diff --git a/.github/workflows/build-test.yaml b/.github/workflows/build-test.yaml
index aefb257b..b2b3bd23 100644
--- a/.github/workflows/build-test.yaml
+++ b/.github/workflows/build-test.yaml
@@ -24,10 +24,10 @@ jobs:
         with:
           go-version-file: go.mod
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@2226d7cb06a077cd73e56eedd38eecad18e5d837 # v6.5.0
+        uses: golangci/golangci-lint-action@1481404843c368bc19ca9406f87d6e0fc97bdcfd # v7.0.0
         with:
-          version: v1.54
-          args: --timeout 10m --exclude SA5011 --verbose --issues-exit-code=0
+          version: v2.0.2
+          args: --timeout 10m --verbose --issues-exit-code=0
           only-new-issues: true
 
   govulncheck:
@@ -108,7 +108,7 @@ jobs:
           cache-to: type=gha,mode=max
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@0.29.0
+        uses: aquasecurity/trivy-action@0.30.0
         with:
           image-ref: "quay.io/jetstack/version-checker:${{github.sha}}"
           format: "table"
diff --git a/.github/workflows/coverage-badge.yaml b/.github/workflows/coverage-badge.yaml
index 5cd5c731..048f9321 100644
--- a/.github/workflows/coverage-badge.yaml
+++ b/.github/workflows/coverage-badge.yaml
@@ -29,7 +29,7 @@ jobs:
           go tool cover -func=coverage.out -o=coverage.out
 
       - name: Go Coverage Badge  # Pass the `coverage.out` output to this action
-        uses: tj-actions/coverage-badge-go@v2
+        uses: tj-actions/coverage-badge-go@v3
         with:
           filename: coverage.out
 
diff --git a/cmd/app/options.go b/cmd/app/options.go
index b4bb191c..f53d77fd 100644
--- a/cmd/app/options.go
+++ b/cmd/app/options.go
@@ -88,13 +88,13 @@ func (o *Options) addFlags(cmd *cobra.Command) {
 
 	usageFmt := "Usage:\n  %s\n"
 	cmd.SetUsageFunc(func(cmd *cobra.Command) error {
-		fmt.Fprintf(cmd.OutOrStderr(), usageFmt, cmd.UseLine())
+		_, _ = fmt.Fprintf(cmd.OutOrStderr(), usageFmt, cmd.UseLine())
 		cliflag.PrintSections(cmd.OutOrStderr(), nfs, 0)
 		return nil
 	})
 
 	cmd.SetHelpFunc(func(cmd *cobra.Command, _ []string) {
-		fmt.Fprintf(cmd.OutOrStdout(), "%s\n\n"+usageFmt, cmd.Long, cmd.UseLine())
+		_, _ = fmt.Fprintf(cmd.OutOrStdout(), "%s\n\n"+usageFmt, cmd.Long, cmd.UseLine())
 		cliflag.PrintSections(cmd.OutOrStdout(), nfs, 0)
 	})
 
diff --git a/cmd/app/options_test.go b/cmd/app/options_test.go
index 3c10a7c0..cfa42688 100644
--- a/cmd/app/options_test.go
+++ b/cmd/app/options_test.go
@@ -181,10 +181,6 @@ func TestComplete(t *testing.T) {
 				t.Errorf("unexpected client options, exp=%#+v got=%#+v",
 					test.expOptions, o.Client)
 			}
-
-			for _, env := range test.envs {
-				os.Unsetenv(env[0])
-			}
 		})
 	}
 }
diff --git a/pkg/client/acr/acr.go b/pkg/client/acr/acr.go
index 0f33800f..0ac52b3f 100644
--- a/pkg/client/acr/acr.go
+++ b/pkg/client/acr/acr.go
@@ -78,7 +78,7 @@ func (c *Client) Tags(ctx context.Context, host, repo, image string) ([]api.Imag
 	if err != nil {
 		return nil, err
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	var manifestResp ManifestResponse
 	if err := json.NewDecoder(resp.Body).Decode(&manifestResp); err != nil {
@@ -212,7 +212,7 @@ func (c *Client) getAccessTokenClient(ctx context.Context, host string) (*acrCli
 		return nil, fmt.Errorf("%s: failed to request access token: %s",
 			host, err)
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	var respToken AccessTokenResponse
 	if err := json.NewDecoder(resp.Body).Decode(&respToken); err != nil {
diff --git a/pkg/client/acr/path_test.go b/pkg/client/acr/path_test.go
index ec69c0a1..d16e2dd6 100644
--- a/pkg/client/acr/path_test.go
+++ b/pkg/client/acr/path_test.go
@@ -1,6 +1,10 @@
 package acr
 
