diff --git a/osbase/tpm/credactivation_compat.go b/osbase/tpm/credactivation_compat.go
index 24766a7..2c5ee3b 100644
--- a/osbase/tpm/credactivation_compat.go
+++ b/osbase/tpm/credactivation_compat.go
@@ -57,7 +57,7 @@
 	// Spec: TCG 2.0 EK Credential Profile revision 14, section 2.1.5.1.
 	seed := make([]byte, symBlockSize)
 	if _, err := io.ReadFull(rnd, seed); err != nil {
-		return nil, nil, fmt.Errorf("generating seed: %v", err)
+		return nil, nil, fmt.Errorf("generating seed: %w", err)
 	}
 
 	// Encrypt the seed value using the provided public key.
@@ -65,7 +65,7 @@
 	label := append([]byte(labelIdentity), 0)
 	encSecret, err := rsa.EncryptOAEP(aikHash.New(), rnd, pub, seed, label)
 	if err != nil {
-		return nil, nil, fmt.Errorf("generating encrypted seed: %v", err)
+		return nil, nil, fmt.Errorf("generating encrypted seed: %w", err)
 	}
 
 	// Generate the encrypted credential by convolving the seed with the digest
@@ -73,19 +73,19 @@
 	// See section 24.4 of TPM 2.0 specification, part 1.
 	aikNameEncoded, err := aik.Encode()
 	if err != nil {
-		return nil, nil, fmt.Errorf("encoding aikName: %v", err)
+		return nil, nil, fmt.Errorf("encoding aikName: %w", err)
 	}
 	symmetricKey, err := tpm2.KDFa(aik.Alg, seed, labelStorage, aikNameEncoded, nil, len(seed)*8)
 	if err != nil {
-		return nil, nil, fmt.Errorf("generating symmetric key: %v", err)
+		return nil, nil, fmt.Errorf("generating symmetric key: %w", err)
 	}
 	c, err := aes.NewCipher(symmetricKey)
 	if err != nil {
-		return nil, nil, fmt.Errorf("symmetric cipher setup: %v", err)
+		return nil, nil, fmt.Errorf("symmetric cipher setup: %w", err)
 	}
 	cv, err := tpmutil.Pack(tpmutil.U16Bytes(secret))
 	if err != nil {
-		return nil, nil, fmt.Errorf("generating cv (TPM2B_Digest): %v", err)
+		return nil, nil, fmt.Errorf("generating cv (TPM2B_Digest): %w", err)
 	}
 
 	// IV is all null bytes. encIdentity represents the encrypted credential.
@@ -97,7 +97,7 @@
 	// See section 24.5 of the TPM specification revision 2 part 1.
 	macKey, err := tpm2.KDFa(aik.Alg, seed, labelIntegrity, nil, nil, aikHash.Size()*8)
 	if err != nil {
-		return nil, nil, fmt.Errorf("generating HMAC key: %v", err)
+		return nil, nil, fmt.Errorf("generating HMAC key: %w", err)
 	}
 
 	mac := hmac.New(aikHash.New, macKey)
@@ -111,16 +111,16 @@
 	}
 	id, err := tpmutil.Pack(idObject)
 	if err != nil {
-		return nil, nil, fmt.Errorf("encoding IDObject: %v", err)
+		return nil, nil, fmt.Errorf("encoding IDObject: %w", err)
 	}
 
 	packedID, err := tpmutil.Pack(id)
 	if err != nil {
-		return nil, nil, fmt.Errorf("packing id: %v", err)
+		return nil, nil, fmt.Errorf("packing id: %w", err)
 	}
 	packedEncSecret, err := tpmutil.Pack(encSecret)
 	if err != nil {
-		return nil, nil, fmt.Errorf("packing encSecret: %v", err)
+		return nil, nil, fmt.Errorf("packing encSecret: %w", err)
 	}
 
 	return packedID, packedEncSecret, nil
diff --git a/osbase/tpm/eventlog/eventlog.go b/osbase/tpm/eventlog/eventlog.go
index dbfeae0..03aaf69 100644
--- a/osbase/tpm/eventlog/eventlog.go
+++ b/osbase/tpm/eventlog/eventlog.go
@@ -259,7 +259,7 @@
 		}
 		el := e.clone()
 		if err := wkrd.apply(el); err != nil {
-			return nil, fmt.Errorf("failed applying workaround %q: %v", wkrd.id, err)
+			return nil, fmt.Errorf("failed applying workaround %q: %w", wkrd.id, err)
 		}
 		if events, err := replayEvents(el.rawEvents, pcrs); err == nil {
 			return events, nil
@@ -394,12 +394,12 @@
 	var el EventLog
 	e, err := parseFn(r, specID)
 	if err != nil {
-		return nil, fmt.Errorf("parse first event: %v", err)
+		return nil, fmt.Errorf("parse first event: %w", err)
 	}
 	if e.typ == eventTypeNoAction {
 		specID, err = parseSpecIDEvent(e.data)
 		if err != nil {
-			return nil, fmt.Errorf("failed to parse spec ID event: %v", err)
+			return nil, fmt.Errorf("failed to parse spec ID event: %w", err)
 		}
 		for _, alg := range specID.algs {
 			switch tpm2.Algorithm(alg.ID) {
@@ -472,7 +472,7 @@
 		NumAlgs       uint32
 	}
 	if err := binary.Read(r, binary.LittleEndian, &header); err != nil {
-		return nil, fmt.Errorf("reading event header: %v", err)
+		return nil, fmt.Errorf("reading event header: %w", err)
 	}
 	if header.Signature != wantSignature {
 		return nil, fmt.Errorf("invalid spec id signature: %x", header.Signature)
@@ -493,14 +493,14 @@
 	var e specIDEvent
 	for i := 0; i < int(header.NumAlgs); i++ {
 		if err := binary.Read(r, binary.LittleEndian, &specAlg); err != nil {
-			return nil, fmt.Errorf("reading algorithm: %v", err)
+			return nil, fmt.Errorf("reading algorithm: %w", err)
 		}
 		e.algs = append(e.algs, specAlg)
 	}
 
