diff --git a/.golangci.yaml b/.golangci.yaml
index ab77b9d64c..2b6ae814c0 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -10,8 +10,6 @@ issues:
 linters:
   enable:
   - asciicheck
-  - deadcode
-  - depguard
   - errorlint
   - gofmt
   - gosec
@@ -28,3 +26,5 @@ linters:
 
   disable:
   - errcheck
+  - depguard
+  - deadcode
diff --git a/internal/sbom/cyclonedx.go b/internal/sbom/cyclonedx.go
index 643924c6db..0e4728d645 100644
--- a/internal/sbom/cyclonedx.go
+++ b/internal/sbom/cyclonedx.go
@@ -126,7 +126,7 @@ func GenerateImageCycloneDX(mod []byte) ([]byte, error) {
 	return buf.Bytes(), nil
 }
 
-func GenerateIndexCycloneDX(sii oci.SignedImageIndex) ([]byte, error) {
+func GenerateIndexCycloneDX(oci.SignedImageIndex) ([]byte, error) {
 	return nil, nil
 }
 
diff --git a/pkg/build/cache.go b/pkg/build/cache.go
index 085072a07b..8f3e8bb418 100644
--- a/pkg/build/cache.go
+++ b/pkg/build/cache.go
@@ -48,14 +48,14 @@ func (c *layerCache) get(ctx context.Context, file string, miss layerFactory) (v
 	}
 
 	// Cache hit.
-	if diffid, desc, err := c.getMeta(ctx, file); err == nil {
+	if diffid, desc, err := c.getMeta(ctx, file); err != nil {
+		logs.Debug.Printf("getMeta(%q): %v", file, err)
+	} else {
 		return &lazyLayer{
 			diffid:     *diffid,
 			desc:       *desc,
 			buildLayer: miss,
 		}, nil
-	} else {
-		logs.Debug.Printf("getMeta(%q): %v", file, err)
 	}
 
 	// Cache miss.
@@ -158,11 +158,7 @@ func (c *layerCache) put(ctx context.Context, file string, layer v1.Layer) error
 
 	enc = json.NewEncoder(dtodf)
 	enc.SetIndent("", "  ")
-	if err := enc.Encode(&dtod); err != nil {
-		return err
-	}
-
-	return nil
+	return enc.Encode(&dtod)
 }
 
 func (c *layerCache) readDiffToDesc(file string) (diffIDToDescriptor, error) {
diff --git a/pkg/build/gobuild.go b/pkg/build/gobuild.go
index 884460473d..6ec030f8f2 100644
--- a/pkg/build/gobuild.go
+++ b/pkg/build/gobuild.go
@@ -32,7 +32,6 @@ import (
 	"strings"
 	"text/template"
 
-	"github.com/containerd/stargz-snapshotter/estargz"
 	"github.com/google/go-containerregistry/pkg/name"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/empty"
@@ -394,7 +393,7 @@ func writeSBOM(sbom []byte, appFileName, dir, ext string) error {
 		}
 		sbomPath := filepath.Join(sbomDir, appFileName+"."+ext)
 		log.Printf("Writing SBOM to %s", sbomPath)
-		return os.WriteFile(sbomPath, sbom, 0644)
+		return os.WriteFile(sbomPath, sbom, 0644) //nolint:gosec
 	}
 	return nil
 }
@@ -956,10 +955,7 @@ func buildLayer(appPath, file string, platform *v1.Platform, layerMediaType type
 	binaryLayerBytes := binaryLayerBuf.Bytes()
 	return tarball.LayerFromOpener(func() (io.ReadCloser, error) {
 		return io.NopCloser(bytes.NewBuffer(binaryLayerBytes)), nil
-	}, tarball.WithCompressedCaching, tarball.WithEstargzOptions(estargz.WithPrioritizedFiles([]string{
-		// When using estargz, prioritize downloading the binary entrypoint.
-		appPath,
-	})), tarball.WithMediaType(layerMediaType))
+	}, tarball.WithCompressedCaching, tarball.WithMediaType(layerMediaType))
 }
 
