diff --git a/metropolis/node/core/cluster/cluster_bootstrap.go b/metropolis/node/core/cluster/cluster_bootstrap.go
index 774359e..f328815 100644
--- a/metropolis/node/core/cluster/cluster_bootstrap.go
+++ b/metropolis/node/core/cluster/cluster_bootstrap.go
@@ -65,7 +65,7 @@
 	supervisor.Logger(ctx).Infof("Storage Security: cluster policy: %s, node: %s", cc.StorageSecurityPolicy, storageSecurity)
 
 	ownerKey := bootstrap.OwnerPublicKey
-	configuration := ppb.SealedConfiguration{}
+	var configuration ppb.SealedConfiguration
 
 	// Mount new storage with generated CUK, and save NUK into sealed config proto.
 	supervisor.Logger(ctx).Infof("Bootstrapping: mounting new storage...")
diff --git a/metropolis/node/core/consensus/logparser.go b/metropolis/node/core/consensus/logparser.go
index c54968c..dbd3b1d 100644
--- a/metropolis/node/core/consensus/logparser.go
+++ b/metropolis/node/core/consensus/logparser.go
@@ -36,7 +36,7 @@
 		return
 	}
 
-	e := etcdLogEntry{}
+	var e etcdLogEntry
 	// Parse constant fields
 	if err := json.Unmarshal([]byte(l.Data), &e); err != nil {
 		write(&logtree.ExternalLeveledPayload{
diff --git a/metropolis/node/core/consensus/testhelpers.go b/metropolis/node/core/consensus/testhelpers.go
index 8b0b213..3522e06 100644
--- a/metropolis/node/core/consensus/testhelpers.go
+++ b/metropolis/node/core/consensus/testhelpers.go
@@ -25,7 +25,7 @@
 func TestServiceHandle(t *testing.T, cl *clientv3.Client) ServiceHandle {
 	ca := pkiCA()
 
-	tsh := testServiceHandle{}
+	var tsh testServiceHandle
 	st := &Status{
 		cl:                        cl,
 		ca:                        ca,
diff --git a/metropolis/node/core/curator/state_cluster.go b/metropolis/node/core/curator/state_cluster.go
index 2ef7349..6cb0a3a 100644
--- a/metropolis/node/core/curator/state_cluster.go
+++ b/metropolis/node/core/curator/state_cluster.go
@@ -133,7 +133,7 @@
 }
 
 func clusterUnmarshal(data []byte) (*Cluster, error) {
-	msg := cpb.ClusterConfiguration{}
+	var msg cpb.ClusterConfiguration
 	if err := proto.Unmarshal(data, &msg); err != nil {
 		return nil, fmt.Errorf("could not unmarshal proto: %w", err)
 	}
diff --git a/metropolis/node/core/curator/state_node.go b/metropolis/node/core/curator/state_node.go
index 0c2f53b..a0d9dc3 100644
--- a/metropolis/node/core/curator/state_node.go
+++ b/metropolis/node/core/curator/state_node.go
@@ -285,7 +285,7 @@
 }
 
 func nodeUnmarshal(data []byte) (*Node, error) {
-	msg := ppb.Node{}
+	var msg ppb.Node
 	if err := proto.Unmarshal(data, &msg); err != nil {
 		return nil, fmt.Errorf("could not unmarshal proto: %w", err)
 	}
diff --git a/metropolis/node/core/localstorage/storage_esp.go b/metropolis/node/core/localstorage/storage_esp.go
index 8991359..945e6ca 100644
--- a/metropolis/node/core/localstorage/storage_esp.go
+++ b/metropolis/node/core/localstorage/storage_esp.go
@@ -115,7 +115,7 @@
 		return nil, fmt.Errorf("%w: when reading sealed data: %v", ErrNoParameters, err)
 	}
 
-	config := apb.NodeParameters{}
+	var config apb.NodeParameters
 	err = proto.Unmarshal(bytes, &config)
 	if err != nil {
 		return nil, fmt.Errorf("%w: when unmarshaling: %v", ErrParametersCorrupted, err)
@@ -133,7 +133,7 @@
 		return nil, fmt.Errorf("%w: when reading: %v", ErrNoDirectory, err)
 	}
 
-	dir := cpb.ClusterDirectory{}
+	var dir cpb.ClusterDirectory
 	err = proto.Unmarshal(bytes, &dir)
 	if err != nil {
 		return nil, fmt.Errorf("%w: when unmarshaling: %v", ErrDirectoryCorrupted, err)
@@ -150,7 +150,7 @@
 		return nil, fmt.Errorf("%w: when reading: %v", ErrNetworkConfigCorrupted, err)
 	}
 
-	netConf := npb.Net{}
+	var netConf npb.Net
 	err = proto.Unmarshal(bytes, &netConf)
 	if err != nil {
 		return nil, fmt.Errorf("%w: when unmarshaling: %v", ErrNetworkConfigCorrupted, err)
@@ -219,7 +219,7 @@
 		return nil, fmt.Errorf("unknown tpmUsage %d", tpmUsage)
 	}
 
