diff --git a/.golangci.yml b/.golangci.yml
index 2b75b3a143c9..35bd980ca8bc 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -14,6 +14,7 @@ linters:
     - depguard          # Checks if package imports are in a list of acceptable packages
     - dupword           # Finds word repetitions
     - errorlint         # Find code that will cause problems with Go's error wrapping scheme
+    - gocritic          # another style/metalinter (dynamic rules supported)
     - gofmt             # Checks whether code was gofmt-ed
     - goheader          # Checks is file headers matche a given pattern
     - intrange          # Checking for loops that could use an integer range
@@ -67,6 +68,14 @@ linters-settings:
         deny:
           - pkg: github.com/k0sproject/k0s/inttest
             desc: Usage of integration test code outside of integration tests.
+
+  gocritic:
+    disabled-checks:
+      - singleCaseSwitch
+    settings:
+      ifElseChain:
+        minThreshold: 5
+
   goheader:
     template-path: .go-header.txt
     values:
diff --git a/cmd/token/invalidate.go b/cmd/token/invalidate.go
index 09c73309f96b..e7a301b22934 100644
--- a/cmd/token/invalidate.go
+++ b/cmd/token/invalidate.go
@@ -19,7 +19,6 @@ package token
 import (
 	"errors"
 	"fmt"
-	"path/filepath"
 
 	"github.com/k0sproject/k0s/pkg/config"
 	"github.com/k0sproject/k0s/pkg/token"
@@ -40,7 +39,7 @@ func tokenInvalidateCmd() *cobra.Command {
 			if len(args) < 1 {
 				return errors.New("invalidate requires at least one token ID to invalidate")
 			}
-			manager, err := token.NewManager(filepath.Join(opts.K0sVars.AdminKubeConfigPath))
+			manager, err := token.NewManager(opts.K0sVars.AdminKubeConfigPath)
 			if err != nil {
 				return err
 			}
diff --git a/cmd/token/list.go b/cmd/token/list.go
index 2cb2d8b84c8b..d6e4c1448fad 100644
--- a/cmd/token/list.go
+++ b/cmd/token/list.go
@@ -18,7 +18,6 @@ package token
 
 import (
 	"fmt"
-	"path/filepath"
 
 	"github.com/k0sproject/k0s/pkg/config"
 	"github.com/k0sproject/k0s/pkg/token"
@@ -42,7 +41,7 @@ func tokenListCmd() *cobra.Command {
 			if err != nil {
 				return err
 			}
-			manager, err := token.NewManager(filepath.Join(opts.K0sVars.AdminKubeConfigPath))
+			manager, err := token.NewManager(opts.K0sVars.AdminKubeConfigPath)
 			if err != nil {
 				return err
 			}
@@ -56,7 +55,6 @@ func tokenListCmd() *cobra.Command {
 				return nil
 			}
 
-			//fmt.Fprintf(cmd.OutOrStdout(), "Tokens: %v \n", tokens)
 			table := tablewriter.NewWriter(cmd.OutOrStdout())
 			table.SetHeader([]string{"ID", "Role", "Expires at"})
 			table.SetAutoWrapText(false)
diff --git a/internal/pkg/sysinfo/probes/linux/cgroup_v1.go b/internal/pkg/sysinfo/probes/linux/cgroup_v1.go
index ec4a3fecfad5..c8f4edfb2043 100644
--- a/internal/pkg/sysinfo/probes/linux/cgroup_v1.go
+++ b/internal/pkg/sysinfo/probes/linux/cgroup_v1.go
@@ -50,7 +50,7 @@ func (g *cgroupV1) loadControllers(seen func(name, msg string)) error {
 	var lineNo uint
 	lines := bufio.NewScanner(f)
 	for lines.Scan() {
-		lineNo = lineNo + 1
+		lineNo++
 		if err := lines.Err(); err != nil {
 			return fmt.Errorf("failed to parse /proc/cgroups at line %d: %w ", lineNo, err)
 		}
diff --git a/internal/pkg/sysinfo/probes/probes.go b/internal/pkg/sysinfo/probes/probes.go
index 5a875783c89f..56f42a270cbe 100644
--- a/internal/pkg/sysinfo/probes/probes.go
+++ b/internal/pkg/sysinfo/probes/probes.go
@@ -161,7 +161,7 @@ func (p *probes) Get(id string) Probe {
 }
 
 func (p *probes) Set(id string, setter func(ProbePath, Probe) Probe) {
-	path := append(p.path, id)
+	path := append(p.path, id) //nolint:gocritic // not assigning to p.path is intended
 	for _, probe := range p.probes {
 		if probe.id == id {
 			probe.probe = ensureSet(setter(path, probe.probe))
diff --git a/internal/pkg/sysinfo/probes/util.go b/internal/pkg/sysinfo/probes/util.go
index 3bd44350ac0d..02da1fe3a7f1 100644
--- a/internal/pkg/sysinfo/probes/util.go
+++ b/internal/pkg/sysinfo/probes/util.go
@@ -44,7 +44,7 @@ func (b iecBytes) String() string {
 	const prefixes = "KMGTPE"
 	const unit = 1 << 10
 
