diff --git a/metropolis/test/e2e/k8s_cts/main.go b/metropolis/test/e2e/k8s_cts/main.go
index e419b2f..026ca8a 100644
--- a/metropolis/test/e2e/k8s_cts/main.go
+++ b/metropolis/test/e2e/k8s_cts/main.go
@@ -14,8 +14,9 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// This package launches a Metropolis cluster with two nodes and spawns in the CTS container. Then it streams its output
-// to the console. When the CTS has finished it exits with the appropriate error code.
+// This package launches a Metropolis cluster with two nodes and spawns in the
+// CTS container. Then it streams its output to the console. When the CTS has
+// finished it exits with the appropriate error code.
 package main
 
 import (
@@ -37,18 +38,22 @@
 	"source.monogon.dev/metropolis/test/launch"
 )
 
-// makeCTSPodSpec generates a spec for a standalone pod running the Kubernetes CTS. It also sets the test configuration
-// for the Kubernetes E2E test suite to only run CTS tests and excludes known-broken ones.
+// makeCTSPodSpec generates a spec for a standalone pod running the Kubernetes
+// CTS. It also sets the test configuration for the Kubernetes E2E test suite
+// to only run CTS tests and excludes known-broken ones.
 func makeCTSPodSpec(name string, saName string) *corev1.Pod {
 	skipRegexes := []string{
-		// hostNetworking cannot be supported since we run different network stacks for the host and containers
+		// hostNetworking cannot be supported since we run different network
+		// stacks for the host and containers
 		"should function for node-pod communication",
-		// gVisor misreports statfs() syscalls: https://github.com/google/gvisor/issues/3339
+		// gVisor misreports statfs() syscalls:
+		//   https://github.com/google/gvisor/issues/3339
 		`should support \((non-)?root,`,
 		"volume on tmpfs should have the correct mode",
 		"volume on default medium should have the correct mode",
-		// gVisor doesn't support the full Linux privilege machinery including SUID and NewPrivs
-		// https://github.com/google/gvisor/issues/189#issuecomment-481064000
+		// gVisor doesn't support the full Linux privilege machinery including
+		// SUID and NewPrivs:
+		//   https://github.com/google/gvisor/issues/189#issuecomment-481064000
 		"should run the container as unprivileged when false",
 	}
 	return &corev1.Pod{
@@ -73,10 +78,12 @@
 					ImagePullPolicy: corev1.PullNever,
 				},
 			},
-			Tolerations: []corev1.Toleration{{ // Tolerate all taints, otherwise the CTS likes to self-evict
+			// Tolerate all taints, otherwise the CTS likes to self-evict.
+			Tolerations: []corev1.Toleration{{
 				Operator: "Exists",
 			}},
-			PriorityClassName:  "system-cluster-critical", // Don't evict the CTS pod
+			// Don't evict the CTS pod.
+			PriorityClassName:  "system-cluster-critical",
 			RestartPolicy:      corev1.RestartPolicyNever,
 			ServiceAccountName: saName,
 		},
@@ -145,7 +152,8 @@
 	}
 	var logs io.ReadCloser
 	go func() {
-		// This loops the whole .Stream()/io.Copy process because the API sometimes returns streams that immediately return EOF
+		// This loops the whole .Stream()/io.Copy process because the API
+		// sometimes returns streams that immediately return EOF
 		for {
 			logs, err = clientSet.CoreV1().Pods("default").GetLogs(podName, &corev1.PodLogOptions{Follow: true}).Stream(ctx)
 			if err == nil {
diff --git a/metropolis/test/e2e/kubernetes_helpers.go b/metropolis/test/e2e/kubernetes_helpers.go
index 71e8c3a..3c1f95a 100644
--- a/metropolis/test/e2e/kubernetes_helpers.go
+++ b/metropolis/test/e2e/kubernetes_helpers.go
@@ -33,8 +33,9 @@
 	apb "source.monogon.dev/metropolis/proto/api"
 )
 
