ObjectNew: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "other-namespace", Generation: 0}}})).To(BeFalse()) // Generation was not specified.
-			Expect(p.Update(event.UpdateEvent{ObjectOld: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "other-namespace", Generation: 2}}, ObjectNew: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "other-namespace", Generation: 3}}})).To(BeFalse())
-			Expect(p.Update(event.UpdateEvent{ObjectOld: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "other-namespace", Generation: 2}}, ObjectNew: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "test-namespace", Generation: 2}}})).To(BeFalse()) // Generation didn't change.
-			Expect(p.Delete(event.DeleteEvent{Object: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "other-namespace"}}})).To(BeFalse())
-			Expect(p.Create(event.CreateEvent{Object: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "test-namespace"}}})).To(BeFalse())
-			Expect(p.Update(event.UpdateEvent{ObjectOld: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "test-namespace", Generation: 0}}, ObjectNew: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "test-namespace", Generation: 0}}})).To(BeFalse()) // Generation was not specified.
-			Expect(p.Update(event.UpdateEvent{ObjectOld: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "test-namespace", Generation: 2}}, ObjectNew: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "test-namespace", Generation: 3}}})).To(BeFalse())
-			Expect(p.Update(event.UpdateEvent{ObjectOld: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "test-namespace", Generation: 2}}, ObjectNew: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "test-namespace", Generation: 2}}})).To(BeFalse()) // Generation didn't change.
-			Expect(p.Delete(event.DeleteEvent{Object: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "test-namespace"}}})).To(BeFalse())
+			Expect(p.Create(event.CreateEvent{Object: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "other-namespace"}}})).To(BeFalse())
+			Expect(p.Update(event.UpdateEvent{ObjectOld: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "other-namespace", Generation: 0}}, ObjectNew: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "other-namespace", Generation: 0}}})).To(BeFalse()) // Generation was not specified.
+			Expect(p.Update(event.UpdateEvent{ObjectOld: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "other-namespace", Generation: 2}}, ObjectNew: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "other-namespace", Generation: 3}}})).To(BeFalse())
+			Expect(p.Update(event.UpdateEvent{ObjectOld: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "other-namespace", Generation: 2}}, ObjectNew: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "test-namespace", Generation: 2}}})).To(BeFalse()) // Generation didn't change.
+			Expect(p.Delete(event.DeleteEvent{Object: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "test-object", Namespace: "other-namespace"}}})).To(BeFalse())
+			Expect(p.Create(event.CreateEvent{Object: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "test-namespace"}}})).To(BeFalse())
+			Expect(p.Update(event.UpdateEvent{ObjectOld: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "test-namespace", Generation: 0}}, ObjectNew: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "test-namespace", Generation: 0}}})).To(BeFalse()) // Generation was not specified.
+			Expect(p.Update(event.UpdateEvent{ObjectOld: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "test-namespace", Generation: 2}}, ObjectNew: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "test-namespace", Generation: 3}}})).To(BeFalse())
+			Expect(p.Update(event.UpdateEvent{ObjectOld: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "test-namespace", Generation: 2}}, ObjectNew: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "test-namespace", Generation: 2}}})).To(BeFalse()) // Generation didn't change.
+			Expect(p.Delete(event.DeleteEvent{Object: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-object", Namespace: "test-namespace"}}})).To(BeFalse())
 		})
 	})
 
diff --git a/pkg/crds/crds_suite_test.go b/pkg/crds/crds_suite_test.go
index d7b169a890..a5006f6c99 100644
--- a/pkg/crds/crds_suite_test.go
+++ b/pkg/crds/crds_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019, 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019, 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/crds/crds_test.go b/pkg/crds/crds_test.go
index d414b84a78..42fe31a0ec 100644
--- a/pkg/crds/crds_test.go
+++ b/pkg/crds/crds_test.go
@@ -16,7 +16,7 @@ package crds
 
 import (
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	opv1 "github.com/tigera/operator/api/v1"
 )
diff --git a/pkg/crds/operator/operator.tigera.io_apiservers.yaml b/pkg/crds/operator/operator.tigera.io_apiservers.yaml
index afe8dc9263..23850c76cd 100644
--- a/pkg/crds/operator/operator.tigera.io_apiservers.yaml
+++ b/pkg/crds/operator/operator.tigera.io_apiservers.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: apiservers.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crds/operator/operator.tigera.io_applicationlayers.yaml b/pkg/crds/operator/operator.tigera.io_applicationlayers.yaml
index b7002c479b..15fee8c1df 100644
--- a/pkg/crds/operator/operator.tigera.io_applicationlayers.yaml
+++ b/pkg/crds/operator/operator.tigera.io_applicationlayers.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: applicationlayers.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crds/operator/operator.tigera.io_authentications.yaml b/pkg/crds/operator/operator.tigera.io_authentications.yaml
index 3b5c1df5c0..5af90371bb 100644
--- a/pkg/crds/operator/operator.tigera.io_authentications.yaml
+++ b/pkg/crds/operator/operator.tigera.io_authentications.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: authentications.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crds/operator/operator.tigera.io_compliances.yaml b/pkg/crds/operator/operator.tigera.io_compliances.yaml
index dc2f465db3..3c0083fad9 100644
--- a/pkg/crds/operator/operator.tigera.io_compliances.yaml
+++ b/pkg/crds/operator/operator.tigera.io_compliances.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: compliances.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crds/operator/operator.tigera.io_egressgateways.yaml b/pkg/crds/operator/operator.tigera.io_egressgateways.yaml
index 44c3e0c7a9..f97a3ffec4 100644
--- a/pkg/crds/operator/operator.tigera.io_egressgateways.yaml
+++ b/pkg/crds/operator/operator.tigera.io_egressgateways.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: egressgateways.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crds/operator/operator.tigera.io_gatewayapis.yaml b/pkg/crds/operator/operator.tigera.io_gatewayapis.yaml
index 810e4a74d0..e0c8ff4c91 100644
--- a/pkg/crds/operator/operator.tigera.io_gatewayapis.yaml
+++ b/pkg/crds/operator/operator.tigera.io_gatewayapis.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: gatewayapis.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crds/operator/operator.tigera.io_goldmanes.yaml b/pkg/crds/operator/operator.tigera.io_goldmanes.yaml
index f1b163e9ff..c208d2f266 100644
--- a/pkg/crds/operator/operator.tigera.io_goldmanes.yaml
+++ b/pkg/crds/operator/operator.tigera.io_goldmanes.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: goldmanes.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crds/operator/operator.tigera.io_imagesets.yaml b/pkg/crds/operator/operator.tigera.io_imagesets.yaml
index db9b94d3b6..2e96f494af 100644
--- a/pkg/crds/operator/operator.tigera.io_imagesets.yaml
+++ b/pkg/crds/operator/operator.tigera.io_imagesets.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: imagesets.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crds/operator/operator.tigera.io_installations.yaml b/pkg/crds/operator/operator.tigera.io_installations.yaml
index 49825e56d0..468060bba6 100644
--- a/pkg/crds/operator/operator.tigera.io_installations.yaml
+++ b/pkg/crds/operator/operator.tigera.io_installations.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: installations.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crds/operator/operator.tigera.io_intrusiondetections.yaml b/pkg/crds/operator/operator.tigera.io_intrusiondetections.yaml
index f1c19553dc..b44f9c1c82 100644
--- a/pkg/crds/operator/operator.tigera.io_intrusiondetections.yaml
+++ b/pkg/crds/operator/operator.tigera.io_intrusiondetections.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: intrusiondetections.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crds/operator/operator.tigera.io_logcollectors.yaml b/pkg/crds/operator/operator.tigera.io_logcollectors.yaml
index 73a731f85e..c4fe0609fb 100644
--- a/pkg/crds/operator/operator.tigera.io_logcollectors.yaml
+++ b/pkg/crds/operator/operator.tigera.io_logcollectors.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: logcollectors.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crds/operator/operator.tigera.io_logstorages.yaml b/pkg/crds/operator/operator.tigera.io_logstorages.yaml
index 1f65815888..3b3c24336c 100644
--- a/pkg/crds/operator/operator.tigera.io_logstorages.yaml
+++ b/pkg/crds/operator/operator.tigera.io_logstorages.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: logstorages.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crds/operator/operator.tigera.io_managementclusterconnections.yaml b/pkg/crds/operator/operator.tigera.io_managementclusterconnections.yaml
index aa0191adc9..3e73c3c169 100644
--- a/pkg/crds/operator/operator.tigera.io_managementclusterconnections.yaml
+++ b/pkg/crds/operator/operator.tigera.io_managementclusterconnections.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: managementclusterconnections.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crds/operator/operator.tigera.io_managementclusters.yaml b/pkg/crds/operator/operator.tigera.io_managementclusters.yaml
index 6d2c9dfba6..99c7647524 100644
--- a/pkg/crds/operator/operator.tigera.io_managementclusters.yaml
+++ b/pkg/crds/operator/operator.tigera.io_managementclusters.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: managementclusters.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crds/operator/operator.tigera.io_managers.yaml b/pkg/crds/operator/operator.tigera.io_managers.yaml
index 437c8e9c5a..aac9360fb7 100644
--- a/pkg/crds/operator/operator.tigera.io_managers.yaml
+++ b/pkg/crds/operator/operator.tigera.io_managers.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: managers.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crds/operator/operator.tigera.io_monitors.yaml b/pkg/crds/operator/operator.tigera.io_monitors.yaml
index 53c466d0b3..83d9cf0602 100644
--- a/pkg/crds/operator/operator.tigera.io_monitors.yaml
+++ b/pkg/crds/operator/operator.tigera.io_monitors.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: monitors.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crds/operator/operator.tigera.io_nonclusterhosts.yaml b/pkg/crds/operator/operator.tigera.io_nonclusterhosts.yaml
index a9ceff88c8..7c70220384 100644
--- a/pkg/crds/operator/operator.tigera.io_nonclusterhosts.yaml
+++ b/pkg/crds/operator/operator.tigera.io_nonclusterhosts.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: nonclusterhosts.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crds/operator/operator.tigera.io_packetcaptureapis.yaml b/pkg/crds/operator/operator.tigera.io_packetcaptureapis.yaml
index 2050a61ec3..b20c622701 100644
--- a/pkg/crds/operator/operator.tigera.io_packetcaptureapis.yaml
+++ b/pkg/crds/operator/operator.tigera.io_packetcaptureapis.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: packetcaptureapis.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crds/operator/operator.tigera.io_policyrecommendations.yaml b/pkg/crds/operator/operator.tigera.io_policyrecommendations.yaml
index 8aa8192b9c..535fd96b67 100644
--- a/pkg/crds/operator/operator.tigera.io_policyrecommendations.yaml
+++ b/pkg/crds/operator/operator.tigera.io_policyrecommendations.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: policyrecommendations.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crds/operator/operator.tigera.io_tenants.yaml b/pkg/crds/operator/operator.tigera.io_tenants.yaml
index d80f85d35c..b6d2adde2b 100644
--- a/pkg/crds/operator/operator.tigera.io_tenants.yaml
+++ b/pkg/crds/operator/operator.tigera.io_tenants.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: tenants.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crds/operator/operator.tigera.io_tigerastatuses.yaml b/pkg/crds/operator/operator.tigera.io_tigerastatuses.yaml
index 7f1992da6e..c15a8af23f 100644
--- a/pkg/crds/operator/operator.tigera.io_tigerastatuses.yaml
+++ b/pkg/crds/operator/operator.tigera.io_tigerastatuses.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: tigerastatuses.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crds/operator/operator.tigera.io_tlspassthroughroutes.yaml b/pkg/crds/operator/operator.tigera.io_tlspassthroughroutes.yaml
index c2b9b5959e..34df6bc0d6 100644
--- a/pkg/crds/operator/operator.tigera.io_tlspassthroughroutes.yaml
+++ b/pkg/crds/operator/operator.tigera.io_tlspassthroughroutes.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: tlspassthroughroutes.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crds/operator/operator.tigera.io_tlsterminatedroutes.yaml b/pkg/crds/operator/operator.tigera.io_tlsterminatedroutes.yaml
index 4e005a8246..dab111da84 100644
--- a/pkg/crds/operator/operator.tigera.io_tlsterminatedroutes.yaml
+++ b/pkg/crds/operator/operator.tigera.io_tlsterminatedroutes.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: tlsterminatedroutes.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crds/operator/operator.tigera.io_whiskers.yaml b/pkg/crds/operator/operator.tigera.io_whiskers.yaml
index a16774cd1a..13f8ddebb0 100644
--- a/pkg/crds/operator/operator.tigera.io_whiskers.yaml
+++ b/pkg/crds/operator/operator.tigera.io_whiskers.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: whiskers.operator.tigera.io
 spec:
   group: operator.tigera.io
diff --git a/pkg/crypto/crypto_test.go b/pkg/crypto/crypto_test.go
index b70d55b601..5310f09534 100644
--- a/pkg/crypto/crypto_test.go
+++ b/pkg/crypto/crypto_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2022-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@ package crypto
 import (
 	"testing"
 