-import "testing"
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
 
 func TestIsHost(t *testing.T) {
 	tests := map[string]struct {
@@ -85,11 +89,9 @@ func TestRepoImage(t *testing.T) {
 	handler := new(Client)
 	for name, test := range tests {
 		t.Run(name, func(t *testing.T) {
-			if repo, image := handler.RepoImageFromPath(test.path); !(repo == test.expRepo &&
-				image == test.expImage) {
-				t.Errorf("%s: unexpected repo/image, exp=%s,%s got=%s,%s",
-					test.path, test.expRepo, test.expImage, repo, image)
-			}
+			repo, image := handler.RepoImageFromPath(test.path)
+			assert.Equal(t, repo, test.expRepo)
+			assert.Equal(t, image, test.expImage)
 		})
 	}
 }
diff --git a/pkg/client/docker/docker.go b/pkg/client/docker/docker.go
index 12e34628..4662f3af 100644
--- a/pkg/client/docker/docker.go
+++ b/pkg/client/docker/docker.go
@@ -131,7 +131,7 @@ func (c *Client) doRequest(ctx context.Context, url string) (*TagResponse, error
 	if err != nil {
 		return nil, fmt.Errorf("failed to get %q image: %s", c.Name(), err)
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
@@ -165,7 +165,7 @@ func basicAuthSetup(ctx context.Context, client *http.Client, opts Options) (str
 	if err != nil {
 		return "", err
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
diff --git a/pkg/client/ecr/ecr.go b/pkg/client/ecr/ecr.go
index 3b95701a..3654fee4 100644
--- a/pkg/client/ecr/ecr.go
+++ b/pkg/client/ecr/ecr.go
@@ -95,7 +95,7 @@ func (c *Client) createClient(ctx context.Context, region string) (*ecr.Client,
 	if c.IamRoleArn != "" {
 		cfg, err = config.LoadDefaultConfig(ctx,
 			config.WithRegion(region),
-			config.WithHTTPClient(&http.Client{Transport: c.Options.Transporter}),
+			config.WithHTTPClient(&http.Client{Transport: c.Transporter}),
 		)
 	} else {
 		cfg, err = config.LoadDefaultConfig(ctx,
@@ -103,7 +103,7 @@ func (c *Client) createClient(ctx context.Context, region string) (*ecr.Client,
 				credentials.NewStaticCredentialsProvider(c.AccessKeyID, c.SecretAccessKey, c.SessionToken),
 			),
 			config.WithRegion(region),
-			config.WithHTTPClient(&http.Client{Transport: c.Options.Transporter}),
+			config.WithHTTPClient(&http.Client{Transport: c.Transporter}),
 		)
 	}
 	if err != nil {
diff --git a/pkg/client/ecr/path_test.go b/pkg/client/ecr/path_test.go
index 7246dffa..79f08058 100644
--- a/pkg/client/ecr/path_test.go
+++ b/pkg/client/ecr/path_test.go
@@ -1,6 +1,10 @@
 package ecr
 
-import "testing"
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
 
 func TestIsHost(t *testing.T) {
 	tests := map[string]struct {
@@ -98,11 +102,9 @@ func TestRepoImage(t *testing.T) {
 	handler := new(Client)
 	for name, test := range tests {
 		t.Run(name, func(t *testing.T) {
-			if repo, image := handler.RepoImageFromPath(test.path); !(repo == test.expRepo &&
-				image == test.expImage) {
-				t.Errorf("%s: unexpected repo/image, exp=%s,%s got=%s,%s",
-					test.path, test.expRepo, test.expImage, repo, image)
-			}
+			repo, image := handler.RepoImageFromPath(test.path)
+			assert.Equal(t, repo, test.expRepo)
+			assert.Equal(t, image, test.expImage)
 		})
 	}
 }
diff --git a/pkg/client/gcr/gcr.go b/pkg/client/gcr/gcr.go
index 772c3ece..15ebccc6 100644
--- a/pkg/client/gcr/gcr.go
+++ b/pkg/client/gcr/gcr.go
@@ -62,7 +62,7 @@ func (c *Client) Tags(ctx context.Context, host, repo, image string) ([]api.Imag
 	if err != nil {
 		return nil, fmt.Errorf("failed to get %q image: %w", c.Name(), err)
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
diff --git a/pkg/client/ghcr/ghcr.go b/pkg/client/ghcr/ghcr.go
index 617e22d5..8a00f0a6 100644
--- a/pkg/client/ghcr/ghcr.go
+++ b/pkg/client/ghcr/ghcr.go
@@ -76,7 +76,7 @@ func (c *Client) Tags(ctx context.Context, _, owner, repo string) ([]api.ImageTa
 			break
 		}
 
