diff --git a/.github/workflows/_shared-check.yaml b/.github/workflows/_shared-check.yaml
index 2f5c1fc9..9cbee788 100644
--- a/.github/workflows/_shared-check.yaml
+++ b/.github/workflows/_shared-check.yaml
@@ -44,7 +44,7 @@ jobs:
       uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
       with:
         # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
-        version: v2.7.2
+        version: v2.11.3
 
         # Optional: working directory, useful for monorepos
         # working-directory: somedir
diff --git a/cmd/root.go b/cmd/root.go
index 6404d885..74b68813 100644
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -40,6 +40,7 @@ var rootCmd = &cobra.Command{
 		default:
 			logr.Fatalf("Invalid log format: %s", logFormat)
 		}
+
 		if verbose {
 			logr.SetLevel(logrus.DebugLevel)
 		}
@@ -49,7 +50,6 @@ var rootCmd = &cobra.Command{
 		if err := coord.Run(cmd.Context()); err != nil {
 			logr.Fatal(err)
 		}
-
 	},
 }
 
diff --git a/cmd/validate.go b/cmd/validate.go
index 9e185962..f1de16f4 100644
--- a/cmd/validate.go
+++ b/cmd/validate.go
@@ -16,6 +16,7 @@ var validateCmd = &cobra.Command{
 	Run: func(_ *cobra.Command, _ []string) {
 		// Set up minimal logging for error output
 		logrus.SetLevel(logrus.ErrorLevel)
+
 		if verbose {
 			logrus.SetLevel(logrus.DebugLevel)
 		}
diff --git a/pkg/ai/system_prompt.go b/pkg/ai/system_prompt.go
index 3a73d91e..c2eed6da 100644
--- a/pkg/ai/system_prompt.go
+++ b/pkg/ai/system_prompt.go
@@ -345,7 +345,7 @@ func buildTaskDocumentation() string {
 	}
 
 	builder.WriteString("\n```\n\n")
-	builder.WriteString(fmt.Sprintf("Total: %d tasks available\n\n", len(allTaskNames)))
+	fmt.Fprintf(&builder, "Total: %d tasks available\n\n", len(allTaskNames))
 
 	// Define category order
 	categoryOrder := []string{"check", "generate", "get", "run", "validator", "utility", "other"}
@@ -358,11 +358,11 @@ func buildTaskDocumentation() string {
 			continue
 		}
 
-		builder.WriteString(fmt.Sprintf("### %s Tasks\n\n", titleCaser.String(category)))
+		fmt.Fprintf(&builder, "### %s Tasks\n\n", titleCaser.String(category))
 
 		for _, desc := range descs {
-			builder.WriteString(fmt.Sprintf("#### %s\n", desc.Name))
-			builder.WriteString(fmt.Sprintf("**Description:** %s\n\n", desc.Description))
+			fmt.Fprintf(&builder, "#### %s\n", desc.Name)
+			fmt.Fprintf(&builder, "**Description:** %s\n\n", desc.Description)
 
 			// Add config inputs (from JSON schema)
 			writeConfigInputs(&builder, desc.ConfigSchema)
@@ -372,7 +372,7 @@ func buildTaskDocumentation() string {
 				builder.WriteString("**Outputs:**\n")
 
 				for _, output := range desc.Outputs {
-					builder.WriteString(fmt.Sprintf("- `%s` (%s): %s\n", output.Name, output.Type, output.Description))
+					fmt.Fprintf(&builder, "- `%s` (%s): %s\n", output.Name, output.Type, output.Description)
 				}
 
 				builder.WriteString("\n")
diff --git a/pkg/ai/validator.go b/pkg/ai/validator.go
index 8a25f5a5..cdcba17a 100644
--- a/pkg/ai/validator.go
+++ b/pkg/ai/validator.go
@@ -453,9 +453,9 @@ func FormatValidationIssues(issues []ValidationIssue) string {
 		}
 
 		if issue.Path != "" {
-			sb.WriteString(fmt.Sprintf("%s [%s] %s\n", prefix, issue.Path, issue.Message))
+			fmt.Fprintf(&sb, "%s [%s] %s\n", prefix, issue.Path, issue.Message)
 		} else {
-			sb.WriteString(fmt.Sprintf("%s %s\n", prefix, issue.Message))
+			fmt.Fprintf(&sb, "%s %s\n", prefix, issue.Message)
 		}
 	}
 
diff --git a/pkg/assertoor/coordinator.go b/pkg/assertoor/coordinator.go
index b63b4c11..e9f7999b 100644
--- a/pkg/assertoor/coordinator.go
+++ b/pkg/assertoor/coordinator.go
@@ -369,7 +369,7 @@ func (c *Coordinator) runEpochGC(ctx context.Context) {
 		if networkTime < 0 {
 			sleepTime = networkTime.Abs()
 		} else {
-			currentSlot := uint64(networkTime / specs.SecondsPerSlot) //nolint:gosec // no overflow possible
+			currentSlot := uint64(networkTime / specs.SecondsPerSlot) //nolint:gosec // G115: networkTime is checked non-negative above
 			currentEpoch := currentSlot / specs.SlotsPerEpoch
 			currentSlotIndex := currentSlot % specs.SlotsPerEpoch
 			nextGcSlot := uint64(0)
@@ -388,7 +388,7 @@ func (c *Coordinator) runEpochGC(ctx context.Context) {
 				case <-time.After(specs.SecondsPerSlot / 2):
 				}
 
-				nextEpochDuration := time.Until(genesis.GenesisTime.Add(time.Duration((currentEpoch+1)*specs.SlotsPerEpoch) * specs.SecondsPerSlot)) //nolint:gosec // no overflow possible
+				nextEpochDuration := time.Until(genesis.GenesisTime.Add(time.Duration((currentEpoch+1)*specs.SlotsPerEpoch) * specs.SecondsPerSlot)) //nolint:gosec // G115: epoch*slots product won't overflow
 
 				c.log.GetLogger().Infof("run GC (slot %v, %v sec before epoch %v)", currentSlot, nextEpochDuration.Seconds(), currentEpoch+1)
 				runtime.GC()
@@ -402,7 +402,7 @@ func (c *Coordinator) runEpochGC(ctx context.Context) {
 				}
 			}
 
-			nextRunTime := genesis.GenesisTime.Add(time.Duration(nextGcSlot) * specs.SecondsPerSlot) //nolint:gosec // no overflow possible
+			nextRunTime := genesis.GenesisTime.Add(time.Duration(nextGcSlot) * specs.SecondsPerSlot) //nolint:gosec // G115: slot number won't overflow int64
 			sleepTime = time.Until(nextRunTime)
 		}
 
diff --git a/pkg/clients/consensus/block.go b/pkg/clients/consensus/block.go
index b9b211f1..fca3c2ae 100644
--- a/pkg/clients/consensus/block.go
+++ b/pkg/clients/consensus/block.go
@@ -27,7 +27,7 @@ func (block *Block) GetSeenBy() []*Client {
 	block.seenMutex.RLock()
 	defer block.seenMutex.RUnlock()
 
-	clients := []*Client{}
+	clients := make([]*Client, 0, len(block.seenMap))
 
 	for _, client := range block.seenMap {
 		clients = append(clients, client)
diff --git a/pkg/clients/consensus/blockcache.go b/pkg/clients/consensus/blockcache.go
index 48e5312d..fe74bb37 100644
--- a/pkg/clients/consensus/blockcache.go
+++ b/pkg/clients/consensus/blockcache.go
@@ -104,7 +104,7 @@ func (cache *BlockCache) SetMinFollowDistance(followDistance uint64) {
 		followDistance = 10000
 	}
 
-	followDistance32 := uint32(followDistance) //nolint:gosec // no overflow possible
+	followDistance32 := uint32(followDistance)
 
 	if followDistance32 > cache.followDistance {
 		cache.followDistance = followDistance32
@@ -281,7 +281,7 @@ func (cache *BlockCache) AddBlock(root phase0.Root, slot phase0.Slot) (*Block, b
 	}
 
 	if cache.maxSlotIdx < 0 || slot > phase0.Slot(cache.maxSlotIdx) {
-		cache.maxSlotIdx = int64(slot) //nolint:gosec // no overflow possible
+		cache.maxSlotIdx = int64(slot) //nolint:gosec // G115: slot values won't exceed int64 max
 	}
 
 	return cacheBlock, true
@@ -313,8 +313,8 @@ func (cache *BlockCache) GetCachedBlocks() []*Block {
 	cache.blockMutex.RLock()
 	defer cache.blockMutex.RUnlock()
 
-	blocks := []*Block{}
-	slots := []phase0.Slot{}
+	blocks := make([]*Block, 0, len(cache.blockSlotMap))
+	slots := make([]phase0.Slot, 0, len(cache.blockSlotMap))
 
 	for slot := range cache.blockSlotMap {
 		slots = append(slots, slot)
diff --git a/pkg/clients/execution/block.go b/pkg/clients/execution/block.go
index 02261f5d..4c1b1fbf 100644
--- a/pkg/clients/execution/block.go
+++ b/pkg/clients/execution/block.go
@@ -25,7 +25,7 @@ func (block *Block) GetSeenBy() []*Client {
 	block.seenMutex.RLock()
 	defer block.seenMutex.RUnlock()
 
-	clients := []*Client{}
+	clients := make([]*Client, 0, len(block.seenMap))
 	for _, client := range block.seenMap {
 		clients = append(clients, client)
 	}
diff --git a/pkg/clients/execution/blockcache.go b/pkg/clients/execution/blockcache.go
index b71790d3..e03eb9c4 100644
--- a/pkg/clients/execution/blockcache.go
+++ b/pkg/clients/execution/blockcache.go
@@ -73,7 +73,7 @@ func (cache *BlockCache) SetMinFollowDistance(followDistance uint64) {
 		followDistance = 10000
 	}
 
-	followDistance32 := uint32(followDistance) //nolint:gosec // no overflow possible
+	followDistance32 := uint32(followDistance)
 
 	if followDistance32 > cache.followDistance {
 		cache.followDistance = followDistance32
@@ -148,7 +148,7 @@ func (cache *BlockCache) AddBlock(hash common.Hash, number uint64) (*Block, bool
 	}
 
 	if cache.maxSlotIdx < 0 || number > uint64(cache.maxSlotIdx) {
-		cache.maxSlotIdx = int64(number) //nolint:gosec // no overflow possible
+		cache.maxSlotIdx = int64(number) //nolint:gosec // G115: block numbers won't exceed int64 max
 	}
 
 	return cacheBlock, true
@@ -165,8 +165,8 @@ func (cache *BlockCache) GetCachedBlocks() []*Block {
 	cache.cacheMutex.RLock()
 	defer cache.cacheMutex.RUnlock()
 
-	blocks := []*Block{}
-	slots := []uint64{}
+	blocks := make([]*Block, 0, len(cache.numberMap))
+	slots := make([]uint64, 0, len(cache.numberMap))
 
 	for slot := range cache.numberMap {
 		slots = append(slots, slot)
diff --git a/pkg/tasks/check_consensus_attestation_stats/task.go b/pkg/tasks/check_consensus_attestation_stats/task.go
index bf05cffc..957c9cfd 100644
--- a/pkg/tasks/check_consensus_attestation_stats/task.go
+++ b/pkg/tasks/check_consensus_attestation_stats/task.go
@@ -549,7 +549,7 @@ func (t *Task) aggregateEpochVotes(ctx context.Context, epoch uint64) []*epochVo
 		}
 	}
 
-	votes := []*epochVotes{}
+	votes := make([]*epochVotes, 0, len(allHeads))
 	for root := range allHeads {
 		votes = append(votes, allVotes[root])
 	}
@@ -565,7 +565,7 @@ func (t *Task) aggregateAttestationVotes(votes *epochVotes, slot, committee uint
 
 	for bitIdx, attDuty := range voteValidators {
 		validatorIdx := attDuty.validator
-		if aggregationBits.BitAt(uint64(bitIdx) + aggregationBitsOffset) { //nolint:gosec // no overflow possible
+		if aggregationBits.BitAt(uint64(bitIdx) + aggregationBitsOffset) {
 			if votes.activityMap[validatorIdx] {
 				continue
 			}
diff --git a/pkg/tasks/check_consensus_block_proposals/task.go b/pkg/tasks/check_consensus_block_proposals/task.go
index dfc88a2d..0dc7c98e 100644
--- a/pkg/tasks/check_consensus_block_proposals/task.go
+++ b/pkg/tasks/check_consensus_block_proposals/task.go
@@ -184,9 +184,9 @@ func (t *Task) Execute(ctx context.Context) error {
 }
 
 func (t *Task) setMatchingBlocksOutput(blocks []*consensus.Block) {
-	blockRoots := []string{}
-	blockHeaders := []any{}
-	blockBodies := []any{}
+	blockRoots := make([]string, 0, len(blocks))
+	blockHeaders := make([]any, 0, len(blocks))
+	blockBodies := make([]any, 0, len(blocks))
 
 	for _, block := range blocks {
 		blockRoots = append(blockRoots, block.Root.String())
diff --git a/pkg/tasks/check_consensus_sync_status/task.go b/pkg/tasks/check_consensus_sync_status/task.go
index 32dc7f1c..0bde1b07 100644
--- a/pkg/tasks/check_consensus_sync_status/task.go
+++ b/pkg/tasks/check_consensus_sync_status/task.go
@@ -200,7 +200,7 @@ func (t *Task) processClientCheck(client *clients.PoolClient, syncStatus *rpc.Sy
 		return false
 	}
 
-	if int64(syncStatus.HeadSlot) < int64(t.config.MinSlotHeight) { //nolint:gosec // no overflow possible
+	if int64(syncStatus.HeadSlot) < int64(t.config.MinSlotHeight) { //nolint:gosec // G115: slot values won't exceed int64 max
 		checkLogger.Debugf("check failed. check: MinSlotHeight, expected: >= %v, got: %v", t.config.MinSlotHeight, syncStatus.HeadSlot)
 		return false
 	}
diff --git a/pkg/tasks/check_eth_config/task.go b/pkg/tasks/check_eth_config/task.go
index bff4325e..d675461a 100644
--- a/pkg/tasks/check_eth_config/task.go
+++ b/pkg/tasks/check_eth_config/task.go
@@ -225,7 +225,7 @@ func (t *Task) Execute(ctx context.Context) error {
 
 		configIndex := 1
 		for config, clientNames := range configMap {
-			diffBuilder.WriteString(fmt.Sprintf("Config variant #%d (clients: %v):\n", configIndex, clientNames))
+			fmt.Fprintf(&diffBuilder, "Config variant #%d (clients: %v):\n", configIndex, clientNames)
 			diffBuilder.WriteString(config)
 			diffBuilder.WriteString("\n\n")
 
diff --git a/pkg/tasks/check_execution_sync_status/task.go b/pkg/tasks/check_execution_sync_status/task.go
index 1c5727c2..24b33602 100644
--- a/pkg/tasks/check_execution_sync_status/task.go
+++ b/pkg/tasks/check_execution_sync_status/task.go
@@ -196,7 +196,7 @@ func (t *Task) processClientCheck(client *clients.PoolClient, syncStatus *rpc.Sy
 		return false
 	}
 
-	if int64(currentBlock) < int64(t.config.MinBlockHeight) { //nolint:gosec // no overflow possible
+	if int64(currentBlock) < int64(t.config.MinBlockHeight) { //nolint:gosec // G115: block heights won't exceed int64 max
 		checkLogger.Debugf("check failed. check: MinBlockHeight, expected: >= %v, got: %v", t.config.MinBlockHeight, currentBlock)
 		return false
 	}
diff --git a/pkg/tasks/generate_attestations/task.go b/pkg/tasks/generate_attestations/task.go
index ba34968d..9ad0430b 100644
--- a/pkg/tasks/generate_attestations/task.go
+++ b/pkg/tasks/generate_attestations/task.go
@@ -265,10 +265,10 @@ func (t *Task) initValidatorKeys() error {
 
 	startIndex := uint64(0)
 	if t.config.StartIndex > 0 {
-		startIndex = uint64(t.config.StartIndex) //nolint:gosec // no overflow possible
+		startIndex = uint64(t.config.StartIndex)
 	}
 
-	endIndex := startIndex + uint64(t.config.IndexCount) //nolint:gosec // no overflow possible
+	endIndex := startIndex + uint64(t.config.IndexCount) //nolint:gosec // G115: config value is validated non-negative
 
 	for accountIdx := startIndex; accountIdx < endIndex; accountIdx++ {
 		validatorKeyPath := fmt.Sprintf("m/12381/3600/%d/0/0", accountIdx)
@@ -419,7 +419,7 @@ func (t *Task) findSlotDuties(slot uint64, duties []*v1.BeaconCommittee) []*vali
 					validatorIndex:      valIdx,
 					committeeIndex:      committee.Index,
 					committeeLength:     uint64(len(committee.Validators)),
-					positionInCommittee: uint64(position), //nolint:gosec // position from range is always non-negative
+					positionInCommittee: uint64(position),
 				})
 			}
 		}
diff --git a/pkg/tasks/generate_blob_transactions/task.go b/pkg/tasks/generate_blob_transactions/task.go
index b7e1e0aa..925d21e5 100644
--- a/pkg/tasks/generate_blob_transactions/task.go
+++ b/pkg/tasks/generate_blob_transactions/task.go
@@ -308,7 +308,6 @@ func (t *Task) generateTransaction(ctx context.Context, transactionIdx uint64, c
 
 	if t.config.RandomTarget {
 		addrBytes := make([]byte, 20)
-		//nolint:errcheck // ignore
 		rand.Read(addrBytes)
 		toAddr = common.Address(addrBytes)
 	} else if t.config.TargetAddress != "" {
diff --git a/pkg/tasks/generate_bls_changes/task.go b/pkg/tasks/generate_bls_changes/task.go
index 9f168a39..9ed5896f 100644
--- a/pkg/tasks/generate_bls_changes/task.go
+++ b/pkg/tasks/generate_bls_changes/task.go
@@ -116,11 +116,11 @@ func (t *Task) LoadConfig() error {
 
 func (t *Task) Execute(ctx context.Context) error {
 	if t.config.StartIndex > 0 {
-		t.nextIndex = uint64(t.config.StartIndex) //nolint:gosec // no overflow possible
+		t.nextIndex = uint64(t.config.StartIndex)
 	}
 
 	if t.config.IndexCount > 0 {
-		t.lastIndex = t.nextIndex + uint64(t.config.IndexCount) //nolint:gosec // no overflow possible
+		t.lastIndex = t.nextIndex + uint64(t.config.IndexCount)
 	}
 
 	var subscription *consensus.Subscription[*consensus.Block]
@@ -141,7 +141,7 @@ func (t *Task) Execute(ctx context.Context) error {
 	if t.config.LimitTotal > 0 {
 		targetCount = t.config.LimitTotal
 	} else if t.lastIndex > 0 {
-		targetCount = int(t.lastIndex - t.nextIndex) //nolint:gosec // no overflow possible
+		targetCount = int(t.lastIndex - t.nextIndex) //nolint:gosec // G115: difference is bounded by config values
 	}
 
 	t.ctx.ReportProgress(0, "Starting BLS change generation")
diff --git a/pkg/tasks/generate_consolidations/task.go b/pkg/tasks/generate_consolidations/task.go
index 69b7d08a..60bab5b6 100644
--- a/pkg/tasks/generate_consolidations/task.go
+++ b/pkg/tasks/generate_consolidations/task.go
@@ -121,11 +121,11 @@ func (t *Task) LoadConfig() error {
 //nolint:gocyclo // no need to reduce complexity
 func (t *Task) Execute(ctx context.Context) error {
 	if t.config.SourceStartIndex > 0 {
-		t.nextIndex = uint64(t.config.SourceStartIndex) //nolint:gosec // no overflow possible
+		t.nextIndex = uint64(t.config.SourceStartIndex)
 	}
 
 	if t.config.SourceIndexCount > 0 {
-		t.lastIndex = t.nextIndex + uint64(t.config.SourceIndexCount) //nolint:gosec // no overflow possible
+		t.lastIndex = t.nextIndex + uint64(t.config.SourceIndexCount)
 	}
 
 	var subscription *consensus.Subscription[*consensus.Block]
@@ -204,7 +204,7 @@ func (t *Task) Execute(ctx context.Context) error {
 				progress := float64(totalCount) / float64(t.config.LimitTotal) * 100
 				t.ctx.ReportProgress(progress, fmt.Sprintf("Generated %d/%d consolidations", totalCount, t.config.LimitTotal))
 			case t.lastIndex > 0:
-				indexTotal := t.lastIndex - uint64(t.config.SourceStartIndex) //nolint:gosec // no overflow possible
+				indexTotal := t.lastIndex - uint64(t.config.SourceStartIndex) //nolint:gosec // G115: config value is validated non-negative
 				progress := float64(totalCount) / float64(indexTotal) * 100
 				t.ctx.ReportProgress(progress, fmt.Sprintf("Generated %d/%d consolidations", totalCount, indexTotal))
 			default:
diff --git a/pkg/tasks/generate_deposits/task.go b/pkg/tasks/generate_deposits/task.go
index 912eade4..e1e41003 100644
--- a/pkg/tasks/generate_deposits/task.go
+++ b/pkg/tasks/generate_deposits/task.go
@@ -140,11 +140,11 @@ func (t *Task) LoadConfig() error {
 //nolint:gocyclo // ignore
 func (t *Task) Execute(ctx context.Context) error {
 	if t.config.StartIndex > 0 {
-		t.nextIndex = uint64(t.config.StartIndex) //nolint:gosec // no overflow possible
+		t.nextIndex = uint64(t.config.StartIndex)
 	}
 
 	if t.config.IndexCount > 0 {
-		t.lastIndex = t.nextIndex + uint64(t.config.IndexCount) //nolint:gosec // no overflow possible
+		t.lastIndex = t.nextIndex + uint64(t.config.IndexCount)
 	}
 
 	var subscription *consensus.Subscription[*consensus.Block]
@@ -169,7 +169,7 @@ func (t *Task) Execute(ctx context.Context) error {
 	if t.config.LimitTotal > 0 {
 		targetCount = t.config.LimitTotal
 	} else if t.lastIndex > 0 {
-		targetCount = int(t.lastIndex - t.nextIndex) //nolint:gosec // no overflow possible
+		targetCount = int(t.lastIndex - t.nextIndex) //nolint:gosec // G115: difference is bounded by config values
 	}
 
 	t.ctx.ReportProgress(0, "Starting deposit generation")
diff --git a/pkg/tasks/generate_eoa_transactions/task.go b/pkg/tasks/generate_eoa_transactions/task.go
index 69ca09d8..059515b6 100644
--- a/pkg/tasks/generate_eoa_transactions/task.go
+++ b/pkg/tasks/generate_eoa_transactions/task.go
@@ -270,7 +270,6 @@ func (t *Task) generateTransaction(ctx context.Context, transactionIdx uint64, c
 
 		if t.config.RandomTarget {
 			addrBytes := make([]byte, 20)
-			//nolint:errcheck // ignore
 			rand.Read(addrBytes)
 			addr = common.Address(addrBytes)
 		} else if t.config.TargetAddress != "" {
diff --git a/pkg/tasks/generate_exits/task.go b/pkg/tasks/generate_exits/task.go
index 7dd4a171..69fb4166 100644
--- a/pkg/tasks/generate_exits/task.go
+++ b/pkg/tasks/generate_exits/task.go
@@ -102,11 +102,11 @@ func (t *Task) LoadConfig() error {
 
 func (t *Task) Execute(ctx context.Context) error {
 	if t.config.StartIndex > 0 {
-		t.nextIndex = uint64(t.config.StartIndex) //nolint:gosec // no overflow possible
+		t.nextIndex = uint64(t.config.StartIndex)
 	}
 
 	if t.config.IndexCount > 0 {
-		t.lastIndex = t.nextIndex + uint64(t.config.IndexCount) //nolint:gosec // no overflow possible
+		t.lastIndex = t.nextIndex + uint64(t.config.IndexCount)
 	}
 
 	var subscription *consensus.Subscription[*consensus.Block]
@@ -132,7 +132,7 @@ func (t *Task) Execute(ctx context.Context) error {
 	if t.config.LimitTotal > 0 {
 		targetCount = t.config.LimitTotal
 	} else if t.lastIndex > 0 {
-		targetCount = int(t.lastIndex - t.nextIndex) //nolint:gosec // no overflow possible
+		targetCount = int(t.lastIndex - t.nextIndex) //nolint:gosec // G115: difference is bounded by config values
 	}
 
 	t.ctx.ReportProgress(0, "Starting voluntary exit generation")
@@ -324,7 +324,7 @@ func (t *Task) generateVoluntaryExit(ctx context.Context, accountIdx uint64, for
 	}
 
 	if t.config.ExitEpoch >= 0 {
-		operation.Epoch = phase0.Epoch(t.config.ExitEpoch) //nolint:gosec // no overflow possible
+		operation.Epoch = phase0.Epoch(t.config.ExitEpoch)
 	} else {
 		currentSlot, _ := client.GetLastHead()
 		operation.Epoch = phase0.Epoch(currentSlot / phase0.Slot(specs.SlotsPerEpoch))
diff --git a/pkg/tasks/generate_slashings/task.go b/pkg/tasks/generate_slashings/task.go
index d35197b5..fbe9d474 100644
--- a/pkg/tasks/generate_slashings/task.go
+++ b/pkg/tasks/generate_slashings/task.go
@@ -105,11 +105,11 @@ func (t *Task) LoadConfig() error {
 
 func (t *Task) Execute(ctx context.Context) error {
 	if t.config.StartIndex > 0 {
-		t.nextIndex = uint64(t.config.StartIndex) //nolint:gosec // no overflow possible
+		t.nextIndex = uint64(t.config.StartIndex)
 	}
 
 	if t.config.IndexCount > 0 {
-		t.lastIndex = t.nextIndex + uint64(t.config.IndexCount) //nolint:gosec // no overflow possible
+		t.lastIndex = t.nextIndex + uint64(t.config.IndexCount)
 	}
 
 	var subscription *consensus.Subscription[*consensus.Block]
@@ -158,7 +158,7 @@ func (t *Task) Execute(ctx context.Context) error {
 				progress := float64(totalCount) / float64(t.config.LimitTotal) * 100
 				t.ctx.ReportProgress(progress, fmt.Sprintf("Generated %d/%d slashings", totalCount, t.config.LimitTotal))
 			case t.lastIndex > 0:
-				indexTotal := t.lastIndex - uint64(t.config.StartIndex) //nolint:gosec // no overflow possible
+				indexTotal := t.lastIndex - uint64(t.config.StartIndex) //nolint:gosec // G115: config value is validated non-negative
 				progress := float64(totalCount) / float64(indexTotal) * 100
 				t.ctx.ReportProgress(progress, fmt.Sprintf("Generated %d/%d slashings", totalCount, indexTotal))
 			default:
diff --git a/pkg/tasks/generate_transaction/task.go b/pkg/tasks/generate_transaction/task.go
index d5e701c2..2afe2295 100644
--- a/pkg/tasks/generate_transaction/task.go
+++ b/pkg/tasks/generate_transaction/task.go
@@ -402,7 +402,6 @@ func (t *Task) generateTransaction() (*ethtypes.Transaction, error) {
 
 		if t.config.RandomTarget {
 			addrBytes := make([]byte, 20)
-			//nolint:errcheck // ignore
 			rand.Read(addrBytes)
 			addr = common.Address(addrBytes)
 		} else if t.config.TargetAddress != "" {
diff --git a/pkg/tasks/generate_withdrawal_requests/task.go b/pkg/tasks/generate_withdrawal_requests/task.go
index 8c0c2086..84c9d3f6 100644
--- a/pkg/tasks/generate_withdrawal_requests/task.go
+++ b/pkg/tasks/generate_withdrawal_requests/task.go
@@ -122,11 +122,11 @@ func (t *Task) LoadConfig() error {
 //nolint:gocyclo // no need to reduce complexity
 func (t *Task) Execute(ctx context.Context) error {
 	if t.config.SourceStartIndex > 0 {
-		t.nextIndex = uint64(t.config.SourceStartIndex) //nolint:gosec // no overflow possible
+		t.nextIndex = uint64(t.config.SourceStartIndex)
 	}
 
