diff --git a/GNUmakefile b/GNUmakefile
index 6a537f3e2..0110512d2 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -161,6 +161,9 @@ check: ## Lint the source code
 	@echo "==> Linting source code..."
 	@golangci-lint run
 
+	@echo "==> Linting ./api source code..."
+	@cd ./api && golangci-lint run --config ../.golangci.yml
+
 	@echo "==> Linting hclog statements..."
 	@hclogvet .
 
diff --git a/api/agent.go b/api/agent.go
index 82497f524..459a62d8d 100644
--- a/api/agent.go
+++ b/api/agent.go
@@ -310,7 +310,7 @@ func (a *Agent) Monitor(stopCh <-chan struct{}, q *QueryOptions) (<-chan *Stream
 	}
 
 	r.setQueryOptions(q)
-	_, resp, err := requireOK(a.client.doRequest(r))
+	_, resp, err := requireOK(a.client.doRequest(r)) //nolint:bodyclose
 	if err != nil {
 		errCh <- err
 		return nil, errCh
diff --git a/api/allocations_exec.go b/api/allocations_exec.go
index 46ed41a14..44c8e1788 100644
--- a/api/allocations_exec.go
+++ b/api/allocations_exec.go
@@ -109,11 +109,11 @@ func (s *execSession) startConnection() (*websocket.Conn, error) {
 	var conn *websocket.Conn
 
 	if nodeClient != nil {
-		conn, _, _ = nodeClient.websocket(reqPath, q)
+		conn, _, _ = nodeClient.websocket(reqPath, q) //nolint:bodyclose // gorilla/websocket Dialer.DialContext() does not require the body to be closed.
 	}
 
 	if conn == nil {
-		conn, _, err = s.client.websocket(reqPath, q)
+		conn, _, err = s.client.websocket(reqPath, q) //nolint:bodyclose // gorilla/websocket Dialer.DialContext() does not require the body to be closed.
 		if err != nil {
 			return nil, err
 		}
diff --git a/api/api.go b/api/api.go
index b59b4a687..a49e84f85 100644
--- a/api/api.go
+++ b/api/api.go
@@ -932,7 +932,7 @@ func (c *Client) rawQuery(endpoint string, q *QueryOptions) (io.ReadCloser, erro
 		return nil, err
 	}
 	r.setQueryOptions(q)
-	_, resp, err := requireOK(c.doRequest(r))
+	_, resp, err := requireOK(c.doRequest(r)) //nolint:bodyclose // Closing the body is the caller's responsibility.
 	if err != nil {
 		return nil, err
 	}
@@ -1036,7 +1036,7 @@ func (c *Client) query(endpoint string, out any, q *QueryOptions) (*QueryMeta, e
 		return nil, err
 	}
 	r.setQueryOptions(q)
-	rtt, resp, err := requireOK(c.doRequest(r))
+	rtt, resp, err := requireOK(c.doRequest(r)) //nolint:bodyclose // Closing the body is the caller's responsibility.
 	if err != nil {
 		return nil, err
 	}
@@ -1061,7 +1061,7 @@ func (c *Client) putQuery(endpoint string, in, out any, q *QueryOptions) (*Query
 	}
 	r.setQueryOptions(q)
 	r.obj = in
-	rtt, resp, err := requireOK(c.doRequest(r))
+	rtt, resp, err := requireOK(c.doRequest(r)) //nolint:bodyclose // Closing the body is the caller's responsibility.
 	if err != nil {
 		return nil, err
 	}
@@ -1092,7 +1092,7 @@ func (c *Client) postQuery(endpoint string, in, out any, q *QueryOptions) (*Quer
 	}
 	r.setQueryOptions(q)
 	r.obj = in
-	rtt, resp, err := requireOK(c.doRequest(r))
+	rtt, resp, err := requireOK(c.doRequest(r)) //nolint:bodyclose // Closing the body is the caller's responsibility.
 	if err != nil {
 		return nil, err
 	}
@@ -1125,7 +1125,7 @@ func (c *Client) write(verb, endpoint string, in, out any, q *WriteOptions) (*Wr
 	}
 	r.setWriteOptions(q)
 	r.obj = in
-	rtt, resp, err := requireOK(c.doRequest(r))
+	rtt, resp, err := requireOK(c.doRequest(r)) //nolint:bodyclose // Closing the body is the caller's responsibility.
 	if err != nil {
 		return nil, err
 	}
@@ -1151,7 +1151,7 @@ func (c *Client) delete(endpoint string, in, out any, q *WriteOptions) (*WriteMe
 	}
 	r.setWriteOptions(q)
 	r.obj = in
-	rtt, resp, err := requireOK(c.doRequest(r))
+	rtt, resp, err := requireOK(c.doRequest(r)) //nolint:bodyclose // Closing the body is the caller's responsibility.
 	if err != nil {
 		return nil, err
 	}
diff --git a/api/consul.go b/api/consul.go
index 039e7e07f..78147e6ec 100644
--- a/api/consul.go
+++ b/api/consul.go
@@ -199,7 +199,6 @@ type ConsulMeshGateway struct {
 func (c *ConsulMeshGateway) Canonicalize() {
 	// Mode may be empty string, indicating behavior will defer to Consul
 	// service-defaults config entry.
-	return
 }
 
 func (c *ConsulMeshGateway) Copy() *ConsulMeshGateway {
@@ -630,9 +629,7 @@ type ConsulMeshConfigEntry struct {
 	// nothing in here
 }
 
-func (e *ConsulMeshConfigEntry) Canonicalize() {
-	return
-}
+func (e *ConsulMeshConfigEntry) Canonicalize() {}
 
 func (e *ConsulMeshConfigEntry) Copy() *ConsulMeshConfigEntry {
 	if e == nil {
diff --git a/api/event_stream.go b/api/event_stream.go
index 7721d15cc..47523b125 100644
--- a/api/event_stream.go
+++ b/api/event_stream.go
@@ -186,7 +186,7 @@ func (e *EventStream) Stream(ctx context.Context, topics map[Topic][]string, ind
 		}
 	}
 
-	_, resp, err := requireOK(e.client.doRequest(r))
+	_, resp, err := requireOK(e.client.doRequest(r)) //nolint:bodyclose
 
 	if err != nil {
 		return nil, err
diff --git a/api/internal/testutil/responsewriter.go b/api/internal/testutil/responsewriter.go
index d6fdc915f..4c5271a75 100644
--- a/api/internal/testutil/responsewriter.go
+++ b/api/internal/testutil/responsewriter.go
@@ -53,7 +53,7 @@ func (r *ResponseRecorder) Header() http.Header {
 func (r *ResponseRecorder) HeaderMap() http.Header {
 	r.mu.Lock()
 	defer r.mu.Unlock()
-	return r.rr.Result().Header
+	return r.rr.Result().Header //nolint:bodyclose
 }
 
 // Write to the underlying response buffer. Safe to call concurrent with Read.
diff --git a/api/internal/testutil/server.go b/api/internal/testutil/server.go
index 39294b547..51673d4ec 100644
--- a/api/internal/testutil/server.go
+++ b/api/internal/testutil/server.go
@@ -373,7 +373,7 @@ func (s *TestServer) url(path string) string {
 
 // requireOK checks the HTTP response code and ensures it is acceptable.
 func (s *TestServer) requireOK(resp *http.Response) error {
-	if resp.StatusCode != 200 {
+	if resp.StatusCode != http.StatusOK {
 		return fmt.Errorf("bad status code: %d", resp.StatusCode)
 	}
 	return nil
@@ -381,7 +381,7 @@ func (s *TestServer) requireOK(resp *http.Response) error {
 
 // put performs a new HTTP PUT request.
 func (s *TestServer) put(path string, body io.Reader) *http.Response {
-	req, err := http.NewRequest("PUT", s.url(path), body)
+	req, err := http.NewRequest(http.MethodPut, s.url(path), body)
 	must.NoError(s.t, err)
 
 	resp, err := s.HTTPClient.Do(req)
diff --git a/api/operator.go b/api/operator.go
index 507ea5cad..90a5b4352 100644
--- a/api/operator.go
+++ b/api/operator.go
@@ -66,7 +66,7 @@ func (op *Operator) RaftGetConfiguration(q *QueryOptions) (*RaftConfiguration, e
 		return nil, err
 	}
 	r.setQueryOptions(q)
-	_, resp, err := requireOK(op.c.doRequest(r))
+	_, resp, err := requireOK(op.c.doRequest(r)) //nolint:bodyclose
 	if err != nil {
 		return nil, err
 	}
@@ -91,7 +91,7 @@ func (op *Operator) RaftRemovePeerByAddress(address string, q *WriteOptions) err
 
 	r.params.Set("address", address)
 
-	_, resp, err := requireOK(op.c.doRequest(r))
+	_, resp, err := requireOK(op.c.doRequest(r)) //nolint:bodyclose
 	if err != nil {
 		return err
 	}
@@ -111,7 +111,7 @@ func (op *Operator) RaftRemovePeerByID(id string, q *WriteOptions) error {
 
 	r.params.Set("id", id)
 
-	_, resp, err := requireOK(op.c.doRequest(r))
+	_, resp, err := requireOK(op.c.doRequest(r)) //nolint:bodyclose
 	if err != nil {
 		return err
 	}
@@ -131,7 +131,7 @@ func (op *Operator) RaftTransferLeadershipByAddress(address string, q *WriteOpti
 
 	r.params.Set("address", address)
 
-	_, resp, err := requireOK(op.c.doRequest(r))
+	_, resp, err := requireOK(op.c.doRequest(r)) //nolint:bodyclose
 	if err != nil {
 		return err
 	}
@@ -151,7 +151,7 @@ func (op *Operator) RaftTransferLeadershipByID(id string, q *WriteOptions) error
 
 	r.params.Set("id", id)
 
-	_, resp, err := requireOK(op.c.doRequest(r))
+	_, resp, err := requireOK(op.c.doRequest(r)) //nolint:bodyclose
 	if err != nil {
 		return err
 	}
@@ -262,18 +262,17 @@ func (op *Operator) Snapshot(q *QueryOptions) (io.ReadCloser, error) {
 		return nil, err
 	}
 	r.setQueryOptions(q)
-	_, resp, err := requireOK(op.c.doRequest(r))
+	_, resp, err := requireOK(op.c.doRequest(r)) //nolint:bodyclose
 	if err != nil {
 		return nil, err
 	}
+	defer resp.Body.Close()
 
 	digest := resp.Header.Get("Digest")
 
 	cr, err := newChecksumValidatingReader(resp.Body, digest)
 	if err != nil {
 		io.Copy(io.Discard, resp.Body)
-		resp.Body.Close()
-
 		return nil, err
 	}
 
@@ -355,7 +354,7 @@ func (op *Operator) ApplyLicense(license string, opts *ApplyLicenseOptions, q *W
 	r.setWriteOptions(q)
 	r.body = strings.NewReader(license)
 
-	rtt, resp, err := requireOK(op.c.doRequest(r))
+	rtt, resp, err := requireOK(op.c.doRequest(r)) //nolint:bodyclose
 	if err != nil {
 		return nil, err
 	}
@@ -375,7 +374,7 @@ func (op *Operator) LicenseGet(q *QueryOptions) (*LicenseReply, *QueryMeta, erro
 	req.setQueryOptions(q)
 
 	var reply LicenseReply
-	rtt, resp, err := op.c.doRequest(req)
+	rtt, resp, err := op.c.doRequest(req) //nolint:bodyclose
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/api/retry.go b/api/retry.go
index 965d0ef5e..c32dbff5e 100644
--- a/api/retry.go
+++ b/api/retry.go
@@ -39,7 +39,7 @@ func (c *Client) retryPut(ctx context.Context, endpoint string, in, out any, q *
 	var err error
 	var wm *WriteMeta
 
-	attemptDelay := time.Duration(100 * time.Second) // Avoid a tick before starting
+	attemptDelay := 100 * time.Second // Avoid a tick before starting
 	startTime := time.Now()
 
 	t := time.NewTimer(attemptDelay)
@@ -60,7 +60,7 @@ func (c *Client) retryPut(ctx context.Context, endpoint string, in, out any, q *
 		wm, err = c.put(endpoint, in, out, q)
 
 		// Maximum retry period is up, don't retry
-		if c.config.retryOptions.maxToLastCall != 0 && time.Now().Sub(startTime) > c.config.retryOptions.maxToLastCall {
+		if c.config.retryOptions.maxToLastCall != 0 && time.Since(startTime) > c.config.retryOptions.maxToLastCall {
 			break
 		}
 
diff --git a/api/search.go b/api/search.go
index a06ee1646..3983fe148 100644
--- a/api/search.go
+++ b/api/search.go
@@ -64,7 +64,8 @@ func (s *Search) FuzzySearch(text string, context contexts.Context, q *QueryOpti
 // ID.
 //
 // e.g. A Task-level service would have scope like,
-//   ["<namespace>", "<job>", "<group>", "<task>"]
+//
+//	["<namespace>", "<job>", "<group>", "<task>"]
 type FuzzyMatch struct {
 	ID    string   // ID is UUID or Name of object
 	Scope []string `json:",omitempty"` // IDs of parent objects
diff --git a/api/tasks.go b/api/tasks.go
index ea448d8c2..33382b117 100644
--- a/api/tasks.go
+++ b/api/tasks.go
@@ -195,7 +195,7 @@ func NewAffinity(lTarget string, operand string, rTarget string, weight int8) *A
 		LTarget: lTarget,
 		RTarget: rTarget,
 		Operand: operand,
-		Weight:  pointerOf(int8(weight)),
+		Weight:  pointerOf(weight),
 	}
 }
 
@@ -301,7 +301,7 @@ func NewSpreadTarget(value string, percent uint8) *SpreadTarget {
 func NewSpread(attribute string, weight int8, spreadTargets []*SpreadTarget) *Spread {
 	return &Spread{
 		Attribute:    attribute,
-		Weight:       pointerOf(int8(weight)),
+		Weight:       pointerOf(weight),
 		SpreadTarget: spreadTargets,
 	}
 }
diff --git a/api/variables.go b/api/variables.go
index ccdfdfe44..0c35d30d2 100644
--- a/api/variables.go
+++ b/api/variables.go
@@ -235,8 +235,8 @@ func (vars *Variables) readInternal(endpoint string, out **Variable, q *QueryOpt
 	}
 	r.setQueryOptions(q)
 
-	checkFn := requireStatusIn(http.StatusOK, http.StatusNotFound, http.StatusForbidden)
-	rtt, resp, err := checkFn(vars.client.doRequest(r))
+	checkFn := requireStatusIn(http.StatusOK, http.StatusNotFound, http.StatusForbidden) //nolint:bodyclose
+	rtt, resp, err := checkFn(vars.client.doRequest(r))                                  //nolint:bodyclose
 	if err != nil {
 		return nil, err
 	}
@@ -284,12 +284,12 @@ func (vars *Variables) deleteInternal(path string, q *WriteOptions) (*WriteMeta,
 	}
 	r.setWriteOptions(q)
 
-	checkFn := requireStatusIn(http.StatusOK, http.StatusNoContent)
-	rtt, resp, err := checkFn(vars.client.doRequest(r))
-
+	checkFn := requireStatusIn(http.StatusOK, http.StatusNoContent) //nolint:bodyclose
+	rtt, resp, err := checkFn(vars.client.doRequest(r))             //nolint:bodyclose
 	if err != nil {
 		return nil, err
 	}
+	defer resp.Body.Close()
 
 	wm := &WriteMeta{RequestTime: rtt}
 	_ = parseWriteMeta(resp, wm)
@@ -305,11 +305,12 @@ func (vars *Variables) deleteChecked(path string, checkIndex uint64, q *WriteOpt
 		return nil, err
 	}
 	r.setWriteOptions(q)
-	checkFn := requireStatusIn(http.StatusOK, http.StatusNoContent, http.StatusConflict)
-	rtt, resp, err := checkFn(vars.client.doRequest(r))
+	checkFn := requireStatusIn(http.StatusOK, http.StatusNoContent, http.StatusConflict) //nolint:bodyclose
+	rtt, resp, err := checkFn(vars.client.doRequest(r))                                  //nolint:bodyclose
 	if err != nil {
 		return nil, err
 	}
+	defer resp.Body.Close()
 
 	wm := &WriteMeta{RequestTime: rtt}
 	_ = parseWriteMeta(resp, wm)
@@ -341,8 +342,8 @@ func (vars *Variables) writeChecked(endpoint string, in *Variable, out *Variable
 	r.setWriteOptions(q)
 	r.obj = in
 
-	checkFn := requireStatusIn(http.StatusOK, http.StatusNoContent, http.StatusConflict)
-	rtt, resp, err := checkFn(vars.client.doRequest(r))
+	checkFn := requireStatusIn(http.StatusOK, http.StatusNoContent, http.StatusConflict) //nolint:bodyclose
+	rtt, resp, err := checkFn(vars.client.doRequest(r))                                  //nolint:bodyclose
 
 	if err != nil {
 		return nil, err
diff --git a/drivers/shared/executor/procstats/list_default.go b/drivers/shared/executor/procstats/list_default.go
index e95599125..2b152934d 100644
--- a/drivers/shared/executor/procstats/list_default.go
+++ b/drivers/shared/executor/procstats/list_default.go
@@ -32,7 +32,7 @@ func List(executorPID int) *set.Set[ProcessID] {
 		nextPPID := stack.Pop()
 		result.Insert(ProcessID(nextPPID))
 
-		p, err := process.NewProcessWithContext(ctx, int32(nextPPID))
+		p, err := process.NewProcessWithContext(ctx, nextPPID)
 		if err != nil {
 			continue
 		}