-		opts.ListOptions.Page = resp.NextPage
+		opts.Page = resp.NextPage
 	}
 
 	return tags, nil
diff --git a/pkg/client/quay/quay.go b/pkg/client/quay/quay.go
index 7140418e..7130084a 100644
--- a/pkg/client/quay/quay.go
+++ b/pkg/client/quay/quay.go
@@ -172,7 +172,7 @@ func (c *Client) makeRequest(ctx context.Context, url string, obj interface{}) e
 	if err != nil {
 		return fmt.Errorf("failed to make quay call %q: %s", url, err)
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	if err := json.NewDecoder(resp.Body).Decode(obj); err != nil {
 		return err
diff --git a/pkg/client/selfhosted/selfhosted.go b/pkg/client/selfhosted/selfhosted.go
index 559eead7..33bac242 100644
--- a/pkg/client/selfhosted/selfhosted.go
+++ b/pkg/client/selfhosted/selfhosted.go
@@ -238,13 +238,13 @@ func (c *Client) doRequest(ctx context.Context, url, header string, obj interfac
 	if err != nil {
 		return nil, fmt.Errorf("failed to get %q image: %s", c.Name(), err)
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return nil, err
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	if resp.StatusCode != http.StatusOK {
 		return nil, selfhostederrors.NewHTTPError(resp.StatusCode, body)
@@ -279,7 +279,7 @@ func (c *Client) setupBasicAuth(ctx context.Context, url, tokenPath string) (str
 		return "", fmt.Errorf("failed to send basic auth request %q: %s",
 			req.URL, err)
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
diff --git a/pkg/client/selfhosted/selfhosted_test.go b/pkg/client/selfhosted/selfhosted_test.go
index 7c3b762f..3fd5abb5 100644
--- a/pkg/client/selfhosted/selfhosted_test.go
+++ b/pkg/client/selfhosted/selfhosted_test.go
@@ -105,7 +105,7 @@ func TestName(t *testing.T) {
 
 	assert.Equal(t, "testhost", client.Name())
 
-	client.Options.Host = ""
+	client.Host = ""
 	assert.Equal(t, "selfhosted", client.Name())
 }
 
@@ -322,7 +322,7 @@ func TestNewTLSConfig(t *testing.T) {
 	t.Run("successful TLS config creation with valid CA path", func(t *testing.T) {
 		caFile, err := os.CreateTemp("", "ca.pem")
 		assert.NoError(t, err)
-		defer os.Remove(caFile.Name())
+		defer func() { assert.NoError(t, os.Remove(caFile.Name())) }()
 
 		_, err = caFile.WriteString(`-----BEGIN CERTIFICATE-----
 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwf3Kq/BnEePvM6rSGPP6
diff --git a/pkg/metrics/roundtripper_test.go b/pkg/metrics/roundtripper_test.go
index 7827fd88..f45da000 100644
--- a/pkg/metrics/roundtripper_test.go
+++ b/pkg/metrics/roundtripper_test.go
@@ -176,6 +176,7 @@ func TestRoundTripper(t *testing.T) {
 			require.NoError(t, err)
 
 			resp, err := client.Do(req)
+			defer func() { _ = resp.Body.Close() }()
 
 			if tt.expectedError {
 				assert.Error(t, err)
@@ -185,7 +186,6 @@ func TestRoundTripper(t *testing.T) {
 				assert.NotNil(t, resp)
 				assert.Equal(t, tt.expectedStatus, resp.StatusCode)
 			}
-			resp.Body.Close()
 
 			// Validate metrics
 			assert.NoError(t,