diff --git a/.golangci.yml b/.golangci.yml
index 0feee5e5d..33cd7411b 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -10,6 +10,7 @@ linters:
     - errorlint
     - gocritic
     - godox
+    - gofumpt
     - goimports
     - goprintffuncname
     - gosimple
@@ -36,3 +37,6 @@ linters-settings:
   godox:
     keywords:
       - FIXME
+  gofumpt:
+    module-path: github.com/simplesurance/baur/v5
+    extra-rules: true
diff --git a/internal/command/diff_inputs_test.go b/internal/command/diff_inputs_test.go
index f333cb331..7026fc0d9 100644
--- a/internal/command/diff_inputs_test.go
+++ b/internal/command/diff_inputs_test.go
@@ -15,13 +15,15 @@ import (
 	"github.com/simplesurance/baur/v5/internal/testutils/repotest"
 )
 
-var appOneName = "app-one"
-var appTwoName = "app-two"
-var buildTaskName = "build"
-var testTaskName = "test"
-var appOneWithBuildTask = fmt.Sprintf("%s.%s", appOneName, buildTaskName)
-var appOneWithTestTask = fmt.Sprintf("%s.%s", appOneName, testTaskName)
-var appTwoWithBuildTask = fmt.Sprintf("%s.%s", appTwoName, buildTaskName)
+var (
+	appOneName          = "app-one"
+	appTwoName          = "app-two"
+	buildTaskName       = "build"
+	testTaskName        = "test"
+	appOneWithBuildTask = fmt.Sprintf("%s.%s", appOneName, buildTaskName)
+	appOneWithTestTask  = fmt.Sprintf("%s.%s", appOneName, testTaskName)
+	appTwoWithBuildTask = fmt.Sprintf("%s.%s", appTwoName, buildTaskName)
+)
 
 func doInitDb(t *testing.T) {
 	t.Helper()
diff --git a/internal/command/helpers.go b/internal/command/helpers.go
index 9bcfdeb90..0ec74cb7c 100644
--- a/internal/command/helpers.go
+++ b/internal/command/helpers.go
@@ -202,7 +202,6 @@ func mustNewCompatibleStorage(uri string) storage.Storer {
 			fatal("baur postgresql database not found\n" +
 				" - ensure that the postgresql URL is correct,\n" +
 				" - run 'baur init db' to create the database and schema")
-
 		}
 		clt.Close()
 		exitOnErr(err)
@@ -315,7 +314,7 @@ func mustTaskRepoRelPath(repositoryDir string, task *baur.Task) string {
 	return path
 }
 
-func subStr(input string, start int, length int) string {
+func subStr(input string, start, length int) string {
 	asRunes := []rune(input)
 
 	if start >= len(asRunes) {
diff --git a/internal/command/ls_apps.go b/internal/command/ls_apps.go
index c71f1b3e6..cc7adeb66 100644
--- a/internal/command/ls_apps.go
+++ b/internal/command/ls_apps.go
@@ -80,7 +80,6 @@ func newLsAppsCmd() *lsAppsCmd {
 	}
 
 	return &cmd
-
 }
 
 func (c *lsAppsCmd) createHeader() []string {
diff --git a/internal/command/ls_runs.go b/internal/command/ls_runs.go
index 717542cd8..24200f9dd 100644
--- a/internal/command/ls_runs.go
+++ b/internal/command/ls_runs.go
@@ -172,7 +172,6 @@ func (c *lsRunsCmd) run(_ *cobra.Command, args []string) {
 			return nil
 		},
 	)
-
 	if err != nil {
 		if errors.Is(err, storage.ErrNotExist) {
 			stderr.Println("no matching task runs exist")
@@ -253,7 +252,6 @@ func (c *lsRunsCmd) getFilters() []*storage.Filter {
 	}
 
 	if c.input != "" {
-
 		if strings.HasPrefix(c.input, "string:") {
 			filters = append(filters, &storage.Filter{
 				Field:    storage.FieldInputString,
@@ -267,7 +265,6 @@ func (c *lsRunsCmd) getFilters() []*storage.Filter {
 				Value:    c.input,
 			})
 		}
-
 	}
 
 	return filters
diff --git a/internal/command/root.go b/internal/command/root.go
index ea5be8225..b66320fd7 100644
--- a/internal/command/root.go
+++ b/internal/command/root.go
@@ -22,17 +22,21 @@ var rootCmd = &cobra.Command{
 	PersistentPreRun: initSb,
 }
 
-var verboseFlag bool
-var cpuProfilingFlag bool
-var noColorFlag bool
-var repositoryPath string
+var (
+	verboseFlag      bool
+	cpuProfilingFlag bool
+	noColorFlag      bool
+	repositoryPath   string
+)
 
 var defCPUProfFile = filepath.Join(os.TempDir(), "baur-cpu.prof")
 
 var ctx = context.Background()
 
-var stdout = term.NewStream(os.Stdout)
-var stderr = term.NewStream(os.Stderr)
+var (
+	stdout = term.NewStream(os.Stdout)
+	stderr = term.NewStream(os.Stderr)
+)
 
 var exitFunc = func(code int) { os.Exit(code) }
 
diff --git a/internal/command/run_test.go b/internal/command/run_test.go
index 6cf84b739..3580e251b 100644
--- a/internal/command/run_test.go
+++ b/internal/command/run_test.go
@@ -30,7 +30,7 @@ func TestRunSimultaneously(t *testing.T) {
 	// checkScript is exected by the tasks, it logs the start and end
 	// timestamp of the script to file.
 	// The test checks if all task start/endtimestamps are in the same period.
-	var checkScript = []byte(`#!/usr/bin/env bash
+	checkScript := []byte(`#!/usr/bin/env bash
 set -veu -o pipefail
 
 runtime_logfile="$1"
@@ -48,7 +48,7 @@ date +%s >> "$runtime_logfile"
 		err := os.WriteFile(
 			filepath.Join(r.Dir, fmt.Sprintf("checkscript%d.sh", i)),
 			checkScript,
-			0755,
+			0o755,
 		)
 		require.NoError(t, err)
 
@@ -129,13 +129,12 @@ func TestRunShowOutput(t *testing.T) {
 		scriptPath, []byte(`#/usr/bin/env bash
 echo "greetings from script.sh"
 	`),
-		0755)
+		0o755)
 	require.NoError(t, err)
 
 	appCfg := cfg.App{
 		Name: "testapp",
 		Tasks: cfg.Tasks{{
-
 			Name:    "build",
 			Command: []string{"bash", scriptPath},
 			Input: cfg.Input{
@@ -172,13 +171,12 @@ func TestRunShowOutputOnErrorOutputIsPrintedOnce(t *testing.T) {
 echo "I will fail!"
 exit 1
 	`),
-		0755)
+		0o755)
 	require.NoError(t, err)
 
 	appCfg := cfg.App{
 		Name: "testapp",
 		Tasks: cfg.Tasks{{
-
 			Name:    "build",
 			Command: []string{"bash", scriptPath},
 			Input: cfg.Input{
@@ -221,7 +219,7 @@ func createEnvVarTestApp(t *testing.T, appName, taskName string, envVarsCfg []cf
 		scriptPath, []byte(`#/usr/bin/env bash
 exit 0
 	`),
-		0755)
+		0o755)
 	require.NoError(t, err)
 	doInitDb(t)
 
@@ -286,7 +284,8 @@ func TestEnvVarInput_Required(t *testing.T) {
 			stdout, _ = interceptCmdOutput(t)
 			statusCmd := newStatusCmd()
 			statusCmd.SetArgs([]string{
-				"--format=csv", "-q", "-f", "run-id", fmt.Sprintf("%s.%s", appName, taskName)},
+				"--format=csv", "-q", "-f", "run-id", fmt.Sprintf("%s.%s", appName, taskName),
+			},
 			)
 			require.NoError(t, statusCmd.Execute())
 			runID := strings.TrimSpace(stdout.String())
diff --git a/internal/command/show_test.go b/internal/command/show_test.go
index 724816529..b0c061a4c 100644
--- a/internal/command/show_test.go
+++ b/internal/command/show_test.go
@@ -52,7 +52,6 @@ func TestShowArgs(t *testing.T) {
 
 		showCmd.Command.Run(&showCmd.Command, []string{"."})
 	})
-
 }
 
 func TestShowWithRepositoryArg(t *testing.T) {
diff --git a/internal/command/status.go b/internal/command/status.go
index c1c8b4bf0..98959d82d 100644
--- a/internal/command/status.go
+++ b/internal/command/status.go
@@ -142,6 +142,7 @@ func (c *statusCmd) statusCreateHeader() []string {
 
 	return headers
 }
+
 func (c *statusCmd) jsonFieldNames() []string {
 	headers := make([]string, 0, len(c.fields.Fields))
 
@@ -299,7 +300,6 @@ func (c *statusCmd) assembleRow(repositoryDir string, task *baur.Task, taskRun *
 				row = append(row, nil)
 			}
 		}
-
 	}
 	return row
 }
diff --git a/internal/command/status_test.go b/internal/command/status_test.go
index d69cca031..f3a5c20f0 100644
--- a/internal/command/status_test.go
+++ b/internal/command/status_test.go
@@ -151,7 +151,7 @@ func TestStatusTaskSpecArgParsing(t *testing.T) {
 			},
 			preRun: func(t *testing.T) {
 				childDir := filepath.Join(repoDir, "app3", uuid.New().String())
-				require.NoError(t, os.Mkdir(childDir, 0700))
+				require.NoError(t, os.Mkdir(childDir, 0o700))
 
 				t.Cleanup(func() {
 					require.NoError(t, os.RemoveAll(childDir))
diff --git a/internal/command/term/format.go b/internal/command/term/format.go
index f2f4fd7fb..0b83c2423 100644
--- a/internal/command/term/format.go
+++ b/internal/command/term/format.go
@@ -28,6 +28,7 @@ func evalOptions(opts []FormatOption) *fmtSettings {
 
 	return &s
 }
+
 func FormatSize(bytes uint64, opts ...FormatOption) string {
 	if evalOptions(opts).baseUnitWithoutUnitName {
 		return fmt.Sprint(bytes)
diff --git a/internal/command/upgrade_configs_test.go b/internal/command/upgrade_configs_test.go
index ab6c9da6f..3d4a13594 100644
--- a/internal/command/upgrade_configs_test.go
+++ b/internal/command/upgrade_configs_test.go
@@ -61,7 +61,6 @@ func TestUpgrade(t *testing.T) {
 			require.NoError(t, err)
 			require.EqualValues(t, repoCfg.Database, repoCfgLoaded.Database)
 			require.EqualValues(t, repoCfg.Discover, repoCfgLoaded.Discover)
-
 		})
 	}
 }
diff --git a/internal/digest/digest_test.go b/internal/digest/digest_test.go
index 116024dbd..bc301597e 100644
--- a/internal/digest/digest_test.go
+++ b/internal/digest/digest_test.go
@@ -19,5 +19,4 @@ func TestFromString(t *testing.T) {
 	if d.String() != shash {
 		t.Errorf("String() returned %q expected %q", d.String(), shash)
 	}
-
 }
diff --git a/internal/exec/command.go b/internal/exec/command.go
index 2694c76be..f9be145e8 100644
--- a/internal/exec/command.go
+++ b/internal/exec/command.go
@@ -15,8 +15,10 @@ import (
 	"github.com/fatih/color"
 )
 
-const maxErrOutputBytesPerStream = 16 * 1024
-const outputStreamLineReaderBufSiz = 512 * 1024
+const (
+	maxErrOutputBytesPerStream   = 16 * 1024
+	outputStreamLineReaderBufSiz = 512 * 1024
+)
 
 type PrintfFn func(format string, a ...any)
 
diff --git a/internal/exec/command_test.go b/internal/exec/command_test.go
index 2a40fd9ae..df0e65549 100644
--- a/internal/exec/command_test.go
+++ b/internal/exec/command_test.go
@@ -19,7 +19,6 @@ func TestCombinedStdoutOutput(t *testing.T) {
 	var err error
 	if runtime.GOOS == "windows" {
 		res, err = Command("bash", "-c", fmt.Sprintf("echo -n '%s'", echoStr)).RunCombinedOut(ctx)
-
 	} else {
 		res, err = Command("echo", "-n", echoStr).RunCombinedOut(ctx)
 	}
@@ -71,5 +70,4 @@ func TestOutputStream(t *testing.T) {
 		LogFn(func(f string, a ...any) { fmt.Fprintf(&buf, f, a...) }).ExpectSuccess().Run(ctx)
 	require.NoError(t, err)
 	require.Contains(t, buf.String(), echoStr)
-
 }
diff --git a/internal/exec/result.go b/internal/exec/result.go
index b6dacc67b..733e223a9 100644
--- a/internal/exec/result.go
+++ b/internal/exec/result.go
@@ -13,7 +13,7 @@ type ExitCodeError struct {
 
 type SprintFn func(...any) string
 
-func (e *ExitCodeError) ColoredError(highlightFn SprintFn, errorFn SprintFn, withCmdOutput bool) string {
+func (e *ExitCodeError) ColoredError(highlightFn, errorFn SprintFn, withCmdOutput bool) string {
 	var result strings.Builder
 	var stdoutExists bool
 