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 )
 
 func TestGeneratePassword(t *testing.T) {
diff --git a/pkg/dns/dns.go b/pkg/dns/dns.go
index 016c00740c..9c89ee6a25 100644
--- a/pkg/dns/dns.go
+++ b/pkg/dns/dns.go
@@ -37,7 +37,7 @@ func GetClusterDomain(resolvConfPath string) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	defer file.Close()
+	defer func() { _ = file.Close() }()
 
 	reg := regexp.MustCompile(`^search.*?\ssvc\.([^\s]*)`)
 
@@ -73,7 +73,7 @@ func Nameservers(resolvConfPath string) ([]string, error) {
 	if err != nil {
 		return nil, err
 	}
-	defer file.Close()
+	defer func() { _ = file.Close() }()
 
 	reg := regexp.MustCompile(`^nameserver\s+([^\s]+)`)
 
diff --git a/pkg/dns/dns_suite_test.go b/pkg/dns/dns_suite_test.go
index 1061872f55..9003834b62 100644
--- a/pkg/dns/dns_suite_test.go
+++ b/pkg/dns/dns_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019, 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019, 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/dns/dns_test.go b/pkg/dns/dns_test.go
index e725d0c362..2e68ac0410 100644
--- a/pkg/dns/dns_test.go
+++ b/pkg/dns/dns_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2020-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/tigera/operator/pkg/dns"
 )
diff --git a/pkg/render/apiserver.go b/pkg/render/apiserver.go
index 2606778621..d6f89a11ec 100644
--- a/pkg/render/apiserver.go
+++ b/pkg/render/apiserver.go
@@ -680,7 +680,7 @@ func (c *apiServerComponent) calicoCustomResourcesClusterRole() *rbacv1.ClusterR
 			},
 		},
 	}
-	if c.cfg.KubernetesVersion == nil || !(c.cfg.KubernetesVersion != nil && c.cfg.KubernetesVersion.Major < 2 && c.cfg.KubernetesVersion.Minor < 30) {
+	if c.cfg.KubernetesVersion == nil || c.cfg.KubernetesVersion.Major >= 2 || c.cfg.KubernetesVersion.Minor >= 30 {
 		// If the kubernetes version is higher than 1.30, we add extra RBAC permissions to allow establishing watches.
 		// https://v1-30.docs.kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/
 		rules = append(rules, rbacv1.PolicyRule{
@@ -1011,11 +1011,12 @@ func getContainerPort(cfg *APIServerConfiguration, containerName ContainerName)
 	}
 
 	// If no override port is found, return the default port
-	if containerName == APIServerContainerName {
+	switch containerName {
+	case APIServerContainerName:
 		return &operatorv1.APIServerDeploymentContainerPort{ContainerPort: APIServerPort}
-	} else if containerName == TigeraAPIServerQueryServerContainerName {
+	case TigeraAPIServerQueryServerContainerName:
 		return &operatorv1.APIServerDeploymentContainerPort{ContainerPort: QueryServerPort}
-	} else if containerName == L7AdmissionControllerContainerName {
+	case L7AdmissionControllerContainerName:
 		return &operatorv1.APIServerDeploymentContainerPort{ContainerPort: L7AdmissionControllerPort}
 	}
 
@@ -1163,7 +1164,7 @@ func (c *apiServerComponent) apiServerDeployment() *appsv1.Deployment {
 		if c.cfg.TrustedBundle != nil {
 			trustedBundleHashAnnotations := c.cfg.TrustedBundle.HashAnnotations()
 			for k, v := range trustedBundleHashAnnotations {
-				d.Spec.Template.ObjectMeta.Annotations[k] = v
+				d.Spec.Template.Annotations[k] = v
 			}
 		}
 	}
@@ -1178,7 +1179,7 @@ func (c *apiServerComponent) apiServerDeployment() *appsv1.Deployment {
 // apiServer creates a MutatingWebhookConfiguration for sidecars.
 func (c *apiServerComponent) sidecarMutatingWebhookConfig() *admregv1.MutatingWebhookConfiguration {
 	var cacert []byte
-	var svcPort int32 = getContainerPort(c.cfg, L7AdmissionControllerContainerName).ContainerPort
+	var svcPort = getContainerPort(c.cfg, L7AdmissionControllerContainerName).ContainerPort
 
 	svcpath := "/sidecar-webhook"
 	svcref := admregv1.ServiceReference{
diff --git a/pkg/render/apiserver_test.go b/pkg/render/apiserver_test.go
index 72d59bcee7..9bebc12448 100644
--- a/pkg/render/apiserver_test.go
+++ b/pkg/render/apiserver_test.go
@@ -24,7 +24,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"github.com/onsi/gomega/gstruct"
 
