diff --git a/cloud/bmaas/bmdb/migrations_test.go b/cloud/bmaas/bmdb/migrations_test.go
index 9ee4ae2..65eef7f 100644
--- a/cloud/bmaas/bmdb/migrations_test.go
+++ b/cloud/bmaas/bmdb/migrations_test.go
@@ -65,8 +65,8 @@
 	// This migration adds a new nullable field to backoffs.
 
 	// This guarantees that versions [prev, ver] can run concurrently in a cluster.
-	min := uint(1672749980)
-	max := uint(1681826233)
+	minVer := uint(1672749980)
+	maxVer := uint(1681826233)
 
 	ctx, ctxC := context.WithCancel(context.Background())
 	defer t.Cleanup(ctxC)
@@ -79,7 +79,7 @@
 
 	// First, make sure the change can actually progress if we have some backoffs
 	// already.
-	if err := b.Database.MigrateUpToIncluding(min); err != nil {
+	if err := b.Database.MigrateUpToIncluding(minVer); err != nil {
 		t.Fatalf("Migration to minimum version failed: %v", err)
 	}
 
@@ -100,7 +100,7 @@
 	}
 
 	// Migrate to newer version.
-	if err := b.Database.MigrateUpToIncluding(max); err != nil {
+	if err := b.Database.MigrateUpToIncluding(maxVer); err != nil {
 		t.Fatalf("Migration to maximum version failed: %v", err)
 	}
 
diff --git a/cloud/bmaas/bmdb/webug/webug.go b/cloud/bmaas/bmdb/webug/webug.go
index e6e1be7..f4d3e4a 100644
--- a/cloud/bmaas/bmdb/webug/webug.go
+++ b/cloud/bmaas/bmdb/webug/webug.go
@@ -36,9 +36,9 @@
 	schema *reflection.Schema
 	// muSchema locks schema for updates.
 	muSchema sync.RWMutex
-	// strictConsistency, when enabled, makes webug render its views with the 
-	// freshest available data, potentially conflicting with online 
-	// transactions. This should only be enabled during testing, as it tends to 
+	// strictConsistency, when enabled, makes webug render its views with the
+	// freshest available data, potentially conflicting with online
+	// transactions. This should only be enabled during testing, as it tends to
 	// clog up the database query planner and make everything slow.
 	strictConsistency bool
 }
@@ -87,9 +87,9 @@
 
 		// Swap the current schema if necessary.
 		cur := s.curSchema().Version
-		new := schema.Version
-		if cur != new {
-			klog.Infof("Got new schema: %s -> %s", cur, new)
+		newVer := schema.Version
+		if cur != newVer {
+			klog.Infof("Got new schema: %s -> %s", cur, newVer)
 			s.muSchema.Lock()
 			s.schema = schema
 			s.muSchema.Unlock()
diff --git a/cloud/equinix/wrapngo/wrapn.go b/cloud/equinix/wrapngo/wrapn.go
index 7bd4522..d249439 100644
--- a/cloud/equinix/wrapngo/wrapn.go
+++ b/cloud/equinix/wrapngo/wrapn.go
@@ -184,10 +184,10 @@
 // variable can be set prior to the below call to enable verbose packngo
 // debug logs.
 func New(opts *Opts) Client {
-	return new(opts)
+	return newClient(opts)
 }
 
-func new(opts *Opts) *client {
+func newClient(opts *Opts) *client {
 	// Apply the defaults.
 	if opts.APIRate == 0 {
 		opts.APIRate = 2 * time.Second
diff --git a/cloud/equinix/wrapngo/wrapngo_live_test.go b/cloud/equinix/wrapngo/wrapngo_live_test.go
index 549071a..fb649c1 100644
--- a/cloud/equinix/wrapngo/wrapngo_live_test.go
+++ b/cloud/equinix/wrapngo/wrapngo_live_test.go
@@ -49,7 +49,7 @@
 	ctx, ctxC := context.WithCancel(context.Background())
 	t.Cleanup(ctxC)
 	return &liveTestClient{
-		cl: new(&Opts{
+		cl: newClient(&Opts{
 			User:   apiuser,
 			APIKey: apikey,
 		}),
diff --git a/metropolis/node/kubernetes/pki/kubernetes.go b/metropolis/node/kubernetes/pki/kubernetes.go
index 962e70d..a30aeda 100644
--- a/metropolis/node/kubernetes/pki/kubernetes.go
+++ b/metropolis/node/kubernetes/pki/kubernetes.go
@@ -109,7 +109,7 @@
 		Certificates: make(map[KubeCertificateName]*opki.Certificate),
 	}
 
