diff --git a/cloud/shepherd/manager/control_loop.go b/cloud/shepherd/manager/control_loop.go
index 7a05658..3e5c832 100644
--- a/cloud/shepherd/manager/control_loop.go
+++ b/cloud/shepherd/manager/control_loop.go
@@ -122,7 +122,7 @@
 func (r *controlLoopRunner) run(ctx context.Context, conn *bmdb.Connection) error {
 	pinfo := r.loop.getProcessInfo()
 
-	eg := errgroup.Group{}
+	var eg errgroup.Group
 	for j := 0; j < r.config.Parallelism; j += 1 {
 		eg.Go(func() error {
 			return r.runOne(ctx, conn, &pinfo)
diff --git a/go/clitable/table_test.go b/go/clitable/table_test.go
index 5fca84c..447d83d 100644
--- a/go/clitable/table_test.go
+++ b/go/clitable/table_test.go
@@ -8,9 +8,9 @@
 
 // TestTableLayout performs a smoke test of the table layout functionality.
 func TestTableLayout(t *testing.T) {
-	tab := Table{}
+	var tab Table
 
-	e := Entry{}
+	var e Entry
 	e.Add("id", "short")
 	e.Add("labels", "")
 	tab.Add(e)
diff --git a/go/net/tinylb/tinylb_test.go b/go/net/tinylb/tinylb_test.go
index acf2dda..322be69 100644
--- a/go/net/tinylb/tinylb_test.go
+++ b/go/net/tinylb/tinylb_test.go
@@ -15,7 +15,7 @@
 
 func TestLoadbalancer(t *testing.T) {
 	v := memory.Value[BackendSet]{}
-	set := BackendSet{}
+	var set BackendSet
 	v.Set(set.Clone())
 
 	ln, err := net.Listen("tcp", ":0")
@@ -163,7 +163,7 @@
 
 func BenchmarkLB(b *testing.B) {
 	v := memory.Value[BackendSet]{}
-	set := BackendSet{}
+	var set BackendSet
 	v.Set(set.Clone())
 
 	ln, err := net.Listen("tcp", ":0")
diff --git a/metropolis/cli/metroctl/table_node.go b/metropolis/cli/metroctl/table_node.go
index 4af9f2c..37dbb48 100644
--- a/metropolis/cli/metroctl/table_node.go
+++ b/metropolis/cli/metroctl/table_node.go
@@ -13,7 +13,7 @@
 )
 
 func nodeEntry(n *apb.Node) clitable.Entry {
-	res := clitable.Entry{}
+	var res clitable.Entry
 
 	res.Add("node id", identity.NodeID(n.Pubkey))
 	state := n.State.String()
diff --git a/metropolis/node/core/cluster/cluster_bootstrap.go b/metropolis/node/core/cluster/cluster_bootstrap.go
index 774359e..f328815 100644
--- a/metropolis/node/core/cluster/cluster_bootstrap.go
+++ b/metropolis/node/core/cluster/cluster_bootstrap.go
@@ -65,7 +65,7 @@
 	supervisor.Logger(ctx).Infof("Storage Security: cluster policy: %s, node: %s", cc.StorageSecurityPolicy, storageSecurity)
 
 	ownerKey := bootstrap.OwnerPublicKey
-	configuration := ppb.SealedConfiguration{}
+	var configuration ppb.SealedConfiguration
 
 	// Mount new storage with generated CUK, and save NUK into sealed config proto.
 	supervisor.Logger(ctx).Infof("Bootstrapping: mounting new storage...")
diff --git a/metropolis/node/core/consensus/logparser.go b/metropolis/node/core/consensus/logparser.go
index c54968c..dbd3b1d 100644
--- a/metropolis/node/core/consensus/logparser.go
+++ b/metropolis/node/core/consensus/logparser.go
@@ -36,7 +36,7 @@
 		return
 	}
 