 	"github.com/openshift/library-go/pkg/crypto"
@@ -350,11 +350,12 @@ var _ = Describe("API server rendering tests (Calico Enterprise)", func() {
 		Expect(svc.Spec.Ports).To(HaveLen(2))
 		serviceFound := 0
 		for _, p := range svc.Spec.Ports {
-			if p.Name == render.APIServerPortName {
+			switch p.Name {
+			case render.APIServerPortName:
 				Expect(p.Port).To(Equal(int32(443)))
 				Expect(p.TargetPort.IntValue()).To(Equal(5443))
 				serviceFound++
-			} else if p.Name == render.QueryServerPortName {
+			case render.QueryServerPortName:
 				Expect(p.Port).To(Equal(int32(8080)))
 				Expect(p.TargetPort.IntValue()).To(Equal(8080))
 				serviceFound++
@@ -1246,14 +1247,15 @@ var _ = Describe("API server rendering tests (Calico Enterprise)", func() {
 			Expect(d.Spec.Template.Spec.Containers).To(HaveLen(3))
 			containersFound := 0
 			for _, c := range d.Spec.Template.Spec.Containers {
-				if c.Name == "calico-apiserver" {
+				switch c.Name {
+				case "calico-apiserver":
 					Expect(c.Resources).To(Equal(rr1))
 					Expect(c.Ports[0].Name).To(Equal(apiServerPort.Name))
 					Expect(c.Ports[0].ContainerPort).To(Equal(apiServerPort.ContainerPort))
 
 					Expect(c.Args[0]).To(ContainSubstring(fmt.Sprintf("--secure-port=%d", apiServerPort.ContainerPort)))
 					containersFound++
-				} else if c.Name == "tigera-queryserver" {
+				case "tigera-queryserver":
 					Expect(c.Resources).To(Equal(rr2))
 					Expect(c.Ports[0].Name).To(Equal(queryServerPort.Name))
 					Expect(c.Ports[0].ContainerPort).To(Equal(queryServerPort.ContainerPort))
@@ -1261,7 +1263,7 @@ var _ = Describe("API server rendering tests (Calico Enterprise)", func() {
 					Expect(c.Env[1].Name).To(Equal("LISTEN_ADDR"))
 					Expect(c.Env[1].Value).To(Equal(fmt.Sprintf(":%d", queryServerPort.ContainerPort)))
 					containersFound++
-				} else if c.Name == "calico-l7-admission-controller" {
+				case "calico-l7-admission-controller":
 					Expect(c.Resources).To(Equal(rr2))
 					Expect(c.Ports[0].Name).To(Equal(l7AdmCtrlPort.Name))
 					Expect(c.Ports[0].ContainerPort).To(Equal(l7AdmCtrlPort.ContainerPort))
@@ -1291,15 +1293,16 @@ var _ = Describe("API server rendering tests (Calico Enterprise)", func() {
 			Expect(svc.Spec.Ports).To(HaveLen(3))
 			servicesFound := 0
 			for _, p := range svc.Spec.Ports {
-				if p.Name == render.APIServerPortName {
+				switch p.Name {
+				case render.APIServerPortName:
 					Expect(p.Port).To(Equal(int32(443)))
 					Expect(p.TargetPort.IntVal).To(Equal(apiServerPort.ContainerPort))
 					servicesFound++
-				} else if p.Name == render.QueryServerPortName {
+				case render.QueryServerPortName:
 					Expect(p.Port).To(Equal(int32(8080)))
 					Expect(p.TargetPort.IntVal).To(Equal(queryServerPort.ContainerPort))
 					servicesFound++
-				} else if p.Name == render.L7AdmissionControllerPortName {
+				case render.L7AdmissionControllerPortName:
 					Expect(p.Port).To(Equal(int32(6443)))
 					Expect(p.TargetPort.IntVal).To(Equal(l7AdmCtrlPort.ContainerPort))
 					servicesFound++
diff --git a/pkg/render/applicationlayer/applicationlayer_suit_test.go b/pkg/render/applicationlayer/applicationlayer_suit_test.go
index 63b342a2f1..686b74d4b0 100644
--- a/pkg/render/applicationlayer/applicationlayer_suit_test.go
+++ b/pkg/render/applicationlayer/applicationlayer_suit_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2021-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2021-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	"github.com/onsi/ginkgo/reporters"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 )
 
 func TestRender(t *testing.T) {
diff --git a/pkg/render/applicationlayer/applicationlayer_test.go b/pkg/render/applicationlayer/applicationlayer_test.go
index 90e8cc9ee9..aa89b7ab6c 100644
--- a/pkg/render/applicationlayer/applicationlayer_test.go
+++ b/pkg/render/applicationlayer/applicationlayer_test.go
@@ -16,7 +16,7 @@ package applicationlayer_test
 
 import (
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
diff --git a/pkg/render/aws-securitygroup-setup_test.go b/pkg/render/aws-securitygroup-setup_test.go
index e9e13c9161..a5b1623957 100644
--- a/pkg/render/aws-securitygroup-setup_test.go
+++ b/pkg/render/aws-securitygroup-setup_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2022-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ package render
 
 import (
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	batchv1 "k8s.io/api/batch/v1"
 	corev1 "k8s.io/api/core/v1"
diff --git a/pkg/render/common/authentication/types.go b/pkg/render/common/authentication/types.go
index f491f3afee..ae442ed3d6 100644
--- a/pkg/render/common/authentication/types.go
+++ b/pkg/render/common/authentication/types.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2020-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -63,7 +63,7 @@ func NewWellKnownConfig(issuerURL string, rootCA []byte) (*WellKnownConfig, erro
 	if err != nil {
 		return nil, err
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
@@ -99,7 +99,7 @@ func (wk *WellKnownConfig) GetJWKS() ([]byte, error) {
 	if err != nil {
 		return nil, err
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	keys, err := io.ReadAll(resp.Body)
 	if err != nil {
diff --git a/pkg/render/common/components/components_suite_test.go b/pkg/render/common/components/components_suite_test.go
index a8496d48ce..8053d9c4d5 100644
--- a/pkg/render/common/components/components_suite_test.go
+++ b/pkg/render/common/components/components_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2022 - 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022 - 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/render/common/components/components_test.go b/pkg/render/common/components/components_test.go
index 2695c231e1..331f88b24c 100644
--- a/pkg/render/common/components/components_test.go
+++ b/pkg/render/common/components/components_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2022-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	v1 "github.com/tigera/operator/api/v1"
 	"github.com/tigera/operator/pkg/ptr"
 	appsv1 "k8s.io/api/apps/v1"
diff --git a/pkg/render/common/elasticsearch/decorator_test.go b/pkg/render/common/elasticsearch/decorator_test.go
index 97d0451ef0..b3b92ac442 100644
--- a/pkg/render/common/elasticsearch/decorator_test.go
+++ b/pkg/render/common/elasticsearch/decorator_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019, 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019, 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@ import (
 	"github.com/tigera/operator/pkg/dns"
 	rmeta "github.com/tigera/operator/pkg/render/common/meta"
 
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	corev1 "k8s.io/api/core/v1"
 )
diff --git a/pkg/render/common/meta/meta.go b/pkg/render/common/meta/meta.go
index 83e93ed627..3af6b4acf6 100644
--- a/pkg/render/common/meta/meta.go
+++ b/pkg/render/common/meta/meta.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2022-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -93,7 +93,7 @@ func DefaultOperatorCASignerName() string {
 // is updated.
 func AnnotationHash(i interface{}) string {
 	h := sha1.New()
-	_, _ = h.Write([]byte(fmt.Sprintf("%q", i)))
+	_, _ = fmt.Fprintf(h, "%q", i)
 	return fmt.Sprintf("%x", h.Sum(nil))
 }
 
diff --git a/pkg/render/common/test/testing.go b/pkg/render/common/test/testing.go
index 893ed28e84..49188ad4d2 100644
--- a/pkg/render/common/test/testing.go
+++ b/pkg/render/common/test/testing.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2021-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2021-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -22,14 +22,13 @@ import (
 	"regexp"
 	"strings"
 
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	v3 "github.com/tigera/api/pkg/apis/projectcalico/v3"
 	rmeta "github.com/tigera/operator/pkg/render/common/meta"
 	"github.com/tigera/operator/pkg/tls"
 
 	corev1 "k8s.io/api/core/v1"
-	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -205,7 +204,7 @@ func GetGlobalResource(resources []client.Object, name, group, version, kind str
 	return nil
 }
 
-func GetContainer(containers []v1.Container, name string) *v1.Container {
+func GetContainer(containers []corev1.Container, name string) *corev1.Container {
 	for _, container := range containers {
 		if container.Name == name {
 			return &container
@@ -242,7 +241,7 @@ func ExpectGlobalAlertTemplateToBePopulated(resource runtime.Object) {
 	}
 }
 
-func ExpectEnv(env []v1.EnvVar, key, value string) {
+func ExpectEnv(env []corev1.EnvVar, key, value string) {
 	for _, e := range env {
 		if e.Name == key {
 			Expect(e.Value).To(Equal(value))
@@ -252,7 +251,7 @@ func ExpectEnv(env []v1.EnvVar, key, value string) {
 	Expect(false).To(BeTrue(), fmt.Sprintf("Missing expected environment variable %s", key))
 }
 