-	config := ppb.SealedConfiguration{}
+	var config ppb.SealedConfiguration
 	err = proto.Unmarshal(bytes, &config)
 	if err != nil {
 		return nil, fmt.Errorf("%w: when unmarshaling: %v", ErrSealedCorrupted, err)
diff --git a/metropolis/node/core/localstorage/storage_test.go b/metropolis/node/core/localstorage/storage_test.go
index 35171bd..b90d7a7 100644
--- a/metropolis/node/core/localstorage/storage_test.go
+++ b/metropolis/node/core/localstorage/storage_test.go
@@ -23,14 +23,14 @@
 )
 
 func TestValidateAll(t *testing.T) {
-	r := Root{}
+	var r Root
 	if err := declarative.Validate(&r); err != nil {
 		t.Errorf("Validation failed: %v", err)
 	}
 }
 
 func TestPlaceFS(t *testing.T) {
-	rr := Root{}
+	var rr Root
 	err := declarative.PlaceFS(&rr, "")
 	if err != nil {
 		t.Errorf("Placement failed: %v", err)
diff --git a/metropolis/node/core/network/dhcp4c/dhcpc_test.go b/metropolis/node/core/network/dhcp4c/dhcpc_test.go
index 7914b31..ca3994a 100644
--- a/metropolis/node/core/network/dhcp4c/dhcpc_test.go
+++ b/metropolis/node/core/network/dhcp4c/dhcpc_test.go
@@ -175,7 +175,7 @@
 // TestAcceptableLease tests if a minimal valid lease is accepted by
 // acceptableLease
 func TestAcceptableLease(t *testing.T) {
-	c := Client{}
+	var c Client
 	offer := &dhcpv4.DHCPv4{
 		OpCode: dhcpv4.OpcodeBootReply,
 	}
diff --git a/metropolis/node/core/network/dns/coredns.go b/metropolis/node/core/network/dns/coredns.go
index c539f44..af4562b 100644
--- a/metropolis/node/core/network/dns/coredns.go
+++ b/metropolis/node/core/network/dns/coredns.go
@@ -72,7 +72,7 @@
 }
 
 func (s *Service) makeCorefile(fargs *fileargs.FileArgs) []byte {
-	corefile := bytes.Buffer{}
+	var corefile bytes.Buffer
 	corefile.WriteString(corefileBase)
 	bindIPs := []string{"127.0.0.1", "::1"}
 	for _, ip := range s.ExtraListenerIPs {
diff --git a/metropolis/node/core/network/dns/directives.go b/metropolis/node/core/network/dns/directives.go
index 57b06e1..10199fe 100644
--- a/metropolis/node/core/network/dns/directives.go
+++ b/metropolis/node/core/network/dns/directives.go
@@ -40,7 +40,7 @@
 // NewUpstreamDirective creates a forward with no fallthrough that forwards all
 // requests not yet matched to the given upstream DNS servers.
 func NewUpstreamDirective(dnsServers []net.IP) *ExtraDirective {
-	strb := strings.Builder{}
+	var strb strings.Builder
 	if len(dnsServers) > 0 {
 		strb.WriteString("forward .")
 		for _, ip := range dnsServers {
diff --git a/metropolis/node/core/nodeparams.go b/metropolis/node/core/nodeparams.go
index 993dd64..cb365d5 100644
--- a/metropolis/node/core/nodeparams.go
+++ b/metropolis/node/core/nodeparams.go
@@ -13,9 +13,10 @@
 	"github.com/cenkalti/backoff/v4"
 	"google.golang.org/protobuf/proto"
 
+	apb "source.monogon.dev/metropolis/proto/api"
+
 	"source.monogon.dev/metropolis/node/core/localstorage"
 	"source.monogon.dev/metropolis/pkg/supervisor"
-	apb "source.monogon.dev/metropolis/proto/api"
 )
 
 func nodeParamsFWCFG(ctx context.Context) (*apb.NodeParameters, error) {
@@ -24,7 +25,7 @@
 		return nil, fmt.Errorf("could not read firmware enrolment file: %w", err)
 	}
 
-	config := apb.NodeParameters{}
+	var config apb.NodeParameters
 	err = proto.Unmarshal(bytes, &config)
 	if err != nil {
 		return nil, fmt.Errorf("could not unmarshal: %v", err)
@@ -58,7 +59,7 @@
 	if err != nil {
 		return nil, fmt.Errorf("cannot decode base64: %w", err)
 	}
-	config := apb.NodeParameters{}
+	var config apb.NodeParameters
 	err = proto.Unmarshal(decoded, &config)
 	if err != nil {
 		return nil, fmt.Errorf("failed unmarshalling NodeParameters: %w", err)
diff --git a/metropolis/node/kubernetes/reconciler/reconciler_status.go b/metropolis/node/kubernetes/reconciler/reconciler_status.go
index f3ad06b..4abf6f8 100644
--- a/metropolis/node/kubernetes/reconciler/reconciler_status.go
+++ b/metropolis/node/kubernetes/reconciler/reconciler_status.go
@@ -194,7 +194,7 @@
 		if len(kv.Value) == 0 {
 			return
 		}
-		node := ppb.Node{}
+		var node ppb.Node
 		if err := proto.Unmarshal(kv.Value, &node); err != nil {
 			supervisor.Logger(ctx).Errorf("Failed to unmarshal node %q: %w", nodeKey, err)
 			return