@@ -58,7 +58,6 @@ func (e *ExitCodeError) ColoredError(highlightFn SprintFn, errorFn SprintFn, wit
 // Error returns the error description.
 func (e *ExitCodeError) Error() string {
 	return e.ColoredError(fmt.Sprint, fmt.Sprint, true)
-
 }
 
 // Result describes the result of a run Cmd.
diff --git a/internal/fs/fileglob_test.go b/internal/fs/fileglob_test.go
index a03ccd63d..7a41ebf31 100644
--- a/internal/fs/fileglob_test.go
+++ b/internal/fs/fileglob_test.go
@@ -166,7 +166,6 @@ func Test_Resolve(t *testing.T) {
 
 		checkFilesInResolvedFiles(t, tempdir, resolvedFiles, tc)
 	}
-
 }
 
 func TestGlobMatch(t *testing.T) {
diff --git a/internal/fs/fs.go b/internal/fs/fs.go
index c2d6a5292..f3eab11a1 100644
--- a/internal/fs/fs.go
+++ b/internal/fs/fs.go
@@ -208,7 +208,7 @@ func FileSize(path string) (int64, error) {
 
 // Mkdir creates recursively directories
 func Mkdir(path string) error {
-	return os.MkdirAll(path, os.FileMode(0755))
+	return os.MkdirAll(path, os.FileMode(0o755))
 }
 
 // AbsPaths ensures that all elements in paths are absolute paths.
@@ -225,7 +225,7 @@ func AbsPaths(rootPath string, paths []string) []string {
 
 // AbsPath ensures that path is an absolute path.
 // If it isn't, it is joined with rootPath.
-func AbsPath(rootPath string, path string) string {
+func AbsPath(rootPath, path string) string {
 	if filepath.IsAbs(path) {
 		return path
 	}
diff --git a/internal/fs/fs_unix.go b/internal/fs/fs_unix.go
index 30869850c..5469b48e4 100644
--- a/internal/fs/fs_unix.go
+++ b/internal/fs/fs_unix.go
@@ -20,5 +20,5 @@ func FileHasOwnerExecPerm(p string) (bool, error) {
 
 // OwnerHasExecPerm returns true if the executable mode bit in m is set.
 func OwnerHasExecPerm(m fs.FileMode) bool {
-	return m&0100 == 0100
+	return m&0o100 == 0o100
 }
diff --git a/internal/output/docker/docker.go b/internal/output/docker/docker.go
index c6e461df5..3a86deebd 100644
--- a/internal/output/docker/docker.go
+++ b/internal/output/docker/docker.go
@@ -12,8 +12,10 @@ import (
 )
 
 // DefaultRegistry is the registry for that authentication data is used
-const DefaultRegistry = "https://index.docker.io/v1/"
-const dockerRegistryDefaultPort = "5000"
+const (
+	DefaultRegistry           = "https://index.docker.io/v1/"
+	dockerRegistryDefaultPort = "5000"
+)
 
 // Client is a docker client
 type Client struct {
diff --git a/internal/output/filecopy/filecopy.go b/internal/output/filecopy/filecopy.go
index 7aab0acce..8368e6a5e 100644
--- a/internal/output/filecopy/filecopy.go
+++ b/internal/output/filecopy/filecopy.go
@@ -60,7 +60,7 @@ func copyFile(src, dst string) error {
 // If the destination directory does not exist, it is created.
 // If the destination path exist and is not a regular file an error is returned.
 // If it exists, is a file and it differs the file is overwritten.
-func (c *Client) Upload(src string, dst string) (string, error) {
+func (c *Client) Upload(src, dst string) (string, error) {
 	destDir := filepath.Dir(dst)
 
