diff --git a/metropolis/node/build/fwprune/main.go b/metropolis/node/build/fwprune/main.go
index dfabcde..4f26fa0 100644
--- a/metropolis/node/build/fwprune/main.go
+++ b/metropolis/node/build/fwprune/main.go
@@ -209,6 +209,9 @@
 	// Format output in a both human- and machine-readable form
 	marshalOpts := prototext.MarshalOptions{Multiline: true, Indent: "  "}
 	fsspecRaw, err := marshalOpts.Marshal(&fsspec.FSSpec{File: files, SymbolicLink: symlinks})
+	if err != nil {
+		log.Fatalf("failed to marshal fsspec: %v", err)
+	}
 	if err := os.WriteFile(*outFSSpecPath, fsspecRaw, 0644); err != nil {
 		log.Fatalf("failed writing output: %v", err)
 	}
diff --git a/metropolis/node/core/curator/state_node.go b/metropolis/node/core/curator/state_node.go
index d580e87..bd11f6a 100644
--- a/metropolis/node/core/curator/state_node.go
+++ b/metropolis/node/core/curator/state_node.go
@@ -446,7 +446,11 @@
 		return status.Errorf(codes.InvalidArgument, "invalid node id")
 	}
 	jkey, err := n.etcdJoinKeyPath()
-
+	if err != nil {
+		// This should never happen.
+		rpc.Trace(ctx).Printf("invalid join key representation: %v", err)
+		return status.Errorf(codes.InvalidArgument, "invalid join key representation")
+	}
 	// Delete both.
 	_, err = l.txnAsLeader(ctx,
 		clientv3.OpDelete(nkey),
diff --git a/metropolis/node/core/mgmt/svc_logs.go b/metropolis/node/core/mgmt/svc_logs.go
index b24e485..6566cee 100644
--- a/metropolis/node/core/mgmt/svc_logs.go
+++ b/metropolis/node/core/mgmt/svc_logs.go
@@ -169,7 +169,6 @@
 		if err != nil {
 			return err
 		}
-		chunk = make([]*cpb.LogEntry, 0, maxChunkSize)
 	}
 
 	// Start serving streaming data, if streaming has been requested.
diff --git a/metropolis/node/core/network/static.go b/metropolis/node/core/network/static.go
index a178e2c..6c72be5 100644
--- a/metropolis/node/core/network/static.go
+++ b/metropolis/node/core/network/static.go
@@ -168,6 +168,8 @@
 			for _, a := range i.Address {
 				ipNet, err := addressOrPrefix(a)
 				if err != nil {
+					l.Warningf("failed to parse %q as IPNet", a)
+					continue
 				}
 				if ipNet.IP.To4() != nil {
 					selectedAddr = ipNet.IP.To4()
diff --git a/metropolis/node/core/update/update.go b/metropolis/node/core/update/update.go
index ad4ad43..8490c78 100644
--- a/metropolis/node/core/update/update.go
+++ b/metropolis/node/core/update/update.go
@@ -275,6 +275,9 @@
 
 func (*Service) tryDownloadBundle(ctx context.Context, bundleURL string, bundleRaw *bytes.Buffer) error {
 	bundleReq, err := http.NewRequestWithContext(ctx, "GET", bundleURL, nil)
+	if err != nil {
+		return fmt.Errorf("failed to create request: %w", err)
+	}
 	bundleRes, err := http.DefaultClient.Do(bundleReq)
 	if err != nil {
 		return fmt.Errorf("HTTP request failed: %w", err)
diff --git a/metropolis/node/kubernetes/authproxy/authproxy.go b/metropolis/node/kubernetes/authproxy/authproxy.go
index e8e6fd8..c4a844e 100644
--- a/metropolis/node/kubernetes/authproxy/authproxy.go
+++ b/metropolis/node/kubernetes/authproxy/authproxy.go
@@ -56,6 +56,9 @@
 
 	k8sCAs := x509.NewCertPool()
 	cert, _, err := s.KPKI.Certificate(ctx, pki.IdCA)
+	if err != nil {
+		return fmt.Errorf("could not load certificate %q from PKI: %w", pki.IdCA, err)
+	}
 	parsedCert, err := x509.ParseCertificate(cert)
 	if err != nil {
 		return fmt.Errorf("failed to parse K8s CA certificate: %w", err)
diff --git a/metropolis/node/kubernetes/pki/kubernetes.go b/metropolis/node/kubernetes/pki/kubernetes.go
index a30aeda..66731ae 100644
--- a/metropolis/node/kubernetes/pki/kubernetes.go
+++ b/metropolis/node/kubernetes/pki/kubernetes.go
@@ -337,7 +337,7 @@
 	// Save to etcd.
 	_, err = k.KV.Put(ctx, path, string(key))
 	if err != nil {
-		err = fmt.Errorf("failed to write newly generated key: %w", err)
+		return nil, fmt.Errorf("failed to write newly generated key: %w", err)
 	}
 	return key, nil
 }
diff --git a/metropolis/node/kubernetes/plugins/kvmdevice/kvmdevice.go b/metropolis/node/kubernetes/plugins/kvmdevice/kvmdevice.go
index bef049a..007bde6 100644
--- a/metropolis/node/kubernetes/plugins/kvmdevice/kvmdevice.go
+++ b/metropolis/node/kubernetes/plugins/kvmdevice/kvmdevice.go
@@ -158,6 +158,9 @@
 	}
 
 	kvmDevNode, err := deviceNumberFromString(string(kvmDevRaw))
+	if err != nil {
+		return fmt.Errorf("failed to parse KVM device node: %w", err)
+	}
 
 	err = unix.Mknod("/dev/kvm", 0660, int(kvmDevNode))
 	if err != nil && errors.Is(err, unix.EEXIST) {
diff --git a/metropolis/node/kubernetes/service_controller.go b/metropolis/node/kubernetes/service_controller.go
index ccb5b29..c1cec27 100644
--- a/metropolis/node/kubernetes/service_controller.go
+++ b/metropolis/node/kubernetes/service_controller.go
@@ -85,6 +85,9 @@
 	}
 
 	clientConfig, err := rawClientConfig.ClientConfig()
+	if err != nil {
+		return fmt.Errorf("could not fetch generate client config: %w", err)
+	}
 	clientSet, err := kubernetes.NewForConfig(clientConfig)
 	if err != nil {
 		return fmt.Errorf("could not generate kubernetes client: %w", err)
diff --git a/metropolis/node/kubernetes/service_worker.go b/metropolis/node/kubernetes/service_worker.go
index 2572dfa..7ad985f 100644
--- a/metropolis/node/kubernetes/service_worker.go
+++ b/metropolis/node/kubernetes/service_worker.go
@@ -238,6 +238,9 @@
 		return nil, nil, fmt.Errorf("could not generate kubernetes client config: %w", err)
 	}
 	clientConfig, err := rawClientConfig.ClientConfig()
+	if err != nil {
+		return nil, nil, fmt.Errorf("could not fetch generate client config: %w", err)
+	}
 	clientSet, err := kubernetes.NewForConfig(clientConfig)
 	if err != nil {
 		return nil, nil, fmt.Errorf("could not generate kubernetes client: %w", err)