-	e := etcdLogEntry{}
+	var e etcdLogEntry
 	// Parse constant fields
 	if err := json.Unmarshal([]byte(l.Data), &e); err != nil {
 		write(&logtree.ExternalLeveledPayload{
diff --git a/metropolis/node/core/consensus/testhelpers.go b/metropolis/node/core/consensus/testhelpers.go
index 8b0b213..3522e06 100644
--- a/metropolis/node/core/consensus/testhelpers.go
+++ b/metropolis/node/core/consensus/testhelpers.go
@@ -25,7 +25,7 @@
 func TestServiceHandle(t *testing.T, cl *clientv3.Client) ServiceHandle {
 	ca := pkiCA()
 
-	tsh := testServiceHandle{}
+	var tsh testServiceHandle
 	st := &Status{
 		cl:                        cl,
 		ca:                        ca,
diff --git a/metropolis/node/core/curator/state_cluster.go b/metropolis/node/core/curator/state_cluster.go
index 2ef7349..6cb0a3a 100644
--- a/metropolis/node/core/curator/state_cluster.go
+++ b/metropolis/node/core/curator/state_cluster.go
@@ -133,7 +133,7 @@
 }
 
 func clusterUnmarshal(data []byte) (*Cluster, error) {
-	msg := cpb.ClusterConfiguration{}
+	var msg cpb.ClusterConfiguration
 	if err := proto.Unmarshal(data, &msg); err != nil {
 		return nil, fmt.Errorf("could not unmarshal proto: %w", err)
 	}
diff --git a/metropolis/node/core/curator/state_node.go b/metropolis/node/core/curator/state_node.go
index 0c2f53b..a0d9dc3 100644
--- a/metropolis/node/core/curator/state_node.go
+++ b/metropolis/node/core/curator/state_node.go
@@ -285,7 +285,7 @@
 }
 
 func nodeUnmarshal(data []byte) (*Node, error) {
-	msg := ppb.Node{}
+	var msg ppb.Node
 	if err := proto.Unmarshal(data, &msg); err != nil {
 		return nil, fmt.Errorf("could not unmarshal proto: %w", err)
 	}
diff --git a/metropolis/node/core/localstorage/storage_esp.go b/metropolis/node/core/localstorage/storage_esp.go
index 8991359..945e6ca 100644
--- a/metropolis/node/core/localstorage/storage_esp.go
+++ b/metropolis/node/core/localstorage/storage_esp.go
@@ -115,7 +115,7 @@
 		return nil, fmt.Errorf("%w: when reading sealed data: %v", ErrNoParameters, err)
 	}
 
-	config := apb.NodeParameters{}
+	var config apb.NodeParameters
 	err = proto.Unmarshal(bytes, &config)
 	if err != nil {
 		return nil, fmt.Errorf("%w: when unmarshaling: %v", ErrParametersCorrupted, err)
@@ -133,7 +133,7 @@
 		return nil, fmt.Errorf("%w: when reading: %v", ErrNoDirectory, err)
 	}
 
-	dir := cpb.ClusterDirectory{}
+	var dir cpb.ClusterDirectory
 	err = proto.Unmarshal(bytes, &dir)
 	if err != nil {
 		return nil, fmt.Errorf("%w: when unmarshaling: %v", ErrDirectoryCorrupted, err)
@@ -150,7 +150,7 @@
 		return nil, fmt.Errorf("%w: when reading: %v", ErrNetworkConfigCorrupted, err)
 	}
 
-	netConf := npb.Net{}
+	var netConf npb.Net
 	err = proto.Unmarshal(bytes, &netConf)
 	if err != nil {
 		return nil, fmt.Errorf("%w: when unmarshaling: %v", ErrNetworkConfigCorrupted, err)
@@ -219,7 +219,7 @@
 		return nil, fmt.Errorf("unknown tpmUsage %d", tpmUsage)
 	}
 