 	isDir, err := fs.IsDir(destDir)
diff --git a/internal/output/s3/s3.go b/internal/output/s3/s3.go
index 62f68053b..c200e1cd6 100644
--- a/internal/output/s3/s3.go
+++ b/internal/output/s3/s3.go
@@ -89,7 +89,7 @@ func (c *Client) Upload(filepath, bucket, key string) (string, error) {
 }
 
 func (c *Client) Download(ctx context.Context, bucket, key, filepath string) error {
-	f, err := os.OpenFile(filepath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0640)
+	f, err := os.OpenFile(filepath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o640)
 	if err != nil {
 		return err
 	}
diff --git a/internal/resolve/gosource/gosource.go b/internal/resolve/gosource/gosource.go
index 93c6e2055..8d51e4a22 100644
--- a/internal/resolve/gosource/gosource.go
+++ b/internal/resolve/gosource/gosource.go
@@ -13,8 +13,10 @@ import (
 	"github.com/simplesurance/baur/v5/internal/fs"
 )
 
-const globQueryPrefix = "fileglob="
-const fileQueryPrefix = "file="
+const (
+	globQueryPrefix = "fileglob="
+	fileQueryPrefix = "file="
+)
 
 var defLogFn = func(string, ...any) {}
 
diff --git a/internal/routines/pool_test.go b/internal/routines/pool_test.go
index 4bbeaa4b6..b00fd52b4 100644
--- a/internal/routines/pool_test.go
+++ b/internal/routines/pool_test.go
@@ -26,7 +26,6 @@ func TestScheduleAndWait(t *testing.T) {
 	for i := range workDone {
 		assert.Equal(t, int32(1), atomic.LoadInt32(&workDone[i]), "work %d not done", i)
 	}
-
 }
 
 func TestQueuePanicsAfterWait(t *testing.T) {
diff --git a/internal/testutils/fstest/fstest.go b/internal/testutils/fstest/fstest.go
index c87fb2fb3..f94e314bf 100644
--- a/internal/testutils/fstest/fstest.go
+++ b/internal/testutils/fstest/fstest.go
@@ -14,7 +14,7 @@ import (
 // If an error happens, t.Fatal() is called.
 func WriteExecutable(t *testing.T, data []byte, path string) {
 	t.Helper()
-	writeToFile(t, data, path, 0755)
+	writeToFile(t, data, path, 0o755)
 }
 
 // WriteToFile writes data to a file.
@@ -22,7 +22,7 @@ func WriteExecutable(t *testing.T, data []byte, path string) {
 // If an error happens, t.Fatal() is called.
 func WriteToFile(t *testing.T, data []byte, path string) {
 	t.Helper()
-	writeToFile(t, data, path, 0644)
+	writeToFile(t, data, path, 0o644)
 }
 
 func writeToFile(t *testing.T, data []byte, path string, perm fs.FileMode) {
@@ -37,7 +37,7 @@ func writeToFile(t *testing.T, data []byte, path string, perm fs.FileMode) {
 }
 
 func MkdirAll(t *testing.T, path string) {
-	err := os.MkdirAll(path, 0775)
+	err := os.MkdirAll(path, 0o775)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/internal/testutils/repotest/repotest.go b/internal/testutils/repotest/repotest.go
index 9eb6b751c..ac4494377 100644
--- a/internal/testutils/repotest/repotest.go
+++ b/internal/testutils/repotest/repotest.go
@@ -29,7 +29,7 @@ func (r *Repo) CreateAppWithoutTasks(t *testing.T) *cfg.App {
 
 	appDir := filepath.Join(r.Dir, appName)
 
-	if err := os.Mkdir(appDir, 0775); err != nil {
+	if err := os.Mkdir(appDir, 0o775); err != nil {
 		t.Fatal(err)
 	}
 
@@ -107,7 +107,7 @@ func (r *Repo) CreateSimpleApp(t *testing.T) *cfg.App {
 
 	appDir := filepath.Join(r.Dir, appName)
 
-	if err := os.Mkdir(appDir, 0775); err != nil {
+	if err := os.Mkdir(appDir, 0o775); err != nil {
 		t.Fatal(err)
 	}
 
@@ -190,7 +190,7 @@ func (r *Repo) CreateAppWithNoOutputs(t *testing.T, appName string) *cfg.App {
 
 	appDir := filepath.Join(r.Dir, appName)
 
