diff --git a/metropolis/pkg/blockdev/blockdev_linux.go b/metropolis/pkg/blockdev/blockdev_linux.go
index 6d87c87..b5ef106 100644
--- a/metropolis/pkg/blockdev/blockdev_linux.go
+++ b/metropolis/pkg/blockdev/blockdev_linux.go
@@ -72,7 +72,7 @@
 		// Attempts to leverage discard guarantees to provide extremely quick
 		// metadata-only zeroing.
 		err = unix.Fallocate(int(fd), unix.FALLOC_FL_PUNCH_HOLE|unix.FALLOC_FL_KEEP_SIZE, startByte, endByte-startByte)
-		if err == unix.EOPNOTSUPP {
+		if errors.Is(err, unix.EOPNOTSUPP) {
 			// Tries Write Same and friends and then just falls back to writing
 			// zeroes.
 			_, _, err = unix.Syscall(unix.SYS_IOCTL, fd, unix.BLKZEROOUT, uintptr(unsafe.Pointer(&args[0])))
diff --git a/metropolis/pkg/event/etcd/etcd_test.go b/metropolis/pkg/event/etcd/etcd_test.go
index 6173732..d4eb04f 100644
--- a/metropolis/pkg/event/etcd/etcd_test.go
+++ b/metropolis/pkg/event/etcd/etcd_test.go
@@ -131,7 +131,7 @@
 		if err == nil {
 			return
 		}
-		if err == ctxT.Err() {
+		if errors.Is(err, ctxT.Err()) {
 			log.Printf("Retrying after %v", err)
 			continue
 		}
@@ -776,7 +776,7 @@
 	// As expected, next call to Get with BacklogOnly fails - there truly is no new
 	// updates to emit.
 	_, err = watcher.Get(ctx, event.BacklogOnly[StringAt]())
-	if want, got := event.BacklogDone, err; want != got {
+	if want, got := event.BacklogDone, err; !errors.Is(got, want) {
 		t.Fatalf("Second Get: wanted %v, got %v", want, got)
 	}
 
@@ -784,7 +784,7 @@
 	// BacklogOnly will still return BacklogDone.
 	tc.put(t, k, "second")
 	_, err = watcher.Get(ctx, event.BacklogOnly[StringAt]())
-	if want, got := event.BacklogDone, err; want != got {
+	if want, got := event.BacklogDone, err; !errors.Is(got, want) {
 		t.Fatalf("Third Get: wanted %v, got %v", want, got)
 	}
 
@@ -840,7 +840,7 @@
 	nUpdates := 1
 	for {
 		g, err := w.Get(ctx, event.BacklogOnly[StringAt]())
-		if err == event.BacklogDone {
+		if errors.Is(err, event.BacklogDone) {
 			break
 		}
 		if err != nil {
diff --git a/metropolis/pkg/event/memory/memory_test.go b/metropolis/pkg/event/memory/memory_test.go
index 98a1501..80ac575 100644
--- a/metropolis/pkg/event/memory/memory_test.go
+++ b/metropolis/pkg/event/memory/memory_test.go
@@ -18,6 +18,7 @@
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"sync"
 	"sync/atomic"
@@ -294,7 +295,7 @@
 
 	// Cancel the context, and expect that context error to propagate to the .Get().
 	ctxC()
-	if want, got := ctx.Err(), <-errs; want != got {
+	if want, got := ctx.Err(), <-errs; !errors.Is(got, want) {
 		t.Fatalf("Get should've returned %v, got %v", want, got)
 	}
 
@@ -308,7 +309,7 @@
 
 	// Unblock the .Get now.
 	p.Set(1)
-	if want, got := error(nil), <-errs; want != got {
+	if want, got := error(nil), <-errs; !errors.Is(got, want) {
 		t.Fatalf("Get should've returned %v, got %v", want, got)
 	}
 }
diff --git a/metropolis/pkg/fsquota/fsquota.go b/metropolis/pkg/fsquota/fsquota.go
index 1cdcd54..af87d9f 100644
--- a/metropolis/pkg/fsquota/fsquota.go
+++ b/metropolis/pkg/fsquota/fsquota.go
@@ -22,6 +22,7 @@
 package fsquota
 
 import (
+	"errors"
 	"fmt"
 	"math"
 	"os"
@@ -66,7 +67,7 @@
 		// infrequent calls this should not be an immediate issue.
 		for {
 			quota, err := quotactl.GetNextQuota(dir, quotactl.QuotaTypeProject, lastID)
-			if err == unix.ENOENT || err == unix.ESRCH {
+			if errors.Is(err, unix.ENOENT) || errors.Is(err, unix.ESRCH) {
 				// We have enumerated all quotas, nothing exists here
 				break
 			} else if err != nil {
diff --git a/metropolis/pkg/kmod/manager.go b/metropolis/pkg/kmod/manager.go
index 1630a7f..3b3f875 100644
--- a/metropolis/pkg/kmod/manager.go
+++ b/metropolis/pkg/kmod/manager.go
@@ -2,6 +2,7 @@
 
 import (
 	"bufio"
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -150,7 +151,7 @@
 	}
 	defer module.Close()
 	err = LoadModule(module, "", 0)
-	if err != nil && err != unix.EEXIST {
+	if err != nil && errors.Is(err, unix.EEXIST) {
 		return fmt.Errorf("error loading kernel module %v: %w", modMeta.Name, err)
 	}
 	s.loadedModules[modIdx] = true
diff --git a/metropolis/pkg/scsi/inquiry.go b/metropolis/pkg/scsi/inquiry.go
index 45c1603..bce2c9a 100644
--- a/metropolis/pkg/scsi/inquiry.go
+++ b/metropolis/pkg/scsi/inquiry.go
@@ -3,6 +3,7 @@
 import (
 	"bytes"
 	"encoding/binary"
+	"errors"
 	"fmt"
 	"io"
 	"math"
@@ -27,7 +28,7 @@
 	rawReader := io.LimitReader(bytes.NewReader(data), resLen)
 	var raw inquiryDataRaw
 	if err := binary.Read(rawReader, binary.BigEndian, &raw); err != nil {
-		if err == io.ErrUnexpectedEOF {
+		if errors.Is(err, io.ErrUnexpectedEOF) {
 			return nil, fmt.Errorf("response to INQUIRY is smaller than %d bytes, very old or broken device", binary.Size(raw))
 		}
 		panic(err) // Read from memory, shouldn't be possible to hit
@@ -67,14 +68,14 @@
 	}
 	var padding [2]byte
 	if _, err := io.ReadFull(rawReader, padding[:]); err != nil {
-		if err == io.ErrUnexpectedEOF {
+		if errors.Is(err, io.ErrUnexpectedEOF) {
 			return &res, nil
 		}
 	}
 	for i := 0; i < 8; i++ {
 		var versionDesc uint16
 		if err := binary.Read(rawReader, binary.BigEndian, &versionDesc); err != nil {
-			if err == io.EOF || err == io.ErrUnexpectedEOF {
+			if errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF) {
 				return &res, nil
 			}
 		}
diff --git a/metropolis/pkg/socksproxy/socksproxy.go b/metropolis/pkg/socksproxy/socksproxy.go
index dfd32c4..808ae1f 100644
--- a/metropolis/pkg/socksproxy/socksproxy.go
+++ b/metropolis/pkg/socksproxy/socksproxy.go
@@ -17,6 +17,7 @@
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"log"
@@ -173,14 +174,14 @@
 
 	// Read request from the client and translate problems into early error replies.
 	req, err := readRequest(con)
-	switch err {
-	case errNotConnect:
+	switch {
+	case errors.Is(err, errNotConnect):
 		writeReply(con, ReplyCommandNotSupported, net.IPv4(0, 0, 0, 0), 0)
 		return
-	case errUnsupportedAddressType:
+	case errors.Is(err, errUnsupportedAddressType):
 		writeReply(con, ReplyAddressTypeNotSupported, net.IPv4(0, 0, 0, 0), 0)
 		return
-	case nil:
+	case err == nil:
 	default:
 		writeReply(con, ReplyGeneralFailure, net.IPv4(0, 0, 0, 0), 0)
 		return
diff --git a/metropolis/pkg/tpm/eventlog/secureboot.go b/metropolis/pkg/tpm/eventlog/secureboot.go
index d2aa721..090be5c 100644
--- a/metropolis/pkg/tpm/eventlog/secureboot.go
+++ b/metropolis/pkg/tpm/eventlog/secureboot.go
@@ -163,7 +163,7 @@
 			a, err := internal.ParseUEFIVariableAuthority(bytes.NewReader(e.Data))
 			if err != nil {
 				// Workaround for: https://github.com/google/go-attestation/issues/157
-				if err == internal.ErrSigMissingGUID {
+				if errors.Is(err, internal.ErrSigMissingGUID) {
 					// Versions of shim which do not carry
 					// https://github.com/rhboot/shim/commit/8a27a4809a6a2b40fb6a4049071bf96d6ad71b50
 					// have an erroneous additional byte in the event, which breaks digest
diff --git a/metropolis/pkg/verity/encoder.go b/metropolis/pkg/verity/encoder.go
index a1c0ca1..871cec0 100644
--- a/metropolis/pkg/verity/encoder.go
+++ b/metropolis/pkg/verity/encoder.go
@@ -45,6 +45,7 @@
 	"crypto/sha256"
 	"encoding/binary"
 	"encoding/hex"
+	"errors"
 	"fmt"
 	"io"
 	"strconv"
@@ -177,9 +178,9 @@
 			dcnt++
 		}
 		// Handle the read errors.
-		switch err {
-		case nil:
-		case io.ErrUnexpectedEOF, io.EOF:
+		switch {
+		case err == nil:
+		case errors.Is(err, io.ErrUnexpectedEOF), errors.Is(err, io.EOF):
 			// io.ReadFull returns io.ErrUnexpectedEOF after a partial read,
 			// and io.EOF if no bytes were read. In both cases it's possible
 			// to end up with a partially filled hash block.