-func ExpectVolumeMount(vms []v1.VolumeMount, name, path string) {
+func ExpectVolumeMount(vms []corev1.VolumeMount, name, path string) {
 	for _, vm := range vms {
 		if vm.Name == name {
 			Expect(vm.MountPath).To(Equal(path))
diff --git a/pkg/render/compliance_test.go b/pkg/render/compliance_test.go
index 32c1d1c0c9..d059f4f41d 100644
--- a/pkg/render/compliance_test.go
+++ b/pkg/render/compliance_test.go
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
diff --git a/pkg/render/csi_test.go b/pkg/render/csi_test.go
index db8e3d3282..cf0b5171e4 100644
--- a/pkg/render/csi_test.go
+++ b/pkg/render/csi_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2022-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022-2026 Tigera, Inc. All rights reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 	"strings"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
diff --git a/pkg/render/dex_config_test.go b/pkg/render/dex_config_test.go
index 017c79806b..251bf611c9 100644
--- a/pkg/render/dex_config_test.go
+++ b/pkg/render/dex_config_test.go
@@ -20,7 +20,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	operatorv1 "github.com/tigera/operator/api/v1"
 	"github.com/tigera/operator/pkg/common"
diff --git a/pkg/render/dex_test.go b/pkg/render/dex_test.go
index f0dbcc587e..6b47342239 100644
--- a/pkg/render/dex_test.go
+++ b/pkg/render/dex_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2020-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"gopkg.in/yaml.v2"
 
diff --git a/pkg/render/egressgateway/egressgateway.go b/pkg/render/egressgateway/egressgateway.go
index e2e8e0fc96..2fe7bab92f 100644
--- a/pkg/render/egressgateway/egressgateway.go
+++ b/pkg/render/egressgateway/egressgateway.go
@@ -87,7 +87,7 @@ func (c *component) ResolveImages(is *operatorv1.ImageSet) error {
 	prefix := c.config.Installation.ImagePrefix
 
 	if c.config.OSType != c.SupportedOSType() {
-		return fmt.Errorf("Egress Gateway is supported only on %s", c.SupportedOSType())
+		return fmt.Errorf("egress Gateway is supported only on %s", c.SupportedOSType())
 	}
 
 	var err error
@@ -125,11 +125,11 @@ func (c *component) Objects() ([]client.Object, []client.Object) {
 
 func (c *component) egwOperatorSecretsRoleBinding() *rbacv1.RoleBinding {
 	operatorSecretRB := render.CreateOperatorSecretsRoleBinding(c.config.EgressGW.Namespace)
-	operatorSecretRB.ObjectMeta.Labels = common.MapExistsOrInitialize(operatorSecretRB.ObjectMeta.Labels)
+	operatorSecretRB.Labels = common.MapExistsOrInitialize(operatorSecretRB.Labels)
 	// The tigera-operator-secrets RoleBinding is shared across all EGW CRs in this namespace.
 	// As such, we mark it as having multiple owners so that we maintain multiple owner references
 	// when creating the rolebinding so that it will only be GC'd when all of its owners have been deleted.
-	operatorSecretRB.ObjectMeta.Labels[common.MultipleOwnersLabel] = "true"
+	operatorSecretRB.Labels[common.MultipleOwnersLabel] = "true"
 	return operatorSecretRB
 }
 
@@ -321,11 +321,11 @@ func (c *component) egwPullSecrets() []*corev1.Secret {
 	for _, secret := range c.config.PullSecrets {
 		x := secret.DeepCopy()
 		x.ObjectMeta = metav1.ObjectMeta{Name: secret.Name, Namespace: c.config.EgressGW.Namespace}
-		x.ObjectMeta.Labels = common.MapExistsOrInitialize(x.ObjectMeta.Labels)
+		x.Labels = common.MapExistsOrInitialize(x.Labels)
 		// Each pull secret is shared across all of the EGW deployments in this namespace.
 		// As such, we mark it as having multiple owners so that we maintain multiple owner references
 		// when creating the secret so that it will only be GC'd when all of its owners have been deleted.
-		x.ObjectMeta.Labels[common.MultipleOwnersLabel] = "true"
+		x.Labels[common.MultipleOwnersLabel] = "true"
 		secrets = append(secrets, x)
 	}
 	return secrets
diff --git a/pkg/render/egressgateway/egressgateway_suite_test.go b/pkg/render/egressgateway/egressgateway_suite_test.go
index 7494257470..3a9514d212 100644
--- a/pkg/render/egressgateway/egressgateway_suite_test.go
+++ b/pkg/render/egressgateway/egressgateway_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	"github.com/onsi/ginkgo/reporters"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	uzap "go.uber.org/zap"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
diff --git a/pkg/render/egressgateway/egressgateway_test.go b/pkg/render/egressgateway/egressgateway_test.go
index b8227160fa..5e014a2d91 100644
--- a/pkg/render/egressgateway/egressgateway_test.go
+++ b/pkg/render/egressgateway/egressgateway_test.go
@@ -16,7 +16,7 @@ package egressgateway_test
 
 import (
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -209,7 +209,7 @@ var _ = Describe("Egress Gateway rendering tests", func() {
 		for _, elem := range expectedEnvVars {
 			Expect(egwContainer.Env).To(ContainElement(elem))
 		}
-		ipPoolAnnotation := dep.Spec.Template.ObjectMeta.Annotations["cni.projectcalico.org/ipv4pools"]
+		ipPoolAnnotation := dep.Spec.Template.Annotations["cni.projectcalico.org/ipv4pools"]
 		expectedIPPoolAnnotation := "[\"ippool-1\",\"ippool-2\"]"
 		Expect(ipPoolAnnotation).To(Equal(expectedIPPoolAnnotation))
 		Expect(dep.Spec.Template.ObjectMeta.Annotations["egress.projectcalico.org/externalNetworkNames"]).To(Equal("[\"one\",\"two\"]"))
@@ -285,7 +285,7 @@ var _ = Describe("Egress Gateway rendering tests", func() {
 		Expect(resources).To(HaveLen(3))
 		dep := rtest.GetResource(resources, "egress-test", "test-ns", "apps", "v1", "Deployment").(*appsv1.Deployment)
 		Expect(dep.Spec.Template.Spec.Containers[0].Resources).To(Equal(expectedResource))
-		elasticIPAnnotation := dep.Spec.Template.ObjectMeta.Annotations["cni.projectcalico.org/awsElasticIPs"]
+		elasticIPAnnotation := dep.Spec.Template.Annotations["cni.projectcalico.org/awsElasticIPs"]
 		Expect(elasticIPAnnotation).To(Equal("[\"1.2.3.4\",\"5.6.7.8\"]"))
 	})
 
diff --git a/pkg/render/fluentd_test.go b/pkg/render/fluentd_test.go
index 1a54fdb085..8b5ef2d080 100644
--- a/pkg/render/fluentd_test.go
+++ b/pkg/render/fluentd_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@ package render_test
 import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
diff --git a/pkg/render/gateway_api_test.go b/pkg/render/gateway_api_test.go
index 57e1cc5686..4516537c12 100644
--- a/pkg/render/gateway_api_test.go
+++ b/pkg/render/gateway_api_test.go
@@ -18,7 +18,7 @@ import (
 	"fmt"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	envoyapi "github.com/envoyproxy/gateway/api/v1alpha1"
 	operatorv1 "github.com/tigera/operator/api/v1"
diff --git a/pkg/render/goldmane/component_test.go b/pkg/render/goldmane/component_test.go
index cf7c7f27cb..1a261d2118 100644
--- a/pkg/render/goldmane/component_test.go
+++ b/pkg/render/goldmane/component_test.go
@@ -17,7 +17,7 @@ package goldmane_test
 import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/google/go-cmp/cmp"
 