 	var vendorInfoSize uint8
 	if err := binary.Read(r, binary.LittleEndian, &vendorInfoSize); err != nil {
-		return nil, fmt.Errorf("reading vender info size: %v", err)
+		return nil, fmt.Errorf("reading vender info size: %w", err)
 	}
 	if r.Len() != int(vendorInfoSize) {
 		return nil, fmt.Errorf("reading vendor info, expected %d remaining bytes, got %d", vendorInfoSize, r.Len())
@@ -600,7 +600,7 @@
 				continue
 			}
 			if uint16(r.Len()) < alg.Size {
-				return event, fmt.Errorf("reading digest: %v", io.ErrUnexpectedEOF)
+				return event, fmt.Errorf("reading digest: %w", io.ErrUnexpectedEOF)
 			}
 			digest.data = make([]byte, alg.Size)
 			digest.hash = HashAlg(alg.ID).cryptoHash()
diff --git a/osbase/tpm/eventlog/secureboot.go b/osbase/tpm/eventlog/secureboot.go
index 6fd4f1f..1e870ad 100644
--- a/osbase/tpm/eventlog/secureboot.go
+++ b/osbase/tpm/eventlog/secureboot.go
@@ -95,7 +95,7 @@
 
 		et, err := internal.UntrustedParseEventType(uint32(e.Type))
 		if err != nil {
-			return nil, fmt.Errorf("unrecognised event type: %v", err)
+			return nil, fmt.Errorf("unrecognised event type: %w", err)
 		}
 
 		digestVerify := e.digestEquals(e.Data)
@@ -109,7 +109,7 @@
 				return nil, fmt.Errorf("invalid separator data at event %d: %v", e.sequence, e.Data)
 			}
 			if digestVerify != nil {
-				return nil, fmt.Errorf("invalid separator digest at event %d: %v", e.sequence, digestVerify)
+				return nil, fmt.Errorf("invalid separator digest at event %d: %w", e.sequence, digestVerify)
 			}
 
 		case internal.EFIAction:
@@ -121,7 +121,7 @@
 		case internal.EFIVariableDriverConfig:
 			v, err := internal.ParseUEFIVariableData(bytes.NewReader(e.Data))
 			if err != nil {
-				return nil, fmt.Errorf("failed parsing EFI variable at event %d: %v", e.sequence, err)
+				return nil, fmt.Errorf("failed parsing EFI variable at event %d: %w", e.sequence, err)
 			}
 			if _, seenBefore := seenVars[v.VarName()]; seenBefore {
 				return nil, fmt.Errorf("duplicate EFI variable %q at event %d", v.VarName(), e.sequence)
@@ -132,7 +132,7 @@
 			}
 
 			if digestVerify != nil {
-				return nil, fmt.Errorf("invalid digest for variable %q on event %d: %v", v.VarName(), e.sequence, digestVerify)
+				return nil, fmt.Errorf("invalid digest for variable %q on event %d: %w", v.VarName(), e.sequence, digestVerify)
 			}
 
 			switch v.VarName() {
@@ -143,19 +143,19 @@
 				out.Enabled = v.VariableData[0] == 1
 			case "PK":
 				if out.PlatformKeys, out.PlatformKeyHashes, err = v.SignatureData(); err != nil {
-					return nil, fmt.Errorf("event %d: failed parsing platform keys: %v", e.sequence, err)
+					return nil, fmt.Errorf("event %d: failed parsing platform keys: %w", e.sequence, err)
 				}
 			case "KEK":
 				if out.ExchangeKeys, out.ExchangeKeyHashes, err = v.SignatureData(); err != nil {
-					return nil, fmt.Errorf("event %d: failed parsing key exchange keys: %v", e.sequence, err)
+					return nil, fmt.Errorf("event %d: failed parsing key exchange keys: %w", e.sequence, err)
 				}
 			case "db":
 				if out.PermittedKeys, out.PermittedHashes, err = v.SignatureData(); err != nil {
-					return nil, fmt.Errorf("event %d: failed parsing signature database: %v", e.sequence, err)
+					return nil, fmt.Errorf("event %d: failed parsing signature database: %w", e.sequence, err)
 				}
 			case "dbx":
 				if out.ForbiddenKeys, out.ForbiddenHashes, err = v.SignatureData(); err != nil {
-					return nil, fmt.Errorf("event %d: failed parsing forbidden signature database: %v", e.sequence, err)
+					return nil, fmt.Errorf("event %d: failed parsing forbidden signature database: %w", e.sequence, err)
 				}
 			}
 
@@ -172,12 +172,12 @@
 						digestVerify = e.digestEquals(e.Data[:len(e.Data)-1])
 					}
 				} else {
-					return nil, fmt.Errorf("failed parsing EFI variable authority at event %d: %v", e.sequence, err)
+					return nil, fmt.Errorf("failed parsing EFI variable authority at event %d: %w", e.sequence, err)
 				}
 			}
 			seenAuthority = true
 			if digestVerify != nil {
-				return nil, fmt.Errorf("invalid digest for authority on event %d: %v", e.sequence, digestVerify)
+				return nil, fmt.Errorf("invalid digest for authority on event %d: %w", e.sequence, digestVerify)
 			}
 			if !seenSeparator {
 				out.PreSeparatorAuthority = append(out.PreSeparatorAuthority, a.Certs...)