 	if t.config.SourceIndexCount > 0 {
-		t.lastIndex = t.nextIndex + uint64(t.config.SourceIndexCount) //nolint:gosec // no overflow possible
+		t.lastIndex = t.nextIndex + uint64(t.config.SourceIndexCount)
 	}
 
 	var subscription *consensus.Subscription[*consensus.Block]
@@ -205,7 +205,7 @@ func (t *Task) Execute(ctx context.Context) error {
 				progress := float64(totalCount) / float64(t.config.LimitTotal) * 100
 				t.ctx.ReportProgress(progress, fmt.Sprintf("Generated %d/%d withdrawal requests", totalCount, t.config.LimitTotal))
 			case t.lastIndex > 0:
-				indexTotal := t.lastIndex - uint64(t.config.SourceStartIndex) //nolint:gosec // no overflow possible
+				indexTotal := t.lastIndex - uint64(t.config.SourceStartIndex) //nolint:gosec // G115: config value is validated non-negative
 				progress := float64(totalCount) / float64(indexTotal) * 100
 				t.ctx.ReportProgress(progress, fmt.Sprintf("Generated %d/%d withdrawal requests", totalCount, indexTotal))
 			default:
diff --git a/pkg/tasks/run_shell/task.go b/pkg/tasks/run_shell/task.go
index 2d85dc9d..9ec9efcd 100644
--- a/pkg/tasks/run_shell/task.go
+++ b/pkg/tasks/run_shell/task.go
@@ -378,6 +378,7 @@ func (t *Task) storeTaskResults(summaryFile *resultFile, resultDir string) {
 		fileIdx := uint64(0)
 
 		var storeResultFilesFn func(path string, prefix string)
+
 		storeResultFilesFn = func(path string, prefix string) {
 			if prefix != "" {
 				prefix += "/"
diff --git a/pkg/test/descriptor.go b/pkg/test/descriptor.go
index c95437d3..1e50fd5f 100644
--- a/pkg/test/descriptor.go
+++ b/pkg/test/descriptor.go
@@ -36,7 +36,7 @@ func NewDescriptor(testID, testSrc, basePath string, config *types.TestConfig, v
 }
 
 func LoadTestDescriptors(ctx context.Context, globalVars types.Variables, localTests []*types.TestConfig, externalTests []*types.ExternalTestConfig) []types.TestDescriptor {
-	descriptors := []types.TestDescriptor{}
+	descriptors := make([]types.TestDescriptor, 0, len(localTests)+len(externalTests))
 
 	workingDir, err := os.Getwd()
 	if err != nil {
diff --git a/pkg/txmgr/spamoor.go b/pkg/txmgr/spamoor.go
index f6f73a81..2f584337 100644
--- a/pkg/txmgr/spamoor.go
+++ b/pkg/txmgr/spamoor.go
@@ -31,9 +31,10 @@ func NewSpamoor(ctx context.Context, logger logrus.FieldLogger, executionPool *e
 	}
 
 	clientPool := spamoor.NewClientPool(ctx, logger.WithField("module", "clientpool"))
-	clientOptions := make([]*spamoor.ClientOptions, 0)
 
 	endpoints := executionPool.GetAllEndpoints()
+	clientOptions := make([]*spamoor.ClientOptions, 0, len(endpoints))
+
 	for _, client := range endpoints {
 		clientOptions = append(clientOptions, s.getClientOptions(client))
 	}
@@ -146,7 +147,7 @@ func (s *Spamoor) GetTxPool() *spamoor.TxPool {
 
 func (s *Spamoor) GetReadyClient() *spamoor.Client {
 	idx := s.clientIdx.Add(1)
-	return s.clientPool.GetClient(spamoor.WithClientSelectionMode(spamoor.SelectClientByIndex, int(idx%1000000))) //nolint:gosec // bounded before conversion
+	return s.clientPool.GetClient(spamoor.WithClientSelectionMode(spamoor.SelectClientByIndex, int(idx%1000000)))
 }
 