-	config := ppb.SealedConfiguration{}
+	var config ppb.SealedConfiguration
 	err = proto.Unmarshal(bytes, &config)
 	if err != nil {
 		return nil, fmt.Errorf("%w: when unmarshaling: %v", ErrSealedCorrupted, err)
diff --git a/metropolis/node/core/localstorage/storage_test.go b/metropolis/node/core/localstorage/storage_test.go
index 35171bd..b90d7a7 100644
--- a/metropolis/node/core/localstorage/storage_test.go
+++ b/metropolis/node/core/localstorage/storage_test.go
@@ -23,14 +23,14 @@
 )
 
 func TestValidateAll(t *testing.T) {
-	r := Root{}
+	var r Root
 	if err := declarative.Validate(&r); err != nil {
 		t.Errorf("Validation failed: %v", err)
 	}
 }
 
 func TestPlaceFS(t *testing.T) {
-	rr := Root{}
+	var rr Root
 	err := declarative.PlaceFS(&rr, "")
 	if err != nil {
 		t.Errorf("Placement failed: %v", err)
diff --git a/metropolis/node/core/network/dhcp4c/dhcpc_test.go b/metropolis/node/core/network/dhcp4c/dhcpc_test.go
index 7914b31..ca3994a 100644
--- a/metropolis/node/core/network/dhcp4c/dhcpc_test.go
+++ b/metropolis/node/core/network/dhcp4c/dhcpc_test.go
@@ -175,7 +175,7 @@
 // TestAcceptableLease tests if a minimal valid lease is accepted by
 // acceptableLease
 func TestAcceptableLease(t *testing.T) {
-	c := Client{}
+	var c Client
 	offer := &dhcpv4.DHCPv4{
 		OpCode: dhcpv4.OpcodeBootReply,
 	}
diff --git a/metropolis/node/core/network/dns/coredns.go b/metropolis/node/core/network/dns/coredns.go
index c539f44..af4562b 100644
--- a/metropolis/node/core/network/dns/coredns.go
+++ b/metropolis/node/core/network/dns/coredns.go
@@ -72,7 +72,7 @@
 }
 
 func (s *Service) makeCorefile(fargs *fileargs.FileArgs) []byte {
-	corefile := bytes.Buffer{}
+	var corefile bytes.Buffer
 	corefile.WriteString(corefileBase)
 	bindIPs := []string{"127.0.0.1", "::1"}
 	for _, ip := range s.ExtraListenerIPs {
diff --git a/metropolis/node/core/network/dns/directives.go b/metropolis/node/core/network/dns/directives.go
index 57b06e1..10199fe 100644
--- a/metropolis/node/core/network/dns/directives.go
+++ b/metropolis/node/core/network/dns/directives.go
@@ -40,7 +40,7 @@
 // NewUpstreamDirective creates a forward with no fallthrough that forwards all
 // requests not yet matched to the given upstream DNS servers.
 func NewUpstreamDirective(dnsServers []net.IP) *ExtraDirective {
-	strb := strings.Builder{}
+	var strb strings.Builder
 	if len(dnsServers) > 0 {
 		strb.WriteString("forward .")
 		for _, ip := range dnsServers {
diff --git a/metropolis/node/core/nodeparams.go b/metropolis/node/core/nodeparams.go
index 993dd64..cb365d5 100644
--- a/metropolis/node/core/nodeparams.go
+++ b/metropolis/node/core/nodeparams.go
@@ -13,9 +13,10 @@
 	"github.com/cenkalti/backoff/v4"
 	"google.golang.org/protobuf/proto"
 
+	apb "source.monogon.dev/metropolis/proto/api"
+
 	"source.monogon.dev/metropolis/node/core/localstorage"
 	"source.monogon.dev/metropolis/pkg/supervisor"
-	apb "source.monogon.dev/metropolis/proto/api"
 )
 
 func nodeParamsFWCFG(ctx context.Context) (*apb.NodeParameters, error) {
@@ -24,7 +25,7 @@
 		return nil, fmt.Errorf("could not read firmware enrolment file: %w", err)
 	}
 