diff --git a/pkg/render/goldmane/suite_test.go b/pkg/render/goldmane/suite_test.go
index d9e7fbf4c2..6bc7ea3fe7 100644
--- a/pkg/render/goldmane/suite_test.go
+++ b/pkg/render/goldmane/suite_test.go
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/render/guardian_test.go b/pkg/render/guardian_test.go
index 71b83fa2ed..08b8358bf9 100644
--- a/pkg/render/guardian_test.go
+++ b/pkg/render/guardian_test.go
@@ -17,7 +17,7 @@ package render_test
 import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
diff --git a/pkg/render/intrusion_detection_test.go b/pkg/render/intrusion_detection_test.go
index b4a99c5c77..ce9937a4cd 100644
--- a/pkg/render/intrusion_detection_test.go
+++ b/pkg/render/intrusion_detection_test.go
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
diff --git a/pkg/render/intrusiondetection/dpi/dpi_suite_test.go b/pkg/render/intrusiondetection/dpi/dpi_suite_test.go
index 4c0ab5803d..d18fe72a83 100644
--- a/pkg/render/intrusiondetection/dpi/dpi_suite_test.go
+++ b/pkg/render/intrusiondetection/dpi/dpi_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2021, 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2021, 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/render/intrusiondetection/dpi/dpi_test.go b/pkg/render/intrusiondetection/dpi/dpi_test.go
index c1d17117b3..e016d2a6f8 100644
--- a/pkg/render/intrusiondetection/dpi/dpi_test.go
+++ b/pkg/render/intrusiondetection/dpi/dpi_test.go
@@ -17,7 +17,7 @@ package dpi_test
 import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
diff --git a/pkg/render/kubecontrollers/kube-controllers_suite_test.go b/pkg/render/kubecontrollers/kube-controllers_suite_test.go
index ef78049223..b0eaf45998 100644
--- a/pkg/render/kubecontrollers/kube-controllers_suite_test.go
+++ b/pkg/render/kubecontrollers/kube-controllers_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2021, 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2021, 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/render/kubecontrollers/kube-controllers_test.go b/pkg/render/kubecontrollers/kube-controllers_test.go
index 21457c0853..e1cebe8dd6 100644
--- a/pkg/render/kubecontrollers/kube-controllers_test.go
+++ b/pkg/render/kubecontrollers/kube-controllers_test.go
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -696,9 +696,10 @@ var _ = Describe("kube-controllers rendering tests", func() {
 		for _, container := range deployment.Spec.Template.Spec.Containers {
 			if container.Name == kubecontrollers.EsKubeController {
 				for _, env := range container.Env {
-					if env.Name == "OIDC_AUTH_USERNAME_PREFIX" {
+					switch env.Name {
+					case "OIDC_AUTH_USERNAME_PREFIX":
 						usernamePrefix = env.Value
-					} else if env.Name == "OIDC_AUTH_GROUP_PREFIX" {
+					case "OIDC_AUTH_GROUP_PREFIX":
 						groupPrefix = env.Value
 					}
 				}
diff --git a/pkg/render/logstorage/dashboards/dashboards_suite_test.go b/pkg/render/logstorage/dashboards/dashboards_suite_test.go
index 6cd0f9be05..3074b2e01f 100644
--- a/pkg/render/logstorage/dashboards/dashboards_suite_test.go
+++ b/pkg/render/logstorage/dashboards/dashboards_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2024-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/render/logstorage/dashboards/dashboards_test.go b/pkg/render/logstorage/dashboards/dashboards_test.go
index dcc182ed3b..9ccb914e5c 100644
--- a/pkg/render/logstorage/dashboards/dashboards_test.go
+++ b/pkg/render/logstorage/dashboards/dashboards_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2024-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	batchv1 "k8s.io/api/batch/v1"
 	corev1 "k8s.io/api/core/v1"
diff --git a/pkg/render/logstorage/eck/eck_suite_test.go b/pkg/render/logstorage/eck/eck_suite_test.go
index 3a9f485a31..d223e772d5 100644
--- a/pkg/render/logstorage/eck/eck_suite_test.go
+++ b/pkg/render/logstorage/eck/eck_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2024-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/render/logstorage/eck/eck_test.go b/pkg/render/logstorage/eck/eck_test.go
index 0ea1d5a33d..983821189d 100644
--- a/pkg/render/logstorage/eck/eck_test.go
+++ b/pkg/render/logstorage/eck/eck_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2024-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@ package eck_test
 import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
diff --git a/pkg/render/logstorage/esgateway/esgateway_suite_test.go b/pkg/render/logstorage/esgateway/esgateway_suite_test.go
index bd7d7e776a..5a1b50475e 100644
--- a/pkg/render/logstorage/esgateway/esgateway_suite_test.go
+++ b/pkg/render/logstorage/esgateway/esgateway_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2021, 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2021, 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/render/logstorage/esgateway/esgateway_test.go b/pkg/render/logstorage/esgateway/esgateway_test.go
index da9ea77154..41ce0096ab 100644
--- a/pkg/render/logstorage/esgateway/esgateway_test.go
+++ b/pkg/render/logstorage/esgateway/esgateway_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2021-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2021-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
diff --git a/pkg/render/logstorage/esmetrics/elasticsearch_metrics_suite_test.go b/pkg/render/logstorage/esmetrics/elasticsearch_metrics_suite_test.go
index db4fdcd965..70beadd3a5 100644
--- a/pkg/render/logstorage/esmetrics/elasticsearch_metrics_suite_test.go
+++ b/pkg/render/logstorage/esmetrics/elasticsearch_metrics_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2021, 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2021, 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/render/logstorage/esmetrics/elasticsearch_metrics_test.go b/pkg/render/logstorage/esmetrics/elasticsearch_metrics_test.go
index f3f5275933..7ecf5cf174 100644
--- a/pkg/render/logstorage/esmetrics/elasticsearch_metrics_test.go
+++ b/pkg/render/logstorage/esmetrics/elasticsearch_metrics_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2021-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2021-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@ package esmetrics
 import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
diff --git a/pkg/render/logstorage/externalelasticsearch/externalelasticsearch_suite_test.go b/pkg/render/logstorage/externalelasticsearch/externalelasticsearch_suite_test.go
index a467504c47..9b2a403c1e 100644
--- a/pkg/render/logstorage/externalelasticsearch/externalelasticsearch_suite_test.go
+++ b/pkg/render/logstorage/externalelasticsearch/externalelasticsearch_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/render/logstorage/externalelasticsearch/externalelasticsearch_test.go b/pkg/render/logstorage/externalelasticsearch/externalelasticsearch_test.go
index de0c90e56f..0032b46488 100644
--- a/pkg/render/logstorage/externalelasticsearch/externalelasticsearch_test.go
+++ b/pkg/render/logstorage/externalelasticsearch/externalelasticsearch_test.go
@@ -16,7 +16,7 @@ package externalelasticsearch
 
 import (
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
diff --git a/pkg/render/logstorage/kibana/kibana_suite_test.go b/pkg/render/logstorage/kibana/kibana_suite_test.go
index 9bd1de7232..98d1b3eee5 100644
--- a/pkg/render/logstorage/kibana/kibana_suite_test.go
+++ b/pkg/render/logstorage/kibana/kibana_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2024-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/render/logstorage/kibana/kibana_test.go b/pkg/render/logstorage/kibana/kibana_test.go
index 22b0527a2d..870c5babfb 100644
--- a/pkg/render/logstorage/kibana/kibana_test.go
+++ b/pkg/render/logstorage/kibana/kibana_test.go
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
diff --git a/pkg/render/logstorage/linseed/linseed_suite_test.go b/pkg/render/logstorage/linseed/linseed_suite_test.go
index 619602a832..3cbba7cd8d 100644
--- a/pkg/render/logstorage/linseed/linseed_suite_test.go
+++ b/pkg/render/logstorage/linseed/linseed_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2022 - 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022 - 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/render/logstorage/linseed/linseed_test.go b/pkg/render/logstorage/linseed/linseed_test.go
index d4719192df..6f1edc1ce8 100644
--- a/pkg/render/logstorage/linseed/linseed_test.go
+++ b/pkg/render/logstorage/linseed/linseed_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2022-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
diff --git a/pkg/render/logstorage_test.go b/pkg/render/logstorage_test.go
index b8552579a4..c48a9a0856 100644
--- a/pkg/render/logstorage_test.go
+++ b/pkg/render/logstorage_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2020-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	esv1 "github.com/elastic/cloud-on-k8s/v2/pkg/apis/elasticsearch/v1"
 
diff --git a/pkg/render/manager/manager_route_config.go b/pkg/render/manager/manager_route_config.go
index 79ed590634..141e5b7ba1 100644
--- a/pkg/render/manager/manager_route_config.go
+++ b/pkg/render/manager/manager_route_config.go
@@ -199,14 +199,15 @@ func (builder *voltronRouteConfigBuilder) Build() (*VoltronRouteConfig, error) {
 			PathReplace: route.Spec.PathMatch.PathReplace,
 		}
 
-		if route.Spec.Target == operatorv1.TargetTypeUI {
+		switch route.Spec.Target {
+		case operatorv1.TargetTypeUI:
 			uiTLSTerminatedRoutes = append(uiTLSTerminatedRoutes, r)
 			if route.Spec.Unauthenticated != nil {
 				r.Unauthenticated = *route.Spec.Unauthenticated
 			}
-		} else if route.Spec.Target == operatorv1.TargetTypeUpstreamTunnel {
+		case operatorv1.TargetTypeUpstreamTunnel:
 			tunnelTLSTerminatedRoutes = append(tunnelTLSTerminatedRoutes, r)
-		} else {
+		default:
 			return nil, fmt.Errorf("unknown Target value %s", route.Spec.Target)
 		}
 
diff --git a/pkg/render/manager/manager_route_config_test.go b/pkg/render/manager/manager_route_config_test.go
index e9226263eb..73f678d7d1 100644
--- a/pkg/render/manager/manager_route_config_test.go
+++ b/pkg/render/manager/manager_route_config_test.go
@@ -21,7 +21,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
diff --git a/pkg/render/manager/manager_suite_test.go b/pkg/render/manager/manager_suite_test.go
index b5e728c89b..b0b7a02f15 100644
--- a/pkg/render/manager/manager_suite_test.go
+++ b/pkg/render/manager/manager_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2024-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@ import (
 	uzap "go.uber.org/zap"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
diff --git a/pkg/render/manager_test.go b/pkg/render/manager_test.go
index 2ca3b25085..57ec2f12fc 100644
--- a/pkg/render/manager_test.go
+++ b/pkg/render/manager_test.go
@@ -21,7 +21,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
diff --git a/pkg/render/monitor/monitor.go b/pkg/render/monitor/monitor.go
index 881222ad3f..4227974f2e 100644
--- a/pkg/render/monitor/monitor.go
+++ b/pkg/render/monitor/monitor.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2021-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2021-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -1473,7 +1473,7 @@ func (mc *monitorComponent) externalServiceMonitor() (client.Object, bool) {
 		// permissions to the service account. But if the user does not want to use our defaults, it can change the
 		// bearerTokenSecret to one of their choosing. In that case, it is up to the user to provide the required access.
 		// See also api/v1/monitor_types.go.
-		if ep.BearerTokenSecret.LocalObjectReference.Name == TigeraExternalPrometheus {
+		if ep.BearerTokenSecret.Name == TigeraExternalPrometheus {
 			needsRBAC = true
 		}
 	}
diff --git a/pkg/render/monitor/monitor_suite_test.go b/pkg/render/monitor/monitor_suite_test.go
index 2399dbb91a..16e6f4806f 100644
--- a/pkg/render/monitor/monitor_suite_test.go
+++ b/pkg/render/monitor/monitor_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2021, 2023 Tigera, Inc. All rights reserved.
+// Copyright (c) 2021, 2023,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/render/monitor/monitor_test.go b/pkg/render/monitor/monitor_test.go
index df86eb806d..1399c74b44 100644
--- a/pkg/render/monitor/monitor_test.go
+++ b/pkg/render/monitor/monitor_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2021-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2021-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	monitoringv1 "github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1"
 