-	for i := 0; ; i = i + 1 {
+	for i := 0; ; i++ {
 		x := float32(b) / float32((uint64(1) << (i * 10)))
 		if x < unit {
 			if i == 0 {
diff --git a/internal/pkg/sysinfo/sysinfo.go b/internal/pkg/sysinfo/sysinfo.go
index dd2529254454..a397c020dcb9 100644
--- a/internal/pkg/sysinfo/sysinfo.go
+++ b/internal/pkg/sysinfo/sysinfo.go
@@ -65,10 +65,10 @@ func (s *K0sSysinfoSpec) NewSysinfoProbes() probes.Probes {
 	// https://docs.k0sproject.io/main/system-requirements/#storage
 	var minFreeDiskSpace uint64
 	if s.ControllerRoleEnabled {
-		minFreeDiskSpace = minFreeDiskSpace + 500*probes.Mi
+		minFreeDiskSpace += 500 * probes.Mi
 	}
 	if s.WorkerRoleEnabled {
-		minFreeDiskSpace = minFreeDiskSpace + 1300*probes.Mi
+		minFreeDiskSpace += 1300 * probes.Mi
 	}
 	probes.AssertFileSystem(p, s.DataDir)
 	probes.AssertFreeDiskSpace(p, s.DataDir, minFreeDiskSpace)
diff --git a/internal/testutil/fakeclient/tracker.go b/internal/testutil/fakeclient/tracker.go
index 66eb1516a7a0..7db1398d34a5 100644
--- a/internal/testutil/fakeclient/tracker.go
+++ b/internal/testutil/fakeclient/tracker.go
@@ -258,7 +258,7 @@ func fromUnstructured(scheme *runtime.Scheme, obj runtime.Object, gvk schema.Gro
 	}
 
 	listGVK := gvk
-	listGVK.Kind = listGVK.Kind + "List"
+	listGVK.Kind += "List"
 
 	list, err := scheme.New(listGVK)
 	if err != nil {
diff --git a/inttest/kubeletcertrotate/kubeletcertrotate_test.go b/inttest/kubeletcertrotate/kubeletcertrotate_test.go
index cc6772c48628..c54fd8b05079 100644
--- a/inttest/kubeletcertrotate/kubeletcertrotate_test.go
+++ b/inttest/kubeletcertrotate/kubeletcertrotate_test.go
@@ -142,7 +142,6 @@ spec:
 
 		s.Equal(appc.PlanCompleted, cmd.State)
 		s.NotNil(cmd.K0sUpdate)
-		//s.Nil(cmd.K0sUpdate.Controllers)
 		s.NotNil(cmd.K0sUpdate.Workers)
 
 		for _, group := range [][]apv1beta2.PlanCommandTargetStatus{cmd.K0sUpdate.Controllers, cmd.K0sUpdate.Workers} {
diff --git a/pkg/apis/k0s/v1beta1/clusterconfig_types.go b/pkg/apis/k0s/v1beta1/clusterconfig_types.go
index b9d411a42a43..5581e166ae15 100644
--- a/pkg/apis/k0s/v1beta1/clusterconfig_types.go
+++ b/pkg/apis/k0s/v1beta1/clusterconfig_types.go
@@ -91,12 +91,10 @@ func (c *ClusterConfig) StripDefaults() *ClusterConfig {
 	}
 	if reflect.DeepEqual(copy.Spec.Network, DefaultNetwork()) {
 		copy.Spec.Network = nil
-	} else {
-		if copy.Spec.Network.NodeLocalLoadBalancing != nil &&
-			copy.Spec.Network.NodeLocalLoadBalancing.EnvoyProxy != nil &&
-			reflect.DeepEqual(copy.Spec.Network.NodeLocalLoadBalancing.EnvoyProxy.Image, DefaultEnvoyProxyImage()) {
-			copy.Spec.Network.NodeLocalLoadBalancing.EnvoyProxy.Image = nil
-		}
+	} else if copy.Spec.Network.NodeLocalLoadBalancing != nil &&
+		copy.Spec.Network.NodeLocalLoadBalancing.EnvoyProxy != nil &&
+		reflect.DeepEqual(copy.Spec.Network.NodeLocalLoadBalancing.EnvoyProxy.Image, DefaultEnvoyProxyImage()) {
+		copy.Spec.Network.NodeLocalLoadBalancing.EnvoyProxy.Image = nil
 	}
 	if reflect.DeepEqual(copy.Spec.Telemetry, DefaultClusterTelemetry()) {
 		copy.Spec.Telemetry = nil
diff --git a/pkg/apis/k0s/v1beta1/network.go b/pkg/apis/k0s/v1beta1/network.go
index 70ffcad91ab4..9fc772addfd4 100644
--- a/pkg/apis/k0s/v1beta1/network.go
+++ b/pkg/apis/k0s/v1beta1/network.go
@@ -149,9 +149,9 @@ func (n *Network) DNSAddress() (string, error) {
 
 	prefixlen, _ := ipnet.Mask.Size()
 	if prefixlen < 29 {
-		address[3] = address[3] + 10
+		address[3] += 10
 	} else {
-		address[3] = address[3] + 2
+		address[3] += 2
 	}
 
 	if !ipnet.Contains(address) {
diff --git a/pkg/autopilot/controller/plans/cmdprovider/k0supdate/utils/find_test.go b/pkg/autopilot/controller/plans/cmdprovider/k0supdate/utils/find_test.go
index 8e9ca29278d0..a466138a6919 100644
--- a/pkg/autopilot/controller/plans/cmdprovider/k0supdate/utils/find_test.go
+++ b/pkg/autopilot/controller/plans/cmdprovider/k0supdate/utils/find_test.go
@@ -45,7 +45,7 @@ func TestFindNextPendingRandom(t *testing.T) {
 		assert.NoError(t, err)
 		assert.NotNil(t, node)
 
-		countMap[node.Name] = countMap[node.Name] + 1
+		countMap[node.Name] += 1
 	}
 
 	assert.Contains(t, countMap, "bbb")
diff --git a/pkg/autopilot/controller/readyprober.go b/pkg/autopilot/controller/readyprober.go
index 33115d85c5ea..d54ca90849c0 100644
--- a/pkg/autopilot/controller/readyprober.go
+++ b/pkg/autopilot/controller/readyprober.go
@@ -78,11 +78,7 @@ func (p readