diff --git a/.goreleaser.yml b/.goreleaser.yml
index 0868ed5..8049f24 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -95,7 +95,6 @@ builds:
 
 archives:
   - id: step-kms-plugin
-    rlcp: true
     name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}{{ if .Mips }}_{{ .Mips }}{{ end }}"
     format_overrides:
       - goos: windows
diff --git a/Makefile b/Makefile
index 985d687..f439605 100644
--- a/Makefile
+++ b/Makefile
@@ -94,12 +94,16 @@ test:
 fmt:
 	$Q goimports --local github.com/smallstep/step-kms-plugin  -l -w $(SRC)
 
-lint: SHELL:=/bin/bash
-lint:
+lint: golint govulncheck
+
+golint: SHELL:=/bin/bash
+golint:
 	$Q LOG_LEVEL=error golangci-lint run --config <(curl -s https://raw.githubusercontent.com/smallstep/workflows/master/.golangci.yml) --timeout=30m
+
+govulncheck:
 	$Q govulncheck ./...
 
-.PHONY: fmt lint
+.PHONY: fmt lint golint govulncheck
 
 #########################################
 # Release
@@ -120,7 +124,7 @@ release-dry-run:
 		-v `pwd`:/go/src/$(PKG) \
 		-w /go/src/$(PKG) \
 		ghcr.io/goreleaser/goreleaser-cross:${GOLANG_CROSS_VERSION} \
-		--clean --skip-validate --skip-publish
+		--clean --skip=validate --skip=publish
 
 release:
 	@if [ ! -f ".release-env" ]; then \
diff --git a/cmd/certificate.go b/cmd/certificate.go
index bcd3707..4d9157a 100644
--- a/cmd/certificate.go
+++ b/cmd/certificate.go
@@ -63,7 +63,7 @@ var certificateCmd = &cobra.Command{
 		certFile := flagutil.MustString(flags, "import")
 		bundle := flagutil.MustBool(flags, "bundle")
 
-		kuri, name, err := getUriAndNameForFS(flagutil.MustString(flags, "kms"), args[0])
+		kuri, name, err := getURIAndNameForFS(flagutil.MustString(flags, "kms"), args[0])
 		if err != nil {
 			return err
 		}
diff --git a/cmd/key.go b/cmd/key.go
index cd28487..f95a558 100644
--- a/cmd/key.go
+++ b/cmd/key.go
@@ -79,7 +79,7 @@ var keyCmd = &cobra.Command{
 
 		flags := cmd.Flags()
 
-		kuri, name, err := getUriAndNameForFS(flagutil.MustString(flags, "kms"), args[0])
+		kuri, name, err := getURIAndNameForFS(flagutil.MustString(flags, "kms"), args[0])
 		if err != nil {
 			return err
 		}
diff --git a/cmd/root.go b/cmd/root.go
index 15daa38..ac50f42 100644
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -127,11 +127,11 @@ func ensureSchemePrefix(kuri string) string {
 	return kuri
 }
 
-// getUriAndNameForFS returns the kuri and name to be used by a KMS FS. If TPM
+// getURIAndNameForFS returns the kuri and name to be used by a KMS FS. If TPM
 // KMS is used it changes the kuri to add the default storage directory.
 //
 // If a storage-directory is already in the kuri, this will take preference.
-func getUriAndNameForFS(kuri, name string) (string, string, error) {
+func getURIAndNameForFS(kuri, name string) (string, string, error) {
 	kuri = ensureSchemePrefix(kuri)
 	if kuri == "" {
 		kuri = name
@@ -143,7 +143,7 @@ func getUriAndNameForFS(kuri, name string) (string, string, error) {
 	}
 
 	if typ == apiv1.TPMKMS {
-		if err = step.Init(); err != nil {
+		if err := step.Init(); err != nil {
 			return "", "", err
 		}
 		kuri, err = changeURI(kuri, url.Values{"storage-directory": []string{filepath.Join(step.Path(), "tpm")}})
diff --git a/docker/Dockerfile.debian b/docker/Dockerfile.debian
index dea2cbe..858eccd 100644
--- a/docker/Dockerfile.debian
+++ b/docker/Dockerfile.debian
@@ -1,4 +1,4 @@
-FROM golang AS builder
+FROM golang:bullseye AS builder
 
 WORKDIR /src
 COPY . .
diff --git a/internal/termutil/tui.go b/internal/termutil/tui.go
index 9e0e2b7..975d1d8 100644
--- a/internal/termutil/tui.go
+++ b/internal/termutil/tui.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//nolint:gocritic,errorlint // this file is borrowed from age
+//nolint:gocritic,revive // this file is borrowed from age
 package termutil
 
 import (
@@ -55,7 +55,7 @@ func withTerminal(f func(in, out *os.File) error) error {
 	} else if term.IsTerminal(int(os.Stdin.Fd())) {
 		return f(os.Stdin, os.Stdin)
 	} else {
-		return fmt.Errorf("standard input is not a terminal, and /dev/tty is not available: %v", err)
+		return fmt.Errorf("standard input is not a terminal, and /dev/tty is not available: %w", err)
 	}
 }