diff --git a/pkg/client/clientimplementation/daemonclient/client.go b/pkg/client/clientimplementation/daemonclient/client.go
index c82733e1b..f19411396 100644
--- a/pkg/client/clientimplementation/daemonclient/client.go
+++ b/pkg/client/clientimplementation/daemonclient/client.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"math"
 	"net"
 	"net/netip"
 	"strconv"
@@ -180,6 +181,10 @@ func (c *client) SSHClients(
 			return nil, fmt.Errorf("invalid port: %s", addressParts[1])
 		}
 
+		if port < 0 || port > math.MaxUint16 {
+			return nil, fmt.Errorf("invalid port: %s", addressParts[1])
+		}
+
 		return c.tsClient.DialTCP(ctx, addressParts[0], uint16(port))
 	}
 
@@ -200,6 +205,7 @@ func (c *client) DirectTunnel(ctx context.Context, stdin io.Reader, stdout io.Wr
 	if err != nil {
 		return fmt.Errorf("resolve workspace hostname: %w", err)
 	}
+	//nolint:gosec // G115: fixed default SSH port
 	conn, err := c.tsClient.DialTCP(ctx, wAddr.Host(), uint16(wAddr.Port()))
 	if err != nil {
 		return fmt.Errorf("failed to connect to SSH server in proxy mode: %w", err)
diff --git a/pkg/command/credential_supported.go b/pkg/command/credential_supported.go
index c973211a6..0c3b83b71 100644
--- a/pkg/command/credential_supported.go
+++ b/pkg/command/credential_supported.go
@@ -28,7 +28,7 @@ func ForUser(cmd *exec.Cmd, userName string) error {
 	}
 
 	// Set the user cmd should run as
-	cmd.SysProcAttr = &syscall.SysProcAttr{}
+	//nolint:gosec // G115: uid/gid from user lookup fit uint32
 	cmd.SysProcAttr.Credential = &syscall.Credential{Uid: uint32(uid), Gid: uint32(gid)}
 
 	return nil
diff --git a/pkg/devcontainer/config/prepareprobe.go b/pkg/devcontainer/config/prepareprobe.go
index 18edce790..c4a7b0b28 100644
--- a/pkg/devcontainer/config/prepareprobe.go
+++ b/pkg/devcontainer/config/prepareprobe.go
@@ -28,8 +28,8 @@ func PrepareCmdUser(cmd *exec.Cmd, userName string) error {
 
 	cmd.SysProcAttr = &syscall.SysProcAttr{
 		Credential: &syscall.Credential{
-			Uid: uint32(uid),
-			Gid: uint32(gid),
+			Uid: uint32(uid), //nolint:gosec // G115: uid from user lookup fits uint32
+			Gid: uint32(gid), //nolint:gosec // G115: gid from user lookup fits uint32
 		},
 	}
 
diff --git a/pkg/extract/compress.go b/pkg/extract/compress.go
index 60e9db60f..d021a7316 100644
--- a/pkg/extract/compress.go
+++ b/pkg/extract/compress.go
@@ -135,7 +135,9 @@ func (a *Archiver) tarFolder(target string, targetStat os.FileInfo) error {
 		hdr, _ := tar.FileInfoHeader(targetStat, filePath)
 		hdr.Uid = 0
 		hdr.Gid = 0
-		hdr.Mode = fillGo18FileTypeBits(int64(chmodTarEntry(os.FileMode(hdr.Mode))), targetStat)
+		//nolint:gosec // G115: tar header mode bits fit os.FileMode
+		fileMode := os.FileMode(hdr.Mode)
+		hdr.Mode = fillGo18FileTypeBits(int64(chmodTarEntry(fileMode)), targetStat)
 		hdr.Name = target
 		if err := a.writer.WriteHeader(hdr); err != nil {
 			return fmt.Errorf("tar write header: %w", err)
@@ -177,7 +179,9 @@ func (a *Archiver) tarFile(target string, targetStat os.FileInfo) error {
 	hdr.Name = target
 	hdr.Uid = 0
 	hdr.Gid = 0
-	hdr.Mode = fillGo18FileTypeBits(int64(chmodTarEntry(os.FileMode(hdr.Mode))), targetStat)
+	//nolint:gosec // G115: tar header mode bits fit os.FileMode
+	fileMode := os.FileMode(hdr.Mode)
+	hdr.Mode = fillGo18FileTypeBits(int64(chmodTarEntry(fileMode)), targetStat)
 	hdr.ModTime = time.Unix(targetStat.ModTime().Unix(), 0)
 
 	if err := a.writer.WriteHeader(hdr); err != nil {
diff --git a/pkg/platform/client/client.go b/pkg/platform/client/client.go
index e02516b64..6f5e866bb 100644
--- a/pkg/platform/client/client.go
+++ b/pkg/platform/client/client.go
@@ -440,7 +440,7 @@ func VerifyVersion(baseClient Client) error {
 		return nil
 	}
 
-	backendMajor, err := strconv.Atoi(v.Major)
+	backendMajor, err := strconv.ParseUint(v.Major, 10, 64)
 	if err != nil {
 		return fmt.Errorf("parse major version string: %w", err)
 	}
@@ -456,7 +456,7 @@ func VerifyVersion(baseClient Client) error {
 		return err
 	}
 
-	if int(cliVersion.Major) > backendMajor {
+	if cliVersion.Major > backendMajor {
 		return fmt.Errorf(
 			"unsupported %[1]s version %[2]s. Downgrade your CLI to below v%[3]d.0.0 to support this version, "+
 				"as %[1]s v%[3]d.0.0 and newer versions are incompatible with v%[4]d.x.x",
@@ -465,7 +465,7 @@ func VerifyVersion(baseClient Client) error {
 			cliVersion.Major,
 			backendMajor,
 		)
-	} else if int(cliVersion.Major) < backendMajor {
+	} else if cliVersion.Major < backendMajor {
 		return fmt.Errorf(
 			"unsupported %[1]s version %[2]s. Upgrade your CLI to v%[3]d.0.0 or above to support this version, "+
 				"as %[1]s v%[3]d.0.0 and newer versions are incompatible with v%[4]d.x.x",
diff --git a/pkg/ts/util.go b/pkg/ts/util.go
index bc148846c..1152a94b2 100644
--- a/pkg/ts/util.go
+++ b/pkg/ts/util.go
@@ -62,6 +62,7 @@ func WaitHostReachable(
 	for i := range maxRetries {
 		timeoutCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
 		defer cancel()
+		//nolint:gosec // G115: fixed workspace SSH port
 		conn, err := lc.DialTCP(timeoutCtx, addr.Host(), uint16(addr.Port()))
 		if err == nil {
 			_ = conn.Close()