diff --git a/third_party/sandboxroot/mirror/bazeldnf.go b/third_party/sandboxroot/mirror/bazeldnf.go
index 4f85581..1a2f5ec 100644
--- a/third_party/sandboxroot/mirror/bazeldnf.go
+++ b/third_party/sandboxroot/mirror/bazeldnf.go
@@ -36,7 +36,7 @@
 
 		ext, err := newRPMDef(name.GoString(), sha256.GoString(), urlsS)
 		if err != nil {
-			return nil, fmt.Errorf("invalid rpm: %v", err)
+			return nil, fmt.Errorf("invalid rpm: %w", err)
 		}
 		res = append(res, ext)
 		return starlark.None, nil
diff --git a/third_party/sandboxroot/mirror/main.go b/third_party/sandboxroot/mirror/main.go
index c7e823e..06479d3 100644
--- a/third_party/sandboxroot/mirror/main.go
+++ b/third_party/sandboxroot/mirror/main.go
@@ -94,7 +94,7 @@
 		path := getRepositoriesBzl()
 		rpms, err := getBazelDNFFiles(path)
 		if err != nil {
-			return fmt.Errorf("could not get RPMs from %s: %v", path, err)
+			return fmt.Errorf("could not get RPMs from %s: %w", path, err)
 		}
 
 		if err := checkMirrorURLs(rpms); err != nil {
@@ -111,7 +111,7 @@
 		for i, rpm := range rpms {
 			has, err := rpm.validateOurs(cmd.Context(), flagDeep)
 			if err != nil {
-				return fmt.Errorf("checking %s failed: %v", rpm.name, err)
+				return fmt.Errorf("checking %s failed: %w", rpm.name, err)
 			}
 			if !has {
 				log.Printf("Missing %s in mirror", rpm.name)
@@ -143,7 +143,7 @@
 		path := getRepositoriesBzl()
 		rpms, err := getBazelDNFFiles(path)
 		if err != nil {
-			return fmt.Errorf("could not get RPMs from %s: %v", path, err)
+			return fmt.Errorf("could not get RPMs from %s: %w", path, err)
 		}
 
 		if err := checkMirrorURLs(rpms); err != nil {
@@ -155,7 +155,7 @@
 			if strings.Contains(err.Error(), "could not find default credentials") {
 				log.Printf("Try running gcloud auth application-default login --no-browser")
 			}
-			return fmt.Errorf("could not build google cloud storage client: %v", err)
+			return fmt.Errorf("could not build google cloud storage client: %w", err)
 		}
 		bucket := client.Bucket(flagMirrorBucketName)