diff --git a/metropolis/cli/metroctl/cmd_install_ssh.go b/metropolis/cli/metroctl/cmd_install_ssh.go
index 15ced4a..56bab4c 100644
--- a/metropolis/cli/metroctl/cmd_install_ssh.go
+++ b/metropolis/cli/metroctl/cmd_install_ssh.go
@@ -147,13 +147,13 @@
 	ctx, _ := signal.NotifyContext(context.Background(), os.Interrupt)
 	conn, err := cl.Dial(ctx, address, 5*time.Second)
 	if err != nil {
-		return fmt.Errorf("error while establishing ssh connection: %v", err)
+		return fmt.Errorf("error while establishing ssh connection: %w", err)
 	}
 
 	params := makeNodeParams()
 	rawParams, err := proto.Marshal(params)
 	if err != nil {
-		return fmt.Errorf("error while marshaling node params: %v", err)
+		return fmt.Errorf("error while marshaling node params: %w", err)
 	}
 
 	const takeoverTargetPath = "/root/takeover"
@@ -188,7 +188,7 @@
 		log.Printf("Agent stderr: %q", stderrStr)
 	}
 	if err != nil {
-		return fmt.Errorf("while starting the takeover executable: %v", err)
+		return fmt.Errorf("while starting the takeover executable: %w", err)
 	}
 
 	return nil
diff --git a/metropolis/cli/metroctl/cmd_node_metrics.go b/metropolis/cli/metroctl/cmd_node_metrics.go
index f94f020..f3bde46 100644
--- a/metropolis/cli/metroctl/cmd_node_metrics.go
+++ b/metropolis/cli/metroctl/cmd_node_metrics.go
@@ -68,7 +68,7 @@
 		}
 		res, err := client.Get(fmt.Sprintf("https://%s/metrics/%s", net.JoinHostPort(n.Status.ExternalAddress, common.MetricsPort.PortString()), args[1]))
 		if err != nil {
-			return fmt.Errorf("metrics HTTP request failed: %v", err)
+			return fmt.Errorf("metrics HTTP request failed: %w", err)
 		}
 		defer res.Body.Close()
 		_, err = io.Copy(os.Stdout, res.Body)
diff --git a/metropolis/installer/main.go b/metropolis/installer/main.go
index 0863808..16de51a 100644
--- a/metropolis/installer/main.go
+++ b/metropolis/installer/main.go
@@ -223,7 +223,7 @@
 	// Look for suitable block devices, given the minimum size.
 	blkDevs, err := findInstallableBlockDevices(espDev, minSize)
 	if err != nil {
-		return fmt.Errorf(err.Error())
+		return err
 	}
 	if len(blkDevs) == 0 {
 		return fmt.Errorf("couldn't find a suitable block device")
diff --git a/metropolis/node/core/clusternet/clusternet.go b/metropolis/node/core/clusternet/clusternet.go
index 1c3c7b3..96a500d 100644
--- a/metropolis/node/core/clusternet/clusternet.go
+++ b/metropolis/node/core/clusternet/clusternet.go
@@ -230,11 +230,11 @@
 
 		if shouldAdd {
 			if err := netlink.AddrAdd(loInterface, addr); err != nil {
-				return fmt.Errorf("assigning extra loopback IP: %v", err)
+				return fmt.Errorf("assigning extra loopback IP: %w", err)
 			}
 		} else {
 			if err := netlink.AddrDel(loInterface, addr); err != nil {
-				return fmt.Errorf("removing extra loopback IP: %v", err)
+				return fmt.Errorf("removing extra loopback IP: %w", err)
 			}
 		}
 	}
diff --git a/metropolis/node/core/consensus/client/client.go b/metropolis/node/core/consensus/client/client.go
index 70e27aa..449274a 100644
--- a/metropolis/node/core/consensus/client/client.go
+++ b/metropolis/node/core/consensus/client/client.go
@@ -133,5 +133,5 @@
 	if errL != nil && errW == nil {
 		return fmt.Errorf("closing lease: %w", errL)
 	}
-	return fmt.Errorf("closing watcher: %v, closing lease: %v", errW, errL)
+	return fmt.Errorf("closing watcher: %w, closing lease: %w", errW, errL)
 }
diff --git a/metropolis/node/core/localstorage/directory_pki.go b/metropolis/node/core/localstorage/directory_pki.go
index 8df1914..75c8a2b 100644
--- a/metropolis/node/core/localstorage/directory_pki.go
+++ b/metropolis/node/core/localstorage/directory_pki.go
@@ -41,7 +41,7 @@
 	for _, d := range []*declarative.File{&p.CACertificate, &p.Certificate, &p.Key} {
 		exists, err := d.Exists()
 		if err != nil {
-			return false, fmt.Errorf("failed to check %q: %v", d.FullPath(), err)
+			return false, fmt.Errorf("failed to check %q: %w", d.FullPath(), err)
 		}
 		if !exists {
 			return false, nil
@@ -56,7 +56,7 @@
 	for _, d := range []*declarative.File{&p.CACertificate, &p.Certificate, &p.Key} {
 		exists, err := d.Exists()
 		if err != nil {
-			return false, fmt.Errorf("failed to check %q: %v", d.FullPath(), err)
+			return false, fmt.Errorf("failed to check %q: %w", d.FullPath(), err)
 		}
 		if exists {
 			return false, nil
diff --git a/metropolis/node/core/localstorage/directory_root.go b/metropolis/node/core/localstorage/directory_root.go
index 98eede9..bfacb4e 100644
--- a/metropolis/node/core/localstorage/directory_root.go
+++ b/metropolis/node/core/localstorage/directory_root.go
@@ -51,7 +51,7 @@
 	}
 