-	if err := os.Mkdir(appDir, 0775); err != nil {
+	if err := os.Mkdir(appDir, 0o775); err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/internal/version/version_test.go b/internal/version/version_test.go
index 08347489a..ef49a1d41 100644
--- a/internal/version/version_test.go
+++ b/internal/version/version_test.go
@@ -11,7 +11,6 @@ func TestSemVerFromString(t *testing.T) {
 		want    *SemVer
 		wantErr bool
 	}{
-
 		{
 			arg:     "",
 			wantErr: true,
diff --git a/pkg/baur/app.go b/pkg/baur/app.go
index ddd4f9afc..59b4037b7 100644
--- a/pkg/baur/app.go
+++ b/pkg/baur/app.go
@@ -46,7 +46,7 @@ func (a *App) String() string {
 
 // SortAppsByName sorts the slice by application names.
 func SortAppsByName(apps []*App) {
-	sort.Slice(apps, func(i int, j int) bool {
+	sort.Slice(apps, func(i, j int) bool {
 		return apps[i].Name < apps[j].Name
 	})
 }
diff --git a/pkg/baur/inputresolver_test.go b/pkg/baur/inputresolver_test.go
index ff73283b3..c59798f07 100644
--- a/pkg/baur/inputresolver_test.go
+++ b/pkg/baur/inputresolver_test.go
@@ -298,7 +298,6 @@ func TestFilesOptional(t *testing.T) {
 						found = true
 						break
 					}
-
 				}
 
 				assert.True(t, found, "%s missing in result", f)
@@ -478,7 +477,6 @@ func TestResolveEnvVarInputs(t *testing.T) {
 			require.EqualValues(t, tc.ExpectedResolvedEnvVars, resolvedEnvVars)
 		})
 	}
-
 }
 
 func TestExcludedFiles(t *testing.T) {
diff --git a/pkg/baur/inputresolver_unix_test.go b/pkg/baur/inputresolver_unix_test.go
index d0390984d..36a4716ad 100644
--- a/pkg/baur/inputresolver_unix_test.go
+++ b/pkg/baur/inputresolver_unix_test.go
@@ -22,7 +22,7 @@ func TestSymlinkTargetFilePermissionsChange(t *testing.T) {
 				exec.DefaultLogFn = t.Logf
 				log.RedirectToTestingLog(t)
 				info := prepareSymlinkTestDir(t, tc.AddToGitBeforeChange)
-				require.NoError(t, os.Chmod(info.SymlinkTargetFilePath, 0755))
+				require.NoError(t, os.Chmod(info.SymlinkTargetFilePath, 0o755))
 				if tc.AddToGitAfterChange {
 					gittest.CommitFilesToGit(t, info.TempDir)
 				}
diff --git a/pkg/baur/loader.go b/pkg/baur/loader.go
index a921147b4..64c832ddc 100644
--- a/pkg/baur/loader.go
+++ b/pkg/baur/loader.go
@@ -181,7 +181,6 @@ func (a *Loader) allApps() ([]*App, error) {
 				AppPath1: a.cfg.FilePath(),
 				AppPath2: app.cfg.FilePath(),
 			}
-
 		}
 		apps[app.Name] = app
 	}
diff --git a/pkg/baur/task.go b/pkg/baur/task.go
index 72fbe909a..bd1f9fc73 100644
--- a/pkg/baur/task.go
+++ b/pkg/baur/task.go
@@ -83,7 +83,7 @@ func (t *Task) HasOutputs() bool {
 
 // SortTasksByID sorts the tasks slice by task IDs.
 func SortTasksByID(tasks []*Task) {
-	sort.Slice(tasks, func(i int, j int) bool {
+	sort.Slice(tasks, func(i, j int) bool {
 		return tasks[i].ID < tasks[j].ID
 	})
 }
diff --git a/pkg/baur/taskrunner.go b/pkg/baur/taskrunner.go
index b923d3825..4d6519cc9 100644
--- a/pkg/baur/taskrunner.go
+++ b/pkg/baur/taskrunner.go
@@ -61,7 +61,6 @@ func (t *TaskRunner) deleteTmpFiles(paths []string) {
 			t.LogFn("deleting temporary task info file %q failed: %s\n", path, err)
 		}
 	}
-
 }
 
 func (t *TaskRunner) createTaskInfoEnv(ctx context.Context, task *Task) ([]string, func(), error) {
diff --git a/pkg/baur/uploader.go b/pkg/baur/uploader.go
index bfc92b076..96d1b9d31 100644
--- a/pkg/baur/uploader.go
+++ b/pkg/baur/uploader.go
@@ -20,7 +20,7 @@ type DockerImgUploader interface {
 