 // Append appPath to the PATH environment variable, if it exists. Otherwise,
@@ -1226,18 +1222,15 @@ func (pm *platformMatcher) matches(base *v1.Platform) bool {
 			if p.OS != "windows" {
 				// osversion mismatch is only possibly allowed when os == windows.
 				continue
-			} else {
-				if pcount, bcount := strings.Count(p.OSVersion, "."), strings.Count(base.OSVersion, "."); pcount == 2 && bcount == 3 {
-					if p.OSVersion != base.OSVersion[:strings.LastIndex(base.OSVersion, ".")] {
-						// If requested osversion is X.Y.Z and potential match is X.Y.Z.A, all of X.Y.Z must match.
-						// Any other form of these osversions are not a match.
-						continue
-					}
-				} else {
-					// Partial osversion matching only allows X.Y.Z to match X.Y.Z.A.
+			}
+			if pcount, bcount := strings.Count(p.OSVersion, "."), strings.Count(base.OSVersion, "."); pcount == 2 && bcount == 3 {
+				if p.OSVersion != base.OSVersion[:strings.LastIndex(base.OSVersion, ".")] {
+					// If requested osversion is X.Y.Z and potential match is X.Y.Z.A, all of X.Y.Z must match.
+					// Any other form of these osversions are not a match.
 					continue
 				}
 			}
+			// Otherwise, partial osversion matching only allows X.Y.Z to match X.Y.Z.A.
 		}
 		return true
 	}
diff --git a/pkg/build/limit_test.go b/pkg/build/limit_test.go
index 2fce4eacdc..015bcd70d4 100644
--- a/pkg/build/limit_test.go
+++ b/pkg/build/limit_test.go
@@ -27,17 +27,17 @@ type sleeper struct{}
 var _ Interface = (*sleeper)(nil)
 
 // QualifyImport implements Interface
-func (r *sleeper) QualifyImport(ip string) (string, error) {
+func (*sleeper) QualifyImport(ip string) (string, error) {
 	return ip, nil
 }
 
 // IsSupportedReference implements Interface
-func (r *sleeper) IsSupportedReference(ip string) error {
+func (*sleeper) IsSupportedReference(_ string) error {
 	return nil
 }
 
 // Build implements Interface
-func (r *sleeper) Build(_ context.Context, ip string) (Result, error) {
+func (*sleeper) Build(_ context.Context, _ string) (Result, error) {
 	time.Sleep(50 * time.Millisecond)
 	return nil, nil
 }
diff --git a/pkg/commands/apply.go b/pkg/commands/apply.go
index 4c0f2f83e4..ec1a52088f 100644
--- a/pkg/commands/apply.go
+++ b/pkg/commands/apply.go
@@ -86,7 +86,7 @@ func addApply(topLevel *cobra.Command) {
 			// Issue a "kubectl apply" command reading from stdin,
 			// to which we will pipe the resolved files, and any
 			// remaining flags passed after '--'.
-			kubectlCmd := exec.CommandContext(ctx, "kubectl", append([]string{"apply", "-f", "-"}, args...)...)
+			kubectlCmd := exec.CommandContext(ctx, "kubectl", append([]string{"apply", "-f", "-"}, args...)...) //nolint:gosec
 
 			// Pass through our environment
 			kubectlCmd.Env = os.Environ()
diff --git a/pkg/commands/create.go b/pkg/commands/create.go
index 8c380a9796..a9d9e81519 100644
--- a/pkg/commands/create.go
+++ b/pkg/commands/create.go
@@ -19,7 +19,6 @@ import (
 	"fmt"
 	"os"
 	"os/exec"
-	"strings"
 