-	make := func(i, name KubeCertificateName, template x509.Certificate) {
+	makeCert := func(i, name KubeCertificateName, template x509.Certificate) {
 		pki.Certificates[name] = &opki.Certificate{
 			Namespace: &pki.namespace,
 			Issuer:    pki.Certificates[i],
@@ -126,7 +126,7 @@
 		Template:  opki.CA("Metropolis Kubernetes ID CA"),
 		Mode:      opki.CertificateManaged,
 	}
-	make(IdCA, APIServer, opki.Server(
+	makeCert(IdCA, APIServer, opki.Server(
 		[]string{
 			"kubernetes",
 			"kubernetes.default",
@@ -141,12 +141,12 @@
 		// TODO(q3k): add service network internal apiserver address
 		[]net.IP{{10, 224, 0, 1}, {127, 0, 0, 1}},
 	))
-	make(IdCA, APIServerKubeletClient, opki.Client("metropolis:apiserver-kubelet-client", nil))
-	make(IdCA, ControllerManagerClient, opki.Client("system:kube-controller-manager", nil))
-	make(IdCA, ControllerManager, opki.Server([]string{"kube-controller-manager.local"}, nil))
-	make(IdCA, SchedulerClient, opki.Client("system:kube-scheduler", nil))
-	make(IdCA, Scheduler, opki.Server([]string{"kube-scheduler.local"}, nil))
-	make(IdCA, Master, opki.Client("metropolis:master", []string{"system:masters"}))
+	makeCert(IdCA, APIServerKubeletClient, opki.Client("metropolis:apiserver-kubelet-client", nil))
+	makeCert(IdCA, ControllerManagerClient, opki.Client("system:kube-controller-manager", nil))
+	makeCert(IdCA, ControllerManager, opki.Server([]string{"kube-controller-manager.local"}, nil))
+	makeCert(IdCA, SchedulerClient, opki.Client("system:kube-scheduler", nil))
+	makeCert(IdCA, Scheduler, opki.Server([]string{"kube-scheduler.local"}, nil))
+	makeCert(IdCA, Master, opki.Client("metropolis:master", []string{"system:masters"}))
 
 	pki.Certificates[AggregationCA] = &opki.Certificate{
 		Namespace: &pki.namespace,
@@ -155,8 +155,8 @@
 		Template:  opki.CA("Metropolis OpenAPI Aggregation CA"),
 		Mode:      opki.CertificateManaged,
 	}
-	make(AggregationCA, FrontProxyClient, opki.Client("front-proxy-client", nil))
-	make(AggregationCA, MetropolisAuthProxyClient, opki.Client("metropolis-auth-proxy-client", nil))
+	makeCert(AggregationCA, FrontProxyClient, opki.Client("front-proxy-client", nil))
+	makeCert(AggregationCA, MetropolisAuthProxyClient, opki.Client("metropolis-auth-proxy-client", nil))
 
 	return &pki
 }
diff --git a/metropolis/pkg/smbios/smbios.go b/metropolis/pkg/smbios/smbios.go
index 0080278..e9bcfc3 100644
--- a/metropolis/pkg/smbios/smbios.go
+++ b/metropolis/pkg/smbios/smbios.go
@@ -194,9 +194,9 @@
 	hasAborted := false
 	for i := 2; i < numFields; i++ {
 		fieldType := v.Type().Field(i)
-		if min := fieldType.Tag.Get("smbios_min_ver"); min != "" {
+		if minVer := fieldType.Tag.Get("smbios_min_ver"); minVer != "" {
 			var ver Version
-			if _, err := fmt.Sscanf(min, "%d.%d", &ver.Major, &ver.Minor); err != nil {
+			if _, err := fmt.Sscanf(minVer, "%d.%d", &ver.Major, &ver.Minor); err != nil {
 				panic(fmt.Sprintf("invalid smbios_min_ver tag in %v: %v", fieldType.Name, err))
 			}
 			completedVersion = parsingVersion