@@ -785,15 +785,16 @@ var _ = Describe("monitor rendering tests", func() {
 		}
 
 		getExpectedPolicy := func(name types.NamespacedName, scenario testutils.AllowTigeraScenario) *v3.NetworkPolicy {
-			if name.Name == "allow-tigera.calico-node-alertmanager" {
+			switch name.Name {
+			case "allow-tigera.calico-node-alertmanager":
 				return testutils.SelectPolicyByProvider(scenario, expectedAlertmanagerPolicy, expectedAlertmanagerPolicyForOpenshift)
-			} else if name.Name == "allow-tigera.calico-node-alertmanager-mesh" {
+			case "allow-tigera.calico-node-alertmanager-mesh":
 				return testutils.SelectPolicyByProvider(scenario, expectedAlertmanagerMeshPolicy, expectedAlertmanagerMeshPolicyForOpenshift)
-			} else if name.Name == "allow-tigera.prometheus" {
+			case "allow-tigera.prometheus":
 				return testutils.SelectPolicyByProvider(scenario, expectedPrometheusPolicy, expectedPrometheusPolicyForOpenshift)
-			} else if name.Name == "allow-tigera.tigera-prometheus-api" {
+			case "allow-tigera.tigera-prometheus-api":
 				return testutils.SelectPolicyByProvider(scenario, expectedPrometheusApiPolicy, expectedPrometheusApiPolicyForOpenshift)
-			} else if name.Name == "allow-tigera.prometheus-operator" {
+			case "allow-tigera.prometheus-operator":
 				return testutils.SelectPolicyByProvider(scenario, expectedPrometheusOperatorPolicy, expectedPrometheusOperatorPolicyOpenshift)
 			}
 
diff --git a/pkg/render/namespaces_test.go b/pkg/render/namespaces_test.go
index 4443849e42..b30a6ebea5 100644
--- a/pkg/render/namespaces_test.go
+++ b/pkg/render/namespaces_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ package render_test
 
 import (
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
diff --git a/pkg/render/node.go b/pkg/render/node.go
index 7e76573512..24b3b33451 100644
--- a/pkg/render/node.go
+++ b/pkg/render/node.go
@@ -667,7 +667,7 @@ func (c *nodeComponent) createCalicoPluginConfig() map[string]interface{} {
 			"type": "k8s",
 		},
 		"policy_setup_timeout_seconds": linuxPolicySetupTimeoutSeconds,
-		"endpoint_status_dir":          filepath.Join(c.varRunCalicoVolume().VolumeSource.HostPath.Path, "endpoint-status"),
+		"endpoint_status_dir":          filepath.Join(c.varRunCalicoVolume().HostPath.Path, "endpoint-status"),
 	}
 
 	// Determine logging configuration
diff --git a/pkg/render/node_test.go b/pkg/render/node_test.go
index 89d5b35482..636c815518 100644
--- a/pkg/render/node_test.go
+++ b/pkg/render/node_test.go
@@ -20,7 +20,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"github.com/onsi/gomega/gstruct"
 
 	appsv1 "k8s.io/api/apps/v1"
diff --git a/pkg/render/nonclusterhost/nonclusterhost_suite_test.go b/pkg/render/nonclusterhost/nonclusterhost_suite_test.go
index d24ea6a9a8..8c4ca3253c 100644
--- a/pkg/render/nonclusterhost/nonclusterhost_suite_test.go
+++ b/pkg/render/nonclusterhost/nonclusterhost_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2024-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/render/nonclusterhost/nonclusterhost_test.go b/pkg/render/nonclusterhost/nonclusterhost_test.go
index 0d68cbb125..a432f70ccd 100644
--- a/pkg/render/nonclusterhost/nonclusterhost_test.go
+++ b/pkg/render/nonclusterhost/nonclusterhost_test.go
@@ -16,7 +16,7 @@ package nonclusterhost_test
 
 import (
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
diff --git a/pkg/render/packet_capture_api_test.go b/pkg/render/packet_capture_api_test.go
index 9ded278133..0264b36a14 100644
--- a/pkg/render/packet_capture_api_test.go
+++ b/pkg/render/packet_capture_api_test.go
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
diff --git a/pkg/render/policyrecommendation_test.go b/pkg/render/policyrecommendation_test.go
index e67c98dcf7..50704b165e 100644
--- a/pkg/render/policyrecommendation_test.go
+++ b/pkg/render/policyrecommendation_test.go
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
diff --git a/pkg/render/render_suite_test.go b/pkg/render/render_suite_test.go
index 71b5250a27..74079d2739 100644
--- a/pkg/render/render_suite_test.go
+++ b/pkg/render/render_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@ import (
 	uzap "go.uber.org/zap"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
diff --git a/pkg/render/render_test.go b/pkg/render/render_test.go
index f9639e261e..2c3adb2f57 100644
--- a/pkg/render/render_test.go
+++ b/pkg/render/render_test.go
@@ -22,7 +22,7 @@ import (
 	"reflect"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -199,7 +199,7 @@ var _ = Describe("Rendering tests", func() {
 
 	AfterEach(func() {
 		if CurrentGinkgoTestDescription().Failed {
-			logWriter.Flush()
+			_ = logWriter.Flush()
 			fmt.Printf("Logs:\n%s\n", logBuffer.String())
 		}
 	})
diff --git a/pkg/render/testutils/policy.go b/pkg/render/testutils/policy.go
index c9d0ed46ac..0480ad1b36 100644
--- a/pkg/render/testutils/policy.go
+++ b/pkg/render/testutils/policy.go
@@ -15,7 +15,7 @@
 package testutils
 
 import (
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"encoding/json"
 	"fmt"
@@ -72,7 +72,7 @@ func GetExpectedPolicyFromFile(name string) *v3.NetworkPolicy {
 func GetExpectedPolicyFromFileWithReplacements(name string, replacements map[string]string) *v3.NetworkPolicy {
 	jsonFile, err := os.Open(name)
 	Expect(err).ShouldNot(HaveOccurred())
-	defer jsonFile.Close()
+	defer func() { _ = jsonFile.Close() }()
 
 	byteValue, err := io.ReadAll(jsonFile)
 	Expect(err).ShouldNot(HaveOccurred())
@@ -92,7 +92,7 @@ func GetExpectedPolicyFromFileWithReplacements(name string, replacements map[str
 func GetExpectedGlobalPolicyFromFile(name string) *v3.GlobalNetworkPolicy {
 	jsonFile, err := os.Open(name)
 	Expect(err).ShouldNot(HaveOccurred())
-	defer jsonFile.Close()
+	defer func() { _ = jsonFile.Close() }()
 
 	byteValue, err := io.ReadAll(jsonFile)
 	Expect(err).ShouldNot(HaveOccurred())
diff --git a/pkg/render/tiers/tiers_suite_test.go b/pkg/render/tiers/tiers_suite_test.go
index a41e0bdcde..3d57e498dc 100644
--- a/pkg/render/tiers/tiers_suite_test.go
+++ b/pkg/render/tiers/tiers_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/render/tiers/tiers_test.go b/pkg/render/tiers/tiers_test.go
index af37f2239e..a1f46eb068 100644
--- a/pkg/render/tiers/tiers_test.go
+++ b/pkg/render/tiers/tiers_test.go
@@ -17,7 +17,7 @@ package tiers_test
 import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	v3 "github.com/tigera/api/pkg/apis/projectcalico/v3"
 	v1 "github.com/tigera/operator/api/v1"
 	"github.com/tigera/operator/pkg/common"
diff --git a/pkg/render/typha_test.go b/pkg/render/typha_test.go
index 9c0b91f887..a7d48efb82 100644
--- a/pkg/render/typha_test.go
+++ b/pkg/render/typha_test.go
@@ -18,7 +18,7 @@ import (
 	"fmt"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"github.com/onsi/gomega/gstruct"
 
 	appsv1 "k8s.io/api/apps/v1"
diff --git a/pkg/render/whisker/component_test.go b/pkg/render/whisker/component_test.go
index 96f5555239..60d093d0c4 100644
--- a/pkg/render/whisker/component_test.go
+++ b/pkg/render/whisker/component_test.go
@@ -17,7 +17,7 @@ package whisker_test
 import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/google/go-cmp/cmp"
 
diff --git a/pkg/render/whisker/suite_test.go b/pkg/render/whisker/suite_test.go
index 65e0afae7d..b503008e4f 100644
--- a/pkg/render/whisker/suite_test.go
+++ b/pkg/render/whisker/suite_test.go
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/onsi/ginkgo/reporters"
 )
diff --git a/pkg/render/windows_test.go b/pkg/render/windows_test.go
index e43a794397..5da97ebc24 100644
--- a/pkg/render/windows_test.go
+++ b/pkg/render/windows_test.go
@@ -19,7 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"github.com/onsi/gomega/gstruct"
 
 	appsv1 "k8s.io/api/apps/v1"
diff --git a/pkg/tls/certificatemanagement/keypair_test.go b/pkg/tls/certificatemanagement/keypair_test.go
index f948515faa..18345f32da 100644
--- a/pkg/tls/certificatemanagement/keypair_test.go
+++ b/pkg/tls/certificatemanagement/keypair_test.go
@@ -26,7 +26,7 @@ import (
 	"time"
 
