diff --git a/metropolis/node/core/curator/impl_leader_cluster_networking.go b/metropolis/node/core/curator/impl_leader_cluster_networking.go
index f4f6edc..4bd729d 100644
--- a/metropolis/node/core/curator/impl_leader_cluster_networking.go
+++ b/metropolis/node/core/curator/impl_leader_cluster_networking.go
@@ -2,6 +2,7 @@
 
 import (
 	"context"
+	"errors"
 	"net/netip"
 
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
@@ -32,7 +33,7 @@
 	defer w.Close()
 	for {
 		nodeKV, err := w.Get(ctx, event.BacklogOnly[*nodeAtID]())
-		if err == event.BacklogDone {
+		if errors.Is(err, event.BacklogDone) {
 			break
 		}
 		if err != nil {
diff --git a/metropolis/node/core/curator/impl_leader_curator.go b/metropolis/node/core/curator/impl_leader_curator.go
index 9cbbbe6..d45fc79 100644
--- a/metropolis/node/core/curator/impl_leader_curator.go
+++ b/metropolis/node/core/curator/impl_leader_curator.go
@@ -4,6 +4,7 @@
 	"context"
 	"crypto/ed25519"
 	"crypto/subtle"
+	"errors"
 	"fmt"
 	"io"
 	"net"
@@ -108,7 +109,7 @@
 	nodes := make(map[string]*Node)
 	for {
 		nodeKV, err := w.Get(ctx, event.BacklogOnly[*nodeAtID]())
-		if err == event.BacklogDone {
+		if errors.Is(err, event.BacklogDone) {
 			break
 		}
 		if err != nil {
@@ -359,7 +360,7 @@
 		rpc.Trace(ctx).Printf("node %s already exists in cluster, failing", id)
 		return nil, status.Errorf(codes.FailedPrecondition, "node already exists in cluster, state %s", node.state.String())
 	}
-	if err != errNodeNotFound {
+	if !errors.Is(err, errNodeNotFound) {
 		return nil, err
 	}
 
diff --git a/metropolis/node/core/curator/impl_leader_management.go b/metropolis/node/core/curator/impl_leader_management.go
index 9d5b4cd..2fe5e6c 100644
--- a/metropolis/node/core/curator/impl_leader_management.go
+++ b/metropolis/node/core/curator/impl_leader_management.go
@@ -4,6 +4,7 @@
 	"bytes"
 	"context"
 	"crypto/ed25519"
+	"errors"
 	"sort"
 	"time"
 
@@ -319,7 +320,7 @@
 
 	// Find the node matching the requested public key.
 	node, err := nodeLoad(ctx, l.leadership, id)
-	if err == errNodeNotFound {
+	if errors.Is(err, errNodeNotFound) {
 		return nil, status.Errorf(codes.NotFound, "node %s not found", id)
 	}
 	if err != nil {
@@ -413,7 +414,7 @@
 
 	// Find the node matching the requested public key.
 	node, err := nodeLoad(ctx, l.leadership, id)
-	if err == errNodeNotFound {
+	if errors.Is(err, errNodeNotFound) {
 		return nil, status.Errorf(codes.NotFound, "node %s not found", id)
 	}
 	if err != nil {
diff --git a/metropolis/node/core/mgmt/svc_logs.go b/metropolis/node/core/mgmt/svc_logs.go
index 9d27d63..b24e485 100644
--- a/metropolis/node/core/mgmt/svc_logs.go
+++ b/metropolis/node/core/mgmt/svc_logs.go
@@ -1,6 +1,7 @@
 package mgmt
 
 import (
+	"errors"
 	"strings"
 
 	"google.golang.org/grpc/codes"
@@ -63,9 +64,9 @@
 	}
 	dn := logtree.DN(req.Dn)
 	_, err := dn.Path()
-	switch err {
-	case nil:
-	case logtree.ErrInvalidDN:
+	switch {
+	case err == nil:
+	case errors.Is(err, logtree.ErrInvalidDN):
 		return status.Errorf(codes.InvalidArgument, "invalid DN")
 	default:
 		return status.Errorf(codes.Unavailable, "could not parse DN: %v", err)
@@ -116,9 +117,9 @@
 	}
 
 	reader, err := s.LogTree.Read(logtree.DN(req.Dn), options...)
-	switch err {
-	case nil:
-	case logtree.ErrRawAndLeveled:
+	switch {
+	case err == nil:
+	case errors.Is(err, logtree.ErrRawAndLeveled):
 		return status.Errorf(codes.InvalidArgument, "requested only raw and only leveled logs simultaneously")
 	default:
 		return status.Errorf(codes.Unavailable, "could not retrieve logs: %v", err)
diff --git a/metropolis/node/kubernetes/csi.go b/metropolis/node/kubernetes/csi.go
index f150a13..c0d81bb 100644
--- a/metropolis/node/kubernetes/csi.go
+++ b/metropolis/node/kubernetes/csi.go
@@ -18,6 +18,7 @@
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net"
 	"os"
@@ -107,7 +108,7 @@
 	case *csi.VolumeCapability_Mount:
 		err := unix.Mount(volumePath, req.TargetPath, "", unix.MS_BIND, "")
 		switch {
-		case err == unix.ENOENT:
+		case errors.Is(err, unix.ENOENT):
 			return nil, status.Error(codes.NotFound, "volume not found")
 		case err != nil:
 			return nil, status.Errorf(codes.Unavailable, "failed to bind-mount volume: %v", err)
diff --git a/metropolis/node/kubernetes/plugins/kvmdevice/kvmdevice.go b/metropolis/node/kubernetes/plugins/kvmdevice/kvmdevice.go
index b9b4fb4..902803b 100644
--- a/metropolis/node/kubernetes/plugins/kvmdevice/kvmdevice.go
+++ b/metropolis/node/kubernetes/plugins/kvmdevice/kvmdevice.go
@@ -26,6 +26,7 @@
 import (
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"net"
 	"os"
@@ -158,7 +159,7 @@
 	kvmDevNode, err := deviceNumberFromString(string(kvmDevRaw))
 
 	err = unix.Mknod("/dev/kvm", 0660, int(kvmDevNode))
-	if err != nil && err != unix.EEXIST {
+	if err != nil && errors.Is(err, unix.EEXIST) {
 		return fmt.Errorf("failed to create KVM device node: %v", err)
 	}