diff --git a/metropolis/cli/metroctl/cmd_certs.go b/metropolis/cli/metroctl/cmd_certs.go
index 075a0d0..d914c83 100644
--- a/metropolis/cli/metroctl/cmd_certs.go
+++ b/metropolis/cli/metroctl/cmd_certs.go
@@ -29,7 +29,7 @@
 	Example: "metroctl cert export",
 	Run: func(cmd *cobra.Command, args []string) {
 		ocert, opkey, err := core.GetOwnerCredentials(flags.configPath)
-		if errors.Is(err, core.NoCredentialsError) {
+		if errors.Is(err, core.ErrNoCredentials) {
 			log.Fatalf("You have to take ownership of the cluster first: %v", err)
 		}
 
diff --git a/metropolis/cli/metroctl/cmd_k8scredplugin.go b/metropolis/cli/metroctl/cmd_k8scredplugin.go
index adc3fe8..0d1f318 100644
--- a/metropolis/cli/metroctl/cmd_k8scredplugin.go
+++ b/metropolis/cli/metroctl/cmd_k8scredplugin.go
@@ -28,7 +28,7 @@
 
 func doK8sCredPlugin(cmd *cobra.Command, args []string) {
 	cert, key, err := core.GetOwnerCredentials(flags.configPath)
-	if errors.Is(err, core.NoCredentialsError) {
+	if errors.Is(err, core.ErrNoCredentials) {
 		log.Fatal("No credentials found on your machine")
 	}
 	if err != nil {
diff --git a/metropolis/cli/metroctl/cmd_takeownership.go b/metropolis/cli/metroctl/cmd_takeownership.go
index adad3cf..5161dc9 100644
--- a/metropolis/cli/metroctl/cmd_takeownership.go
+++ b/metropolis/cli/metroctl/cmd_takeownership.go
@@ -47,7 +47,7 @@
 	// Retrieve the cluster owner's private key, and use it to construct
 	// ephemeral credentials. Then, dial the cluster.
 	opk, err := core.GetOwnerKey(flags.configPath)
-	if errors.Is(err, core.NoCredentialsError) {
+	if errors.Is(err, core.ErrNoCredentials) {
 		log.Fatalf("Owner key does not exist. takeownership needs to be executed on the same system that has previously installed the cluster using metroctl install.")
 	}
 	if err != nil {
diff --git a/metropolis/cli/metroctl/core/ca_tofu.go b/metropolis/cli/metroctl/core/ca_tofu.go
index 9df9957..b578aa6 100644
--- a/metropolis/cli/metroctl/core/ca_tofu.go
+++ b/metropolis/cli/metroctl/core/ca_tofu.go
@@ -114,7 +114,7 @@
 	if err == nil {
 		return ca, nil
 	}
-	if !errors.Is(err, NoCACertificateError) {
+	if !errors.Is(err, ErrNoCACertificate) {
 		return nil, err
 	}
 
@@ -128,7 +128,7 @@
 	// against it, and don't ask the user.
 	var ocert *x509.Certificate
 	if err != nil {
-		if errors.Is(err, NoCredentialsError) {
+		if errors.Is(err, ErrNoCredentials) {
 			okey, err := GetOwnerKey(c.ConfigPath)
 			if err != nil {
 				return nil, err
diff --git a/metropolis/cli/metroctl/core/config.go b/metropolis/cli/metroctl/core/config.go
index f3ca8b3..d119883 100644
--- a/metropolis/cli/metroctl/core/config.go
+++ b/metropolis/cli/metroctl/core/config.go
@@ -35,11 +35,13 @@
 	CACertificateFileName = "ca.pem"
 )
 
-// NoCredentialsError indicates that the requested datum (eg. owner key or owner
-// certificate) is not present in the requested directory.
-var NoCredentialsError = errors.New("owner certificate or key does not exist")
+var (
+	// ErrNoCredentials indicates that the requested datum (eg. owner key or owner
+	// certificate) is not present in the requested directory.
+	ErrNoCredentials = errors.New("owner certificate or key does not exist")
 