 // FileCopyUploader is an interface for copying files from one directory to another.
 type FileCopyUploader interface {
-	Upload(src string, dst string) (string, error)
+	Upload(src, dst string) (string, error)
 }
 
 // Uploader uploads outputs, produced by task run, to remote locations.
diff --git a/pkg/cfg/cfg.go b/pkg/cfg/cfg.go
index 48f9d816f..5497f7ace 100644
--- a/pkg/cfg/cfg.go
+++ b/pkg/cfg/cfg.go
@@ -51,7 +51,7 @@ func toFile(data any, filepath string, opts ...toFileOpt) error {
 		return err
 	}
 
-	f, err := os.OpenFile(filepath, fileOpenFlags(settings.overwrite), 0640)
+	f, err := os.OpenFile(filepath, fileOpenFlags(settings.overwrite), 0o640)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/cfg/fileignorelist.go b/pkg/cfg/fileignorelist.go
index 1f48304fe..90c88f706 100644
--- a/pkg/cfg/fileignorelist.go
+++ b/pkg/cfg/fileignorelist.go
@@ -9,7 +9,6 @@ func (f *FileExcludeList) Validate() error {
 	for _, path := range f.Paths {
 		if len(path) == 0 {
 			return newFieldError("can not be empty", "path")
-
 		}
 	}
 
diff --git a/pkg/cfg/fileinputs.go b/pkg/cfg/fileinputs.go
index 0ccb8db05..38af8c669 100644
--- a/pkg/cfg/fileinputs.go
+++ b/pkg/cfg/fileinputs.go
@@ -27,7 +27,6 @@ func (f *FileInputs) validate() error {
 	for _, path := range f.Paths {
 		if len(path) == 0 {
 			return newFieldError("can not be empty", "path")
-
 		}
 	}
 
diff --git a/pkg/cfg/include.go b/pkg/cfg/include.go
index 09b31de09..5656a7182 100644
--- a/pkg/cfg/include.go
+++ b/pkg/cfg/include.go
@@ -108,7 +108,6 @@ func (incl *Include) validateUniqIncludeIDs() error {
 	}
 
 	return nil
-
 }
 
 // ExampleInclude returns an Include struct with exemplary values.
diff --git a/pkg/cfg/includedb.go b/pkg/cfg/includedb.go
index 47362fd1e..cb96359fc 100644
--- a/pkg/cfg/includedb.go
+++ b/pkg/cfg/includedb.go
@@ -27,7 +27,6 @@ var ErrIncludeIDNotFound = errors.New("id not found in include file")
 func NewIncludeDB(logf LogFn) *IncludeDB {
 	if logf == nil {
 		logf = func(_ string, _ ...any) {}
-
 	}
 	return &IncludeDB{
 		inputs:  map[string]map[string]*InputInclude{},
@@ -138,7 +137,6 @@ func (db *IncludeDB) loadOutputInclude(resolver Resolver, workingDir, includeSpe
 	}
 
 	return include, nil
-
 }
 
 // parseIncludeSpec splits the includeSpecifier to an absolute path and an include ID.
diff --git a/pkg/cfg/includedb_test.go b/pkg/cfg/includedb_test.go
index c01f6853d..16ebcd462 100644
--- a/pkg/cfg/includedb_test.go
+++ b/pkg/cfg/includedb_test.go
@@ -14,8 +14,7 @@ import (
 	"github.com/simplesurance/baur/v5/pkg/cfg/resolver"
 )
 
-type mockResolver struct {
-}
+type mockResolver struct{}
 
 func (m *mockResolver) Resolve(in string) (string, error) {
 	return in, nil
@@ -191,8 +190,8 @@ func TestLoadTaskIncludeWithIncludesInDifferentFiles(t *testing.T) {
 
 	tmpdir := t.TempDir()
 