-// GetKubeClientSet gets a Kubeconfig from the debug API and creates a K8s ClientSet using it. The identity used has
-// the system:masters group and thus has RBAC access to everything.
+// GetKubeClientSet gets a Kubeconfig from the debug API and creates a K8s
+// ClientSet using it. The identity used has the system:masters group and thus
+// has RBAC access to everything.
 func GetKubeClientSet(ctx context.Context, client apb.NodeDebugServiceClient, port uint16) (kubernetes.Interface, error) {
 	var lastErr = errors.New("context canceled before any operation completed")
 	for {
@@ -67,9 +68,11 @@
 	}
 }
 
-// makeTestDeploymentSpec generates a Deployment spec for a single pod running NGINX with a readiness probe. This allows
-// verifying that the control plane is capable of scheduling simple pods and that kubelet works, its runtime is set up
-// well enough to run a simple container and the network to the pod can pass readiness probe traffic.
+// makeTestDeploymentSpec generates a Deployment spec for a single pod running
+// NGINX with a readiness probe. This allows verifying that the control plane
+// is capable of scheduling simple pods and that kubelet works, its runtime is
+// set up well enough to run a simple container and the network to the pod can
+// pass readiness probe traffic.
 func makeTestDeploymentSpec(name string) *appsv1.Deployment {
 	return &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{Name: name},
diff --git a/metropolis/test/e2e/main_test.go b/metropolis/test/e2e/main_test.go
index 0463fc4..6d9b1db 100644
--- a/metropolis/test/e2e/main_test.go
+++ b/metropolis/test/e2e/main_test.go
@@ -44,8 +44,8 @@
 const (
 	// Timeout for the global test context.
 	//
-	// Bazel would eventually time out the test after 900s ("large") if, for some reason,
-	// the context cancellation fails to abort it.
+	// Bazel would eventually time out the test after 900s ("large") if, for
+	// some reason, the context cancellation fails to abort it.
 	globalTestTimeout = 600 * time.Second
 
 	// Timeouts for individual end-to-end tests of different sizes.
@@ -53,8 +53,10 @@
 	largeTestTimeout = 120 * time.Second
 )
 
-// TestE2E is the main E2E test entrypoint for single-node freshly-bootstrapped E2E tests. It starts a full Metropolis node
-// in bootstrap mode and then runs tests against it. The actual tests it performs are located in the RunGroup subtest.
+// TestE2E is the main E2E test entrypoint for single-node freshly-bootstrapped
+// E2E tests. It starts a full Metropolis node in bootstrap mode and then runs
+// tests against it. The actual tests it performs are located in the RunGroup
+// subtest.
 func TestE2E(t *testing.T) {
 	// Run pprof server for debugging
 	go func() {
@@ -102,8 +104,9 @@
 	}
 	debugClient := apb.NewNodeDebugServiceClient(grpcClient)
 
-	// This exists to keep the parent around while all the children race
-	// It currently tests both a set of OS-level conditions and Kubernetes Deployments and StatefulSets
+	// This exists to keep the parent around while all the children race.
+	// It currently tests both a set of OS-level conditions and Kubernetes
+	// Deployments and StatefulSets
 	t.Run("RunGroup", func(t *testing.T) {
 		t.Run("Get Kubernetes Debug Kubeconfig", func(t *testing.T) {
 			t.Parallel()
diff --git a/metropolis/test/e2e/utils.go b/metropolis/test/e2e/utils.go
index f888189..dcc9eac 100644
--- a/metropolis/test/e2e/utils.go
+++ b/metropolis/test/e2e/utils.go
@@ -23,8 +23,9 @@
 	"time"
 )
 
-// testEventual creates a new subtest looping the given function until it either doesn't return an error anymore or
-// the timeout is exceeded. The last returned non-context-related error is being used as the test error.
+// testEventual creates a new subtest looping the given function until it
+// either doesn't return an error anymore or the timeout is exceeded. The last
+// returned non-context-related error is being used as the test error.
 func testEventual(t *testing.T, name string, ctx context.Context, timeout time.Duration, f func(context.Context) error) {
 	ctx, cancel := context.WithTimeout(ctx, timeout)
 	t.Helper()