 	. "github.com/onsi/ginkgo/v2"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/tigera/operator/pkg/tls/certificatemanagement"
 )
diff --git a/test/active_test.go b/test/active_test.go
index e21ed6be76..525d1e3cbc 100644
--- a/test/active_test.go
+++ b/test/active_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2021-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2021-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -21,7 +21,7 @@ import (
 	"time"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"github.com/go-logr/logr"
 	corev1 "k8s.io/api/core/v1"
diff --git a/test/crd_management_test.go b/test/crd_management_test.go
index 4f6c8c6ddf..458e0298f5 100644
--- a/test/crd_management_test.go
+++ b/test/crd_management_test.go
@@ -21,7 +21,7 @@ import (
 	"time"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	//"github.com/operator-framework/operator-sdk/pkg/restmapper"
 	corev1 "k8s.io/api/core/v1"
diff --git a/test/fv_suite_test.go b/test/fv_suite_test.go
index c952ef4ed3..f7303ad07d 100644
--- a/test/fv_suite_test.go
+++ b/test/fv_suite_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019, 2023-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2019, 2023-2024,2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 
 	"github.com/onsi/ginkgo/reporters"
diff --git a/test/mainline_test.go b/test/mainline_test.go
index 5902d3c3eb..408f5140a0 100644
--- a/test/mainline_test.go
+++ b/test/mainline_test.go
@@ -22,7 +22,7 @@ import (
 	"time"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	apps "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -99,6 +99,17 @@ var _ = Describe("Mainline component function tests", func() {
 		Expect(kerror.IsNotFound(err)).To(BeTrue(), fmt.Sprintf("Expected Installation not to exist, but got: %s", err))
 	})
 
+	JustAfterEach(func() {
+		// If the spec failed, dump pod state from calico-system before AfterEach
+		// tears the resources down. The operator log only shows that the DaemonSet
+		// reports 0 ready pods — to know *why* we need pod descriptions, container
+		// statuses, recent events, and (for restarted containers) the previous logs.
+		if !CurrentGinkgoTestDescription().Failed || mgr == nil {
+			return
+		}
+		dumpCalicoSystemDiagnostics(kubernetes.NewForConfigOrDie(mgr.GetConfig()))
+	})
+
 	AfterEach(func() {
 		defer func() {
 			cancel()
@@ -293,11 +304,12 @@ func getTigeraStatus(client client.Client, name string) (*operator.TigeraStatus,
 func assertAvailable(ts *operator.TigeraStatus) error {
 	var available, degraded, progressing bool
 	for _, condition := range ts.Status.Conditions {
-		if condition.Type == operator.ComponentAvailable {
+		switch condition.Type {
+		case operator.ComponentAvailable:
 			available = condition.Status == operator.ConditionTrue
-		} else if condition.Type == operator.ComponentDegraded {
+		case operator.ComponentDegraded:
 			degraded = condition.Status == operator.ConditionTrue
-		} else if condition.Type == operator.ComponentProgressing {
+		case operator.ComponentProgressing:
 			progressing = condition.Status == operator.ConditionTrue
 		}
 	}
@@ -535,6 +547,130 @@ func verifyCalicoHasDeployed(c client.Client) {
 	}, 60*time.Second).Should(BeNil())
 }
 
+// dumpCalicoSystemDiagnostics writes pod, event, and recent-log state for the
+// calico-system namespace to the GinkgoWriter. Called from JustAfterEach when a
+// spec fails so the failure output captures *why* a calico-node pod isn't Ready.
+func dumpCalicoSystemDiagnostics(cs kubernetes.Interface) {
+	const ns = "calico-system"
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	w := GinkgoWriter
+	fmt.Fprintf(w, "\n===== diagnostics: %s namespace state =====\n", ns)
+
+	if ds, err := cs.AppsV1().DaemonSets(ns).Get(ctx, "calico-node", metav1.GetOptions{}); err != nil {
+		fmt.Fprintf(w, "DaemonSet calico-node: get failed: %v\n", err)
+	} else {
+		s := ds.Status
+		fmt.Fprintf(w, "DaemonSet calico-node: desired=%d current=%d ready=%d available=%d updated=%d misscheduled=%d\n",
+			s.DesiredNumberScheduled, s.CurrentNumberScheduled, s.NumberReady, s.NumberAvailable, s.UpdatedNumberScheduled, s.NumberMisscheduled)
+	}
+
+	pods, err := cs.CoreV1().Pods(ns).List(ctx, metav1.ListOptions{})
+	if err != nil {
+		fmt.Fprintf(w, "list pods in %s failed: %v\n", ns, err)
+	} else {
+		for _, p := range pods.Items {
+			fmt.Fprintf(w, "\n--- pod %s/%s phase=%s node=%s ---\n", p.Namespace, p.Name, p.Status.Phase, p.Spec.NodeName)
+			for _, cond := range p.Status.Conditions {
+				if cond.Status == corev1.ConditionTrue {
+					continue
+				}
+				fmt.Fprintf(w, "  not-true condition: %s=%s reason=%q message=%q\n", cond.Type, cond.Status, cond.Reason, cond.Message)
+			}
+			containerStatuses := append([]corev1.ContainerStatus{}, p.Status.InitContainerStatuses...)
+			containerStatuses = append(containerStatuses, p.Status.ContainerStatuses...)
+			for _, cs := range containerStatuses {
+				fmt.Fprintf(w, "  container %q ready=%v restarts=%d state=%s\n",
+					cs.Name, cs.Ready, cs.RestartCount, describeContainerState(cs.State))
+				if cs.LastTerminationState.Terminated != nil {
+					t := cs.LastTerminationState.Terminated
+					fmt.Fprintf(w, "    last termination: exit=%d signal=%d reason=%q message=%q\n",
+						t.ExitCode, t.Signal, t.Reason, t.Message)
+				}
+			}
+			dumpPodLogs(ctx, cs, p)
+		}
+	}
+
+	if events, err := cs.CoreV1().Events(ns).List(ctx, metav1.ListOptions{Limit: 50}); err != nil {
+		fmt.Fprintf(w, "\nlist events in %s failed: %v\n", ns, err)
+	} else {
+		fmt.Fprintf(w, "\n--- recent events in %s (Warning only) ---\n", ns)
+		for _, e := range events.Items {
+			if e.Type != corev1.EventTypeWarning {
+				continue
+			}
+			fmt.Fprintf(w, "  %s %s/%s %s: %s\n", e.LastTimestamp.Format(time.RFC3339), e.InvolvedObject.Kind, e.InvolvedObject.Name, e.Reason, e.Message)
+		}
+	}
+	fmt.Fprintf(w, "===== end diagnostics =====\n\n")
+}
+
+func describeContainerState(s corev1.ContainerState) string {
+	switch {
+	case s.Waiting != nil:
+		return fmt.Sprintf("Waiting(reason=%q message=%q)", s.Waiting.Reason, s.Waiting.Message)
+	case s.Terminated != nil:
+		return fmt.Sprintf("Terminated(exit=%d reason=%q message=%q)", s.Terminated.ExitCode, s.Terminated.Reason, s.Terminated.Message)
+	case s.Running != nil:
+		return fmt.Sprintf("Running(since=%s)", s.Running.StartedAt.Format(time.RFC3339))
+	}
+	return "<unknown>"
+}
+
+// dumpPodLogs prints the tail of each container's logs. If the container has
+// restarted, also prints the tail of the previous container's logs (--previous)
+// since that's where the crash cause lives.
+func dumpPodLogs(ctx context.Context, cs kubernetes.Interface, p corev1.Pod) {
+	w := GinkgoWriter
+	const tail = int64(50)
+	containers := append([]corev1.Container{}, p.Spec.InitContainers...)
+	containers = append(containers, p.Spec.Containers...)
+	for _, ctr := range containers {
+		streamPodLog(ctx, cs, p, ctr.Name, false, tail)
+		// If this container has restarted, the prior log is likely the one with the cause.
+		for _, st := range append(p.Status.InitContainerStatuses, p.Status.ContainerStatuses...) {
+			if st.Name == ctr.Name && st.RestartCount > 0 {
+				streamPodLog(ctx, cs, p, ctr.Name, true, tail)
+				break
+			}
+		}
+	}
+	_ = w
+}
+
+func streamPodLog(ctx context.Context, cs kubernetes.Interface, p corev1.Pod, container string, previous bool, tail int64) {
+	w := GinkgoWriter
+	tag := "current"
+	if previous {
+		tag = "previous"
+	}
+	fmt.Fprintf(w, "  --- logs %s container=%q (tail=%d) ---\n", tag, container, tail)
+	req := cs.CoreV1().Pods(p.Namespace).GetLogs(p.Name, &corev1.PodLogOptions{
+		Container: container,
+		Previous:  previous,
+		TailLines: &tail,
+	})
+	stream, err := req.Stream(ctx)
+	if err != nil {
+		fmt.Fprintf(w, "    (no logs: %v)\n", err)
+		return
+	}
+	defer stream.Close()
+	buf := make([]byte, 4096)
+	for {
+		n, readErr := stream.Read(buf)
+		if n > 0 {
+			fmt.Fprintf(w, "    %s", string(buf[:n]))
+		}
+		if readErr != nil {
+			break
+		}
+	}
+	fmt.Fprintln(w)
+}
+
 func verifyCRDsExist(c client.Client, variant operator.ProductVariant) {
 	crdNames := []string{}
 	for _, x := range crds.GetCRDs(variant) {
diff --git a/test/pool_test.go b/test/pool_test.go
index 0bf6faf1dc..78b02a7abe 100644
--- a/test/pool_test.go
+++ b/test/pool_test.go
@@ -20,12 +20,11 @@ import (
 	"strings"
 	"time"
 