-	require.NoError(t, os.MkdirAll(filepath.Join(tmpdir, inputInclDir), 0775))
-	require.NoError(t, os.MkdirAll(filepath.Join(tmpdir, outputInclDir), 0775))
+	require.NoError(t, os.MkdirAll(filepath.Join(tmpdir, inputInclDir), 0o775))
+	require.NoError(t, os.MkdirAll(filepath.Join(tmpdir, outputInclDir), 0o775))
 
 	absInputInclFilepath := filepath.Join(tmpdir, inputInclFilename)
 	cfgToFile(t, inputIncl, absInputInclFilepath)
@@ -244,7 +243,7 @@ func TestIncludePathsAreRelativeToCfg(t *testing.T) {
 
 	tmpdir := t.TempDir()
 
-	require.NoError(t, os.MkdirAll(filepath.Join(tmpdir, inputInclDirName), 0775))
+	require.NoError(t, os.MkdirAll(filepath.Join(tmpdir, inputInclDirName), 0o775))
 
 	cfgToFile(t, inputIncl, filepath.Join(tmpdir, "subdir", inputInclFilename))
 	cfgToFile(t, taskIncl, filepath.Join(tmpdir, taskInclFilename))
@@ -323,7 +322,6 @@ func TestEnsureInputIncludeIDsMustBeUnique(t *testing.T) {
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "unique")
 	require.Nil(t, loadedIncl)
-
 }
 
 func TestEnsureOutputIncludeIDsMustBeUnique(t *testing.T) {
@@ -530,7 +528,6 @@ func TestTaskInclude(t *testing.T) {
 					assert.Contains(t, loadedTask.Output.File, fileOutput)
 				}
 			}
-
 		})
 	}
 }
@@ -677,9 +674,10 @@ func TestVarsInIncludeFiles(t *testing.T) {
 				File: []FileOutput{
 					{
 						Path: "{{ .AppName }}",
-						FileCopy: []FileCopy{{
-							Path: "/tmp/f",
-						},
+						FileCopy: []FileCopy{
+							{
+								Path: "/tmp/f",
+							},
 						},
 					},
 				},
diff --git a/pkg/cfg/task.go b/pkg/cfg/task.go
index 20368a9e2..8641a8246 100644
--- a/pkg/cfg/task.go
+++ b/pkg/cfg/task.go
@@ -36,6 +36,7 @@ func (t *Task) Filepaths() []string {
 func (t *Task) command() []string {
 	return t.Command
 }
+
 func (t *Task) name() string {
 	return t.Name
 }
diff --git a/pkg/storage/postgres/insert.go b/pkg/storage/postgres/insert.go
index 4c2a4f55e..47f75de20 100644
--- a/pkg/storage/postgres/insert.go
+++ b/pkg/storage/postgres/insert.go
@@ -450,7 +450,6 @@ func insertTaskRunInputTasksIfNotExist(ctx context.Context, db dbConn, taskRunID
 	}
 
 	return nil
-
 }
 
 func clonedSortedInputEnvVars(inputs []*storage.InputEnvVar) []*storage.InputEnvVar {
diff --git a/pkg/storage/postgres/query.go b/pkg/storage/postgres/query.go
index b79b6b102..cffc9fefb 100644
--- a/pkg/storage/postgres/query.go
+++ b/pkg/storage/postgres/query.go
@@ -28,7 +28,6 @@ func (c *Client) TaskRun(ctx context.Context, id int) (*storage.TaskRunWithID, e
 
 		return nil
 	})
-
 	if err != nil {
 		return nil, err
 	}
@@ -125,7 +124,6 @@ func (c *Client) inputStrings(ctx context.Context, taskRunID int) ([]*storage.In
 	}
 
 	return result, nil
-
 }
 
 func (c *Client) inputFiles(ctx context.Context, taskRunID int) ([]*storage.InputFile, error) {
@@ -444,7 +442,6 @@ func (c *Client) TaskRuns(
 			&taskRun.StopTimestamp,
 			&taskRun.Result,
 		)
-
 		if err != nil {
 			rows.Close()
 			return fmt.Errorf("query %s with args: %s failed: %w", query, strArgList(args), err)
diff --git a/pkg/storage/postgres/query_test.go b/pkg/storage/postgres/query_test.go
index 605d0e69d..1b55fd6d6 100644
--- a/pkg/storage/postgres/query_test.go
+++ b/pkg/storage/postgres/query_test.go
@@ -568,7 +568,6 @@ func TestTaskRuns(t *testing.T) {
 			assert.ElementsMatch(t, testcase.expectedTaskRuns, result)
 		})
 	}
-
 }
 
 func TestTaskRunQueryRunWithoutOutputWithoutVCS(t *testing.T) {