-	config := apb.NodeParameters{}
+	var config apb.NodeParameters
 	err = proto.Unmarshal(bytes, &config)
 	if err != nil {
 		return nil, fmt.Errorf("could not unmarshal: %v", err)
@@ -58,7 +59,7 @@
 	if err != nil {
 		return nil, fmt.Errorf("cannot decode base64: %w", err)
 	}
-	config := apb.NodeParameters{}
+	var config apb.NodeParameters
 	err = proto.Unmarshal(decoded, &config)
 	if err != nil {
 		return nil, fmt.Errorf("failed unmarshalling NodeParameters: %w", err)
diff --git a/metropolis/node/kubernetes/reconciler/reconciler_status.go b/metropolis/node/kubernetes/reconciler/reconciler_status.go
index f3ad06b..4abf6f8 100644
--- a/metropolis/node/kubernetes/reconciler/reconciler_status.go
+++ b/metropolis/node/kubernetes/reconciler/reconciler_status.go
@@ -194,7 +194,7 @@
 		if len(kv.Value) == 0 {
 			return
 		}
-		node := ppb.Node{}
+		var node ppb.Node
 		if err := proto.Unmarshal(kv.Value, &node); err != nil {
 			supervisor.Logger(ctx).Errorf("Failed to unmarshal node %q: %w", nodeKey, err)
 			return
diff --git a/metropolis/pkg/event/etcd/etcd_test.go b/metropolis/pkg/event/etcd/etcd_test.go
index c6d50b1..bd96363 100644
--- a/metropolis/pkg/event/etcd/etcd_test.go
+++ b/metropolis/pkg/event/etcd/etcd_test.go
@@ -63,7 +63,7 @@
 // it starts the watcher. This is used to test potential race conditions
 // present between these two steps.
 func setRaceWg[T any](w event.Watcher[T]) *sync.WaitGroup {
-	wg := sync.WaitGroup{}
+	var wg sync.WaitGroup
 	w.(*watcher[T]).testRaceWG = &wg
 	return &wg
 }
@@ -72,7 +72,7 @@
 // thie WG after an etcd watch channel is created. This is used in tests to
 // ensure that the watcher is fully created before it is tested.
 func setSetupWg[T any](w event.Watcher[T]) *sync.WaitGroup {
-	wg := sync.WaitGroup{}
+	var wg sync.WaitGroup
 	w.(*watcher[T]).testSetupWG = &wg
 	return &wg
 }
diff --git a/metropolis/pkg/event/memory/example_test.go b/metropolis/pkg/event/memory/example_test.go
index 583650c..1ae12c6 100644
--- a/metropolis/pkg/event/memory/example_test.go
+++ b/metropolis/pkg/event/memory/example_test.go
@@ -82,7 +82,7 @@
 	defer ctxC()
 
 	// Create a fake NetworkService.
-	ns := NetworkService{}
+	var ns NetworkService
 
 	// Run an /etc/hosts updater. It will watch for updates from the NetworkService
 	// about the current IP address of the node.
diff --git a/metropolis/pkg/event/memory/memory_test.go b/metropolis/pkg/event/memory/memory_test.go
index 80ac575..eec0a37 100644
--- a/metropolis/pkg/event/memory/memory_test.go
+++ b/metropolis/pkg/event/memory/memory_test.go
@@ -71,7 +71,7 @@
 		Sync: true,
 	}
 	values := make(chan int, 100)
-	wg := sync.WaitGroup{}
+	var wg sync.WaitGroup
 	wg.Add(1)
 	go func() {
 		ctx := context.Background()
diff --git a/metropolis/pkg/tpm/eventlog/eventlog.go b/metropolis/pkg/tpm/eventlog/eventlog.go
index 036185a..dbfeae0 100644
--- a/metropolis/pkg/tpm/eventlog/eventlog.go
+++ b/metropolis/pkg/tpm/eventlog/eventlog.go
@@ -489,8 +489,8 @@
 	// TODO(ericchiang): Check errata? Or do we expect that to change in ways
 	// we're okay with?
 