 	"github.com/google/ko/pkg/commands/options"
 	"github.com/spf13/cobra"
@@ -87,7 +86,7 @@ func addCreate(topLevel *cobra.Command) {
 			// Issue a "kubectl create" command reading from stdin,
 			// to which we will pipe the resolved files, and any
 			// remaining flags passed after '--'.
-			kubectlCmd := exec.CommandContext(ctx, "kubectl", append([]string{"create", "-f", "-"}, args...)...)
+			kubectlCmd := exec.CommandContext(ctx, "kubectl", append([]string{"create", "-f", "-"}, args...)...) //nolint:gosec
 
 			// Pass through our environment
 			kubectlCmd.Env = os.Environ()
@@ -136,14 +135,3 @@ func addCreate(topLevel *cobra.Command) {
 
 	topLevel.AddCommand(create)
 }
-
-func stripPassword(flags []string) []string {
-	cp := make([]string, len(flags))
-	for _, f := range flags {
-		if strings.HasPrefix(f, "--password=") {
-			f = "--password=REDACTED"
-		}
-		cp = append(cp, f)
-	}
-	return cp
-}
diff --git a/pkg/publish/kind/write_test.go b/pkg/publish/kind/write_test.go
index 865d48f0e9..b5955d2f9b 100644
--- a/pkg/publish/kind/write_test.go
+++ b/pkg/publish/kind/write_test.go
@@ -165,7 +165,7 @@ type fakeProvider struct {
 	nodes []nodes.Node
 }
 
-func (f *fakeProvider) ListInternalNodes(name string) ([]nodes.Node, error) {
+func (f *fakeProvider) ListInternalNodes(string) ([]nodes.Node, error) {
 	return f.nodes, nil
 }
 
@@ -174,7 +174,7 @@ type fakeNode struct {
 	err  error
 }
 
-func (f *fakeNode) CommandContext(ctx context.Context, cmd string, args ...string) exec.Cmd {
+func (f *fakeNode) CommandContext(_ context.Context, cmd string, args ...string) exec.Cmd {
 	command := &fakeCmd{
 		cmd: strings.Join(append([]string{cmd}, args...), " "),
 		err: f.err,
@@ -188,10 +188,10 @@ func (f *fakeNode) String() string {
 }
 
 // The following functions are not used by our code at all.
-func (f *fakeNode) Command(string, ...string) exec.Cmd        { return nil }
-func (f *fakeNode) Role() (string, error)                     { return "", nil }
-func (f *fakeNode) IP() (ipv4 string, ipv6 string, err error) { return "", "", nil }
-func (f *fakeNode) SerialLogs(writer io.Writer) error         { return nil }
+func (f *fakeNode) Command(string, ...string) exec.Cmd { return nil }
+func (f *fakeNode) Role() (string, error)              { return "", nil }
+func (f *fakeNode) IP() (string, string, error)        { return "", "", nil }
+func (f *fakeNode) SerialLogs(io.Writer) error         { return nil }
 
 type fakeCmd struct {
 	cmd   string
diff --git a/pkg/publish/options.go b/pkg/publish/options.go
index d35fd87dca..4e46bf2d74 100644
--- a/pkg/publish/options.go
+++ b/pkg/publish/options.go
@@ -25,7 +25,7 @@ type staticKeychain struct {
 	auth authn.Authenticator
 }
 
-func (s staticKeychain) Resolve(resource authn.Resource) (authn.Authenticator, error) {
+func (s staticKeychain) Resolve(authn.Resource) (authn.Authenticator, error) {
 	return s.auth, nil
 }
 
diff --git a/pkg/publish/shared_test.go b/pkg/publish/shared_test.go
index f229f76b51..4ad3d330c7 100644
--- a/pkg/publish/shared_test.go
+++ b/pkg/publish/shared_test.go
@@ -31,7 +31,7 @@ type slowpublish struct {
 // slowpublish implements Interface
 var _ Interface = (*slowpublish)(nil)
 
-func (sp *slowpublish) Publish(_ context.Context, br build.Result, ref string) (name.Reference, error) {
+func (sp *slowpublish) Publish(context.Context, build.Result, string) (name.Reference, error) {
 	time.Sleep(sp.sleep)
 	return makeRef()
 }