-var NoCACertificateError = errors.New("no cluster CA certificate while secure connection was requested")
+	ErrNoCACertificate = errors.New("no cluster CA certificate while secure connection was requested")
+)
 
 // A PEM block type for a Metropolis initial owner private key
 const ownerKeyType = "METROPOLIS INITIAL OWNER PRIVATE KEY"
@@ -51,7 +53,7 @@
 	switch {
 	case err == nil:
 		return existing, nil
-	case errors.Is(err, NoCredentialsError):
+	case errors.Is(err, ErrNoCredentials):
 	default:
 		return nil, err
 	}
@@ -88,11 +90,11 @@
 
 // GetOwnerKey loads and returns a raw ED25519 private key from the saved owner
 // key in a given metroctl configuration directory path. If the owner key doesn't
-// exist, NoCredentialsError will be returned.
+// exist, ErrNoCredentials will be returned.
 func GetOwnerKey(path string) (ed25519.PrivateKey, error) {
 	ownerPrivateKeyPEM, err := os.ReadFile(filepath.Join(path, OwnerKeyFileName))
 	if os.IsNotExist(err) {
-		return nil, NoCredentialsError
+		return nil, ErrNoCredentials
 	} else if err != nil {
 		return nil, fmt.Errorf("failed to load owner private key: %w", err)
 	}
@@ -125,7 +127,7 @@
 // GetOwnerCredentials loads and returns a raw ED25519 private key alongside a
 // DER-encoded X509 certificate from the saved owner key and certificate in a
 // given metroctl configuration directory path. If either the key or certificate
-// doesn't exist, NoCredentialsError will be returned.
+// doesn't exist, ErrNoCredentials will be returned.
 func GetOwnerCredentials(path string) (cert *x509.Certificate, key ed25519.PrivateKey, err error) {
 	key, err = GetOwnerKey(path)
 	if err != nil {
@@ -134,7 +136,7 @@
 
 	ownerCertPEM, err := os.ReadFile(filepath.Join(path, OwnerCertificateFileName))
 	if os.IsNotExist(err) {
-		return nil, nil, NoCredentialsError
+		return nil, nil, ErrNoCredentials
 	} else if err != nil {
 		return nil, nil, fmt.Errorf("failed to load owner certificate: %w", err)
 	}
@@ -171,7 +173,7 @@
 func GetClusterCA(path string) (cert *x509.Certificate, err error) {
 	caCertPEM, err := os.ReadFile(filepath.Join(path, CACertificateFileName))
 	if os.IsNotExist(err) {
-		return nil, NoCACertificateError
+		return nil, ErrNoCACertificate
 	} else if err != nil {
 		return nil, fmt.Errorf("failed to load CA certificate: %w", err)
 	}
diff --git a/metropolis/cli/metroctl/rpc.go b/metropolis/cli/metroctl/rpc.go
index 06008e3..cab6d4f 100644
--- a/metropolis/cli/metroctl/rpc.go
+++ b/metropolis/cli/metroctl/rpc.go
@@ -18,7 +18,7 @@
 	// Collect credentials, validate command parameters, and try dialing the
 	// cluster.
 	ocert, opkey, err := core.GetOwnerCredentials(flags.configPath)
-	if errors.Is(err, core.NoCredentialsError) {
+	if errors.Is(err, core.ErrNoCredentials) {
 		log.Fatalf("You have to take ownership of the cluster first: %v", err)
 	}
 	if len(flags.clusterEndpoints) == 0 {
@@ -52,7 +52,7 @@
 	// Collect credentials, validate command parameters, and try dialing the
 	// cluster.
 	ocert, opkey, err := core.GetOwnerCredentials(flags.configPath)
-	if errors.Is(err, core.NoCredentialsError) {
+	if errors.Is(err, core.ErrNoCredentials) {
 		log.Fatalf("You have to take ownership of the cluster first: %v", err)
 	}
 	cc, err := core.DialNode(ctx, opkey, ocert, cacert, flags.proxyAddr, id, address)