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/kubernetes"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	corev1 "k8s.io/api/core/v1"
 	kerror "k8s.io/apimachinery/pkg/api/errors"
@@ -74,7 +73,7 @@ var _ = Describe("IPPool FV tests", func() {
 			ObjectMeta: metav1.ObjectMeta{Name: "default"},
 		}
 		err = c.Get(context.Background(), types.NamespacedName{Name: "default"}, instance)
-		Expect(errors.IsNotFound(err)).To(BeTrue(), fmt.Sprintf("Expected Installation not to exist, but got: %s", err))
+		Expect(kerror.IsNotFound(err)).To(BeTrue(), fmt.Sprintf("Expected Installation not to exist, but got: %s", err))
 	})
 
 	AfterEach(func() {
diff --git a/test/struct_defaulter_test.go b/test/struct_defaulter_test.go
index 6106566a03..746f9c1d57 100644
--- a/test/struct_defaulter_test.go
+++ b/test/struct_defaulter_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2022-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022-2026 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ import (
 	"fmt"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 )
 
 type testInterface interface {
diff --git a/test/utils.go b/test/utils.go
index 1fd6a39534..edefff5d1e 100644
--- a/test/utils.go
+++ b/test/utils.go
@@ -33,8 +33,8 @@ import (
 	"k8s.io/apimachinery/pkg/watch"
 	"k8s.io/client-go/kubernetes"
 
-	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	"github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega" //nolint:staticcheck // ST1001: dot import idiomatic for gomega test helpers
 
 	"github.com/openshift/library-go/pkg/crypto"
 
@@ -43,7 +43,6 @@ import (
 	"github.com/tigera/operator/pkg/controller/status"
 
 	corev1 "k8s.io/api/core/v1"
-	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
@@ -87,7 +86,7 @@ func GetResource(c client.Client, obj client.Object) error {
 	return c.Get(context.Background(), k, obj)
 }
 
-func GetContainer(containers []v1.Container, name string) *v1.Container {
+func GetContainer(containers []corev1.Container, name string) *corev1.Container {
 	for _, container := range containers {
 		if container.Name == name {
 			return &container
@@ -103,12 +102,12 @@ func GetContainer(containers []v1.Container, name string) *v1.Container {
 func RunOperator(mgr manager.Manager, ctx context.Context) (doneChan chan struct{}) {
 	doneChan = make(chan struct{})
 	go func() {
-		defer GinkgoRecover()
+		defer ginkgo.GinkgoRecover()
 		_ = mgr.Start(ctx)
 		close(doneChan)
 		// This should not error but it does. Something is not stopping or closing down but
 		// this does not cause other errors. This started happening after updating to
-		// operator-sdk v1.0.1 from v0.10.0.
+		// operator-sdk corev1.0.1 from v0.10.0.
 		//Expect(err).NotTo(HaveOccurred(), func() string {
 		//	var buf bytes.Buffer
 		//	pprof.Lookup("goroutine").WriteTo(&buf, 2)
@@ -120,12 +119,12 @@ func RunOperator(mgr manager.Manager, ctx context.Context) (doneChan chan struct
 	return doneChan
 }
 
-func VerifyPublicCert(secret *v1.Secret, pubKey string, expectedSANs ...string) {
+func VerifyPublicCert(secret *corev1.Secret, pubKey string, expectedSANs ...string) {
 	Expect(secret.Data).To(HaveKey(pubKey))
 	VerifyCertSANs(secret.Data[pubKey], expectedSANs...)
 }
 
-func VerifyCert(secret *v1.Secret, expectedSANs ...string) {
+func VerifyCert(secret *corev1.Secret, expectedSANs ...string) {
 	Expect(secret.Data).To(HaveKey(corev1.TLSPrivateKeyKey))
 	Expect(secret.Data).To(HaveKey(corev1.TLSCertKey))
 
@@ -189,18 +188,18 @@ func (t typhaListWatch) Watch(options metav1.ListOptions) (watch.Interface, erro
 	return t.cs.AppsV1().Deployments("calico-system").Watch(context.Background(), options)
 }
 
-func CreateNode(c kubernetes.Interface, name string, labels map[string]string, annotations map[string]string) *v1.Node {
-	node := &v1.Node{
+func CreateNode(c kubernetes.Interface, name string, labels map[string]string, annotations map[string]string) *corev1.Node {
+	node := &corev1.Node{
 		TypeMeta: metav1.TypeMeta{Kind: "Node", APIVersion: "v1"},
 		ObjectMeta: metav1.ObjectMeta{
 			Name: name,
 		},
 	}
 	if labels != nil {
-		node.ObjectMeta.Labels = labels
+		node.Labels = labels
 	}
 	if annotations != nil {
-		node.ObjectMeta.Annotations = annotations
+		node.Annotations = annotations
 	}
 
 	var err error
@@ -209,13 +208,13 @@ func CreateNode(c kubernetes.Interface, name string, labels map[string]string, a
 	return node
 }
 
-func CreateWindowsNode(cs kubernetes.Interface, name string, variant operator.ProductVariant, version string) *v1.Node {
+func CreateWindowsNode(cs kubernetes.Interface, name string, variant operator.ProductVariant, version string) *corev1.Node {
 	return CreateNode(cs, name,
 		map[string]string{"kubernetes.io/os": "windows"},
 		map[string]string{})
 }
 
-func AssertNodesUnchanged(c kubernetes.Interface, nodes ...*v1.Node) error {
+func AssertNodesUnchanged(c kubernetes.Interface, nodes ...*corev1.Node) error {
 	for _, node := range nodes {
 		newNode, err := c.CoreV1().Nodes().Get(context.Background(), node.Name, metav1.GetOptions{})
 		Expect(err).To(BeNil())
@@ -235,7 +234,7 @@ func DeleteAllowTigeraTierAndExpectWait(ctx context.Context, c client.Client, r
 	mockStatus.On("SetDegraded", operator.ResourceNotReady, "Waiting for allow-tigera tier to be created, see the 'tiers' TigeraStatus for more information", "tiers.projectcalico.org \"allow-tigera\" not found", mock.Anything).Return()
 	_, err = r.Reconcile(ctx, reconcile.Request{})
 	Expect(err).ShouldNot(HaveOccurred())
-	mockStatus.AssertExpectations(GinkgoT())
+	mockStatus.AssertExpectations(ginkgo.GinkgoT())
 }
 
 // ExpectWaitForTierWatch expects the Reconciler issues a degraded status, waiting for a Tier watch to be established.
@@ -252,7 +251,7 @@ func ExpectWaitForWatch(ctx context.Context, r reconcile.Reconciler, mockStatus
 	mockStatus.On("SetDegraded", operator.ResourceNotReady, message, mock.Anything, mock.Anything).Return()
 	_, err := r.Reconcile(ctx, reconcile.Request{})
 	Expect(err).ShouldNot(HaveOccurred())
-	mockStatus.AssertExpectations(GinkgoT())
+	mockStatus.AssertExpectations(ginkgo.GinkgoT())
 }
 
 type ObjectTrackerCall string
diff --git a/test/whisker_test.go b/test/whisker_test.go
index 0e65055232..00bc17f26b 100644
--- a/test/whisker_test.go
+++ b/test/whisker_test.go
@@ -26,7 +26,7 @@ import (
 	"k8s.io/client-go/kubernetes"
 
 	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega" //nolint:staticcheck
 
 	"sigs.k8s.io/controller-runtime/pkg/client"