diff --git a/metropolis/pkg/fsquota/fsquota_test.go b/metropolis/pkg/fsquota/fsquota_test.go
index 243dbf6..4044b60 100644
--- a/metropolis/pkg/fsquota/fsquota_test.go
+++ b/metropolis/pkg/fsquota/fsquota_test.go
@@ -17,6 +17,7 @@
 package fsquota
 
 import (
+	"errors"
 	"fmt"
 	"math"
 	"os"
@@ -92,11 +93,10 @@
 		for {
 			n, err := testfile.Write(testdata)
 			if err != nil {
-				if pathErr, ok := err.(*os.PathError); ok {
-					if pathErr.Err == syscall.ENOSPC {
-						// Running out of space is the only acceptable error to continue execution
-						break
-					}
+				var pathErr *os.PathError
+				if errors.As(err, &pathErr) && errors.Is(pathErr.Err, syscall.ENOSPC) {
+					// Running out of space is the only acceptable error to continue execution
+					break
 				}
 				t.Fatal(err)
 			}
diff --git a/metropolis/pkg/loop/loop.go b/metropolis/pkg/loop/loop.go
index a4974a8..a8be907 100644
--- a/metropolis/pkg/loop/loop.go
+++ b/metropolis/pkg/loop/loop.go
@@ -150,11 +150,10 @@
 			return nil, fmt.Errorf("failed to allocate loop device: %w", os.NewSyscallError("ioctl(LOOP_CTL_GET_FREE)", errno))
 		}
 		dev, err := os.OpenFile(fmt.Sprintf("/dev/loop%v", devNum), os.O_RDWR|os.O_EXCL, 0)
-		if pe, ok := err.(*os.PathError); ok {
-			if pe.Err == unix.EBUSY {
-				// We have lost the race, get a new device
-				continue
-			}
+		var pe *os.PathError
+		if errors.As(err, &pe) && errors.Is(pe.Err, unix.EBUSY) {
+			// We have lost the race, get a new device
+			continue
 		}
 		if err != nil {
 			return nil, fmt.Errorf("failed to open newly-allocated loop device: %w", err)
diff --git a/metropolis/pkg/tpm/eventlog/internal/events.go b/metropolis/pkg/tpm/eventlog/internal/events.go
index 78d305c..c95e9dc 100644
--- a/metropolis/pkg/tpm/eventlog/internal/events.go
+++ b/metropolis/pkg/tpm/eventlog/internal/events.go
@@ -391,7 +391,8 @@
 	} else {
 		// A bug in shim may cause an event to be missing the SignatureOwner GUID.
 		// We handle this, but signal back to the caller using ErrSigMissingGUID.
-		if _, isStructuralErr := err.(asn1.StructuralError); isStructuralErr {
+		var structuralError asn1.StructuralError
+		if errors.As(err, &structuralError) {
 			var err2 error
 			cert, err2 = x509.ParseCertificate(b)
 			if err2 == nil {
diff --git a/metropolis/pkg/tpm/tpm.go b/metropolis/pkg/tpm/tpm.go
index a5a0ee1..785553d 100644
--- a/metropolis/pkg/tpm/tpm.go
+++ b/metropolis/pkg/tpm/tpm.go
@@ -476,7 +476,8 @@
 			// Use a full policy session for the EK
 			{Session: endorsementSession, Attributes: tpm2.AttrContinueSession},
 		}, tpm.akHandleCache, ekHandle, credBlob, secretChallenge)
-		if warn, ok := err.(tpm2.Warning); ok && warn.Code == tpm2.RCRetry {
+		var warn tpm2.Warning
+		if errors.As(err, &warn) && warn.Code == tpm2.RCRetry {
 			time.Sleep(100 * time.Millisecond)
 			continue
 		}