 func (s *Spamoor) GetClient(client *execution.Client) *spamoor.Client {
diff --git a/pkg/web/api/get_task_details_api.go b/pkg/web/api/get_task_details_api.go
index cca77676..361f4e66 100644
--- a/pkg/web/api/get_task_details_api.go
+++ b/pkg/web/api/get_task_details_api.go
@@ -90,12 +90,12 @@ func (ah *APIHandler) GetTestRunTaskDetails(w http.ResponseWriter, r *http.Reque
 	case taskStatus.IsRunning:
 		taskData.Status = "running"
 		taskData.StartTime = taskStatus.StartTime.UnixMilli()
-		taskData.RunTime = uint64(time.Since(taskStatus.StartTime).Round(1 * time.Millisecond).Milliseconds()) //nolint:gosec // no overflow possible
+		taskData.RunTime = uint64(time.Since(taskStatus.StartTime).Round(1 * time.Millisecond).Milliseconds()) //nolint:gosec // G115: duration in ms is always non-negative
 	default:
 		taskData.Status = "complete"
 		taskData.StartTime = taskStatus.StartTime.UnixMilli()
 		taskData.StopTime = taskStatus.StopTime.UnixMilli()
-		taskData.RunTime = uint64(taskStatus.StopTime.Sub(taskStatus.StartTime).Round(1 * time.Millisecond).Milliseconds()) //nolint:gosec // no overflow possible
+		taskData.RunTime = uint64(taskStatus.StopTime.Sub(taskStatus.StartTime).Round(1 * time.Millisecond).Milliseconds()) //nolint:gosec // G115: duration in ms is always non-negative
 	}
 
 	switch taskStatus.Result {
diff --git a/pkg/web/api/get_test_runs_api.go b/pkg/web/api/get_test_runs_api.go
index 831552ef..3ad24fa1 100644
--- a/pkg/web/api/get_test_runs_api.go
+++ b/pkg/web/api/get_test_runs_api.go
@@ -31,9 +31,8 @@ func (ah *APIHandler) GetTestRuns(w http.ResponseWriter, r *http.Request) {
 
 	q := r.URL.Query()
 	filterTestID := q.Get("test_id")
-	testRuns := []*GetTestRunsResponse{}
-
 	testInstances, _ := ah.coordinator.GetTestHistory(filterTestID, 0, 0, 100)
+	testRuns := make([]*GetTestRunsResponse, 0, len(testInstances))
 
 	for _, testInstance := range testInstances {
 		testRun := &GetTestRunsResponse{
diff --git a/pkg/web/api/get_test_yaml_api.go b/pkg/web/api/get_test_yaml_api.go
index 069fa6fc..267283c6 100644
--- a/pkg/web/api/get_test_yaml_api.go
+++ b/pkg/web/api/get_test_yaml_api.go
@@ -100,12 +100,12 @@ func (ah *APIHandler) loadExternalYaml(ctx context.Context, source string) (stri
 	if strings.HasPrefix(cleanSource, "http://") || strings.HasPrefix(cleanSource, "https://") {
 		client := &http.Client{Timeout: time.Second * 120}
 
-		req, err := http.NewRequestWithContext(ctx, "GET", cleanSource, http.NoBody)
+		req, err := http.NewRequestWithContext(ctx, "GET", cleanSource, http.NoBody) //nolint:gosec // URL is derived from configured test sources, not user input
 		if err != nil {
 			return "", fmt.Errorf("failed to create request: %w", err)
 		}
 
-		resp, err := client.Do(req)
+		resp, err := client.Do(req) //nolint:gosec // URL is derived from configured test sources, not user input
 		if err != nil {
 			return "", fmt.Errorf("failed to fetch URL: %w", err)
 		}
@@ -129,7 +129,7 @@ func (ah *APIHandler) loadExternalYaml(ctx context.Context, source string) (stri
 	}
 
 	// It's a local file path - read the file (this endpoint is auth-protected)
-	body, err := os.ReadFile(cleanSource)
+	body, err := os.ReadFile(cleanSource) //nolint:gosec // path is derived from configured test sources, not user input
 	if err != nil {
 		return "", fmt.Errorf("cannot load local file %s: %w", cleanSource, err)
 	}
diff --git a/pkg/web/api/post_tests_register_external_api.go b/pkg/web/api/post_tests_register_external_api.go
index 6db566e7..fb8b2b4b 100644
--- a/pkg/web/api/post_tests_register_external_api.go
+++ b/pkg/web/api/post_tests_register_external_api.go
@@ -76,7 +76,7 @@ func (ah *APIHandler) PostTestsRegisterExternal(w http.ResponseWriter, r *http.R
 		Schedule:   req.Schedule,
 	}
 	if req.Timeout > 0 {
-		extTestCfg.Timeout = &helper.Duration{Duration: time.Duration(req.Timeout) * time.Second} //nolint:gosec // no overflow possible
+		extTestCfg.Timeout = &helper.Duration{Duration: time.Duration(req.Timeout) * time.Second} //nolint:gosec // G115: timeout value is bounded by API input validation
 	}
 
 	// add test descriptor