-	specAlg := specAlgSize{}
-	e := specIDEvent{}
+	var specAlg specAlgSize
+	var e specIDEvent
 	for i := 0; i < int(header.NumAlgs); i++ {
 		if err := binary.Read(r, binary.LittleEndian, &specAlg); err != nil {
 			return nil, fmt.Errorf("reading algorithm: %v", err)
diff --git a/metropolis/pkg/tpm/eventlog/internal/events.go b/metropolis/pkg/tpm/eventlog/internal/events.go
index 3a719ab..eb121b2 100644
--- a/metropolis/pkg/tpm/eventlog/internal/events.go
+++ b/metropolis/pkg/tpm/eventlog/internal/events.go
@@ -275,7 +275,7 @@
 		// Being passed an empty signature list here appears to be valid
 		return nil, nil, nil
 	}
-	signatures := efiSignatureList{}
+	var signatures efiSignatureList
 	buf := bytes.NewReader(b)
 	var certificates []x509.Certificate
 	var hashes [][]byte
@@ -297,7 +297,7 @@
 		switch signatureType {
 		case certX509SigGUID: // X509 certificate
 			for sigOffset := 0; uint32(sigOffset) < signatures.Header.SignatureListSize-28; {
-				signature := efiSignatureData{}
+				var signature efiSignatureData
 				signature.SignatureData = make([]byte, signatures.Header.SignatureSize-16)
 				err := binary.Read(buf, binary.LittleEndian, &signature.SignatureOwner)
 				if err != nil {
@@ -316,7 +316,7 @@
 			}
 		case hashSHA256SigGUID: // SHA256
 			for sigOffset := 0; uint32(sigOffset) < signatures.Header.SignatureListSize-28; {
-				signature := efiSignatureData{}
+				var signature efiSignatureData
 				signature.SignatureData = make([]byte, signatures.Header.SignatureSize-16)
 				err := binary.Read(buf, binary.LittleEndian, &signature.SignatureOwner)
 				if err != nil {
@@ -375,7 +375,7 @@
 	}
 
 	buf := bytes.NewReader(b)
-	signature := EFISignatureData{}
+	var signature EFISignatureData
 	signature.SignatureData = make([]byte, len(b)-16)
 
 	if err := binary.Read(buf, binary.LittleEndian, &signature.SignatureOwner); err != nil {
diff --git a/third_party/go/patches/gvisor-fix-debug-builds.patch b/third_party/go/patches/gvisor-fix-debug-builds.patch
index ea5b04d..ceafb5c 100644
--- a/third_party/go/patches/gvisor-fix-debug-builds.patch
+++ b/third_party/go/patches/gvisor-fix-debug-builds.patch
@@ -407,7 +407,7 @@
 +			// interrupted KVM. Since we're in a signal handler
 +			// currently, all signals are masked and the signal
 +			// must have been delivered directly to this thread.
-+			timeout := unix.Timespec{}
++			var timeout unix.Timespec
 +			sig, _, errno := unix.RawSyscall6( // escapes: no.
 +				unix.SYS_RT_SIGTIMEDWAIT,
 +				uintptr(unsafe.Pointer(&bounceSignalMask)),
diff --git a/third_party/sandboxroot/mirror/main.go b/third_party/sandboxroot/mirror/main.go
index 06479d3..a3256ee 100644
--- a/third_party/sandboxroot/mirror/main.go
+++ b/third_party/sandboxroot/mirror/main.go
@@ -28,7 +28,7 @@
 // ourMirrorURL returns a fully formed URL-string to our mirror (as defined by
 // flags), optionally appending the given parts as file path parts.
 func ourMirrorURL(parts ...string) string {
-	u := url.URL{}
+	var u url.URL
 	u.Scheme = "https"
 	u.Host = "storage.googleapis.com"