 	if err := unix.Mount("tmpfs", r.Ephemeral.FullPath(), "tmpfs", unix.MS_NODEV, ""); err != nil {
-		return fmt.Errorf("mounting /ephemeral: %v", err)
+		return fmt.Errorf("mounting /ephemeral: %w", err)
 	}
 
 	if err := unix.Mount("tmpfs", r.Run.FullPath(), "tmpfs", unix.MS_NOEXEC|unix.MS_NODEV, ""); err != nil {
diff --git a/metropolis/node/core/localstorage/storage_esp.go b/metropolis/node/core/localstorage/storage_esp.go
index fd6913a..6404725 100644
--- a/metropolis/node/core/localstorage/storage_esp.go
+++ b/metropolis/node/core/localstorage/storage_esp.go
@@ -112,13 +112,13 @@
 		if os.IsNotExist(err) {
 			return nil, ErrNoParameters
 		}
-		return nil, fmt.Errorf("%w: when reading sealed data: %v", ErrNoParameters, err)
+		return nil, fmt.Errorf("%w: when reading sealed data: %w", ErrNoParameters, err)
 	}
 
 	var config apb.NodeParameters
 	err = proto.Unmarshal(bytes, &config)
 	if err != nil {
-		return nil, fmt.Errorf("%w: when unmarshaling: %v", ErrParametersCorrupted, err)
+		return nil, fmt.Errorf("%w: when unmarshaling: %w", ErrParametersCorrupted, err)
 	}
 
 	return &config, nil
@@ -130,13 +130,13 @@
 		if os.IsNotExist(err) {
 			return nil, ErrNoDirectory
 		}
-		return nil, fmt.Errorf("%w: when reading: %v", ErrNoDirectory, err)
+		return nil, fmt.Errorf("%w: when reading: %w", ErrNoDirectory, err)
 	}
 
 	var dir cpb.ClusterDirectory
 	err = proto.Unmarshal(bytes, &dir)
 	if err != nil {
-		return nil, fmt.Errorf("%w: when unmarshaling: %v", ErrDirectoryCorrupted, err)
+		return nil, fmt.Errorf("%w: when unmarshaling: %w", ErrDirectoryCorrupted, err)
 	}
 	return &dir, nil
 }
@@ -147,13 +147,13 @@
 		if os.IsNotExist(err) {
 			return nil, nil
 		}
-		return nil, fmt.Errorf("%w: when reading: %v", ErrNetworkConfigCorrupted, err)
+		return nil, fmt.Errorf("%w: when reading: %w", ErrNetworkConfigCorrupted, err)
 	}
 
 	var netConf npb.Net
 	err = proto.Unmarshal(bytes, &netConf)
 	if err != nil {
-		return nil, fmt.Errorf("%w: when unmarshaling: %v", ErrNetworkConfigCorrupted, err)
+		return nil, fmt.Errorf("%w: when unmarshaling: %w", ErrNetworkConfigCorrupted, err)
 	}
 	return &netConf, nil
 }
@@ -204,14 +204,14 @@
 		if os.IsNotExist(err) {
 			return nil, ErrNoSealed
 		}
-		return nil, fmt.Errorf("%w: when reading sealed data: %v", ErrSealedUnavailable, err)
+		return nil, fmt.Errorf("%w: when reading sealed data: %w", ErrSealedUnavailable, err)
 	}
 
 	switch tpmUsage {
 	case cpb.NodeTPMUsage_NODE_TPM_PRESENT_AND_USED:
 		bytes, err = tpm.Unseal(bytes)
 		if err != nil {
-			return nil, fmt.Errorf("%w: when unsealing: %v", ErrSealedCorrupted, err)
+			return nil, fmt.Errorf("%w: when unsealing: %w", ErrSealedCorrupted, err)
 		}
 	case cpb.NodeTPMUsage_NODE_TPM_PRESENT_BUT_UNUSED:
 	case cpb.NodeTPMUsage_NODE_TPM_NOT_PRESENT:
@@ -222,7 +222,7 @@
 	var config ppb.SealedConfiguration
 	err = proto.Unmarshal(bytes, &config)
 	if err != nil {
-		return nil, fmt.Errorf("%w: when unmarshaling: %v", ErrSealedCorrupted, err)
+		return nil, fmt.Errorf("%w: when unmarshaling: %w", ErrSealedCorrupted, err)
 	}
 
 	return &config, nil
diff --git a/metropolis/node/core/nodeparams.go b/metropolis/node/core/nodeparams.go
index 868d070..5aa6db8 100644
--- a/metropolis/node/core/nodeparams.go
+++ b/metropolis/node/core/nodeparams.go
@@ -28,7 +28,7 @@
 	var config apb.NodeParameters
 	err = proto.Unmarshal(bytes, &config)
 	if err != nil {
-		return nil, fmt.Errorf("could not unmarshal: %v", err)
+		return nil, fmt.Errorf("could not unmarshal: %w", err)
 	}
 
 	return &config, nil
diff --git a/metropolis/node/core/roleserve/worker_heartbeat.go b/metropolis/node/core/roleserve/worker_heartbeat.go
index b543334..ba5cecc 100644
--- a/metropolis/node/core/roleserve/worker_heartbeat.go
+++ b/metropolis/node/core/roleserve/worker_heartbeat.go
@@ -43,7 +43,7 @@
 
 	for {
 		if err := stream.Send(&ipb.HeartbeatUpdateRequest{}); err != nil {
-			return fmt.Errorf("while sending a heartbeat: %v", err)
+			return fmt.Errorf("while sending a heartbeat: %w", err)
 		}
 		next := time.Now().Add(curator.HeartbeatTimeout)
 
@@ -52,7 +52,7 @@
 			return fmt.Errorf("stream closed by the server, restarting worker... ")
 		}
 		if err != nil {
-			return fmt.Errorf("while receiving a heartbeat reply: %v", err)
+			return fmt.Errorf("while receiving a heartbeat reply: %w", err)
 		}
 
 		time.Sleep(time.Until(next))
diff --git a/metropolis/node/core/rpc/resolver/resolver.go b/metropolis/node/core/rpc/resolver/resolver.go
index 316c319..c06911b 100644
--- a/metropolis/node/core/rpc/resolver/resolver.go
+++ b/metropolis/node/core/rpc/resolver/resolver.go
@@ -222,7 +222,7 @@
 	cl, err := grpc.Dial(MetropolisControlAddress, opts...)
 	if err != nil {
 		// This generally shouldn't happen.
-		return fmt.Errorf("could not dial gRPC: %v", err)
+		return fmt.Errorf("could not dial gRPC: %w", err)
 	}
 	defer cl.Close()
 
diff --git a/metropolis/node/core/tconsole/tconsole.go b/metropolis/node/core/tconsole/tconsole.go
index bd4bd08..b83a261 100644
--- a/metropolis/node/core/tconsole/tconsole.go
+++ b/metropolis/node/core/tconsole/tconsole.go
@@ -51,7 +51,7 @@
 func New(terminal Terminal, ttyPath string, lt *logtree.LogTree, network event.Value[*network.Status], roles event.Value[*cpb.NodeRoles], curatorConn event.Value[*roleserve.CuratorConnection]) (*Console, error) {
 	reader, err := lt.Read("", logtree.WithChildren(), logtree.WithStream())
 	if err != nil {
-		return nil, fmt.Errorf("lt.Read: %v", err)
+		return nil, fmt.Errorf("lt.Read: %w", err)
 	}
 
 	tty, err := tcell.NewDevTtyFromDev(ttyPath)
diff --git a/metropolis/node/core/update/update.go b/metropolis/node/core/update/update.go
index 2e30d2a..51dc737 100644
--- a/metropolis/node/core/update/update.go
+++ b/metropolis/node/core/update/update.go
@@ -271,7 +271,7 @@
 		return s.tryDownloadBundle(ctx, bundleURL, &bundleRaw)
 	}, backoff.WithContext(b, ctx))
 	if err != nil {
-		return fmt.Errorf("error downloading Metropolis bundle: %v", err)
+		return fmt.Errorf("error downloading Metropolis bundle: %w", err)
 	}
 	bundle, err := zip.NewReader(bytes.NewReader(bundleRaw.Bytes()), int64(bundleRaw.Len()))
 	if err != nil {
@@ -541,12 +541,12 @@
 		if err == nil {
 			s.Logger.Infof("Restored missing EFI boot entry for Metropolis")
 		} else {
-			return fmt.Errorf("while restoring missing EFI boot entry for Metropolis: %v", err)
+			return fmt.Errorf("while restoring missing EFI boot entry for Metropolis: %w", err)
 		}
 	}
 	bootOrder, err := efivarfs.GetBootOrder()
 	if err != nil {
-		return fmt.Errorf("failed to get EFI boot order: %v", err)
+		return fmt.Errorf("failed to get EFI boot order: %w", err)
 	}
 	for _, bentry := range bootOrder {
 		if bentry == uint16(validBootEntryIdx) {
diff --git a/metropolis/node/kubernetes/containerd/main.go b/metropolis/node/kubernetes/containerd/main.go
index 6782137..bb7e140 100644
--- a/metropolis/node/kubernetes/containerd/main.go
+++ b/metropolis/node/kubernetes/containerd/main.go
@@ -83,7 +83,7 @@
 				// is not an issue for us.
 				time.Sleep(10 * time.Millisecond)
 			} else if err != nil {
-				return fmt.Errorf("log pump failed: %v", err)
+				return fmt.Errorf("log pump failed: %w", err)
 			}
 		}
 	}
diff --git a/metropolis/node/kubernetes/plugins/kvmdevice/kvmdevice.go b/metropolis/node/kubernetes/plugins/kvmdevice/kvmdevice.go
index 4d3f4a1..d29112f 100644
--- a/metropolis/node/kubernetes/plugins/kvmdevice/kvmdevice.go
+++ b/metropolis/node/kubernetes/plugins/kvmdevice/kvmdevice.go
@@ -138,7 +138,7 @@
 
 	l1tfStatus, err := os.ReadFile("/sys/devices/system/cpu/vulnerabilities/l1tf")
 	if err != nil && !os.IsNotExist(err) {
-		return fmt.Errorf("failed to query for CPU vulnerabilities: %v", err)
+		return fmt.Errorf("failed to query for CPU vulnerabilities: %w", err)
 	}
 
 	if bytes.Contains(l1tfStatus, []byte("vulnerable")) {
@@ -164,7 +164,7 @@
 
 	err = unix.Mknod("/dev/kvm", 0660, int(kvmDevNode))
 	if err != nil && !errors.Is(err, unix.EEXIST) {
-		return fmt.Errorf("failed to create KVM device node: %v", err)
+		return fmt.Errorf("failed to create KVM device node: %w", err)
 	}
 
 	// Try to remove socket if an unclean shutdown happened
diff --git a/metropolis/node/kubernetes/reconciler/reconciler_test.go b/metropolis/node/kubernetes/reconciler/reconciler_test.go
index f457859..5116b0a 100644
--- a/metropolis/node/kubernetes/reconciler/reconciler_test.go
+++ b/metropolis/node/kubernetes/reconciler/reconciler_test.go
@@ -198,7 +198,7 @@
 		}
 
 		if err := reconcile(ctx, r, rname); err != nil {
-			return fmt.Errorf("reconcile: %v", err)
+			return fmt.Errorf("reconcile: %w", err)
 		}
 		// everything requested should have been created
 		if diff := r.currentDiff(makeTestObject("foo", 0), makeTestObject("bar", 0), makeTestObject("baz", 0)); diff != "" {
@@ -207,7 +207,7 @@
 
 		delete(r.expected, "foo")
 		if err := reconcile(ctx, r, rname); err != nil {
-			return fmt.Errorf("reconcile: %v", err)
+			return fmt.Errorf("reconcile: %w", err)
 		}
 		// foo should now be missing
 		if diff := r.currentDiff(makeTestObject("bar", 0), makeTestObject("baz", 0)); diff != "" {
@@ -216,7 +216,7 @@
 
 		r.expected["bar"] = makeTestObject("bar", 1)
 		if err := reconcile(ctx, r, rname); err != nil {
-			return fmt.Errorf("reconcile: %v", err)
+			return fmt.Errorf("reconcile: %w", err)
 		}
 		// bar should be updated
 		if diff := r.currentDiff(makeTestObject("bar", 1), makeTestObject("baz", 0)); diff != "" {
diff --git a/metropolis/test/e2e/suites/kubernetes/run_test.go b/metropolis/test/e2e/suites/kubernetes/run_test.go
index ed08203..9056ec4 100644
--- a/metropolis/test/e2e/suites/kubernetes/run_test.go
+++ b/metropolis/test/e2e/suites/kubernetes/run_test.go
@@ -182,7 +182,7 @@
 				errorMsg.WriteString(" | ")
 				errorMsg.WriteString(msg.Message)
 			}
-			return fmt.Errorf("pod is not ready: %v", errorMsg.String())
+			return fmt.Errorf("pod is not ready: %s", errorMsg.String())
 		}
 	})
 	util.TestEventual(t, "Simple StatefulSet with PVC", ctx, largeTestTimeout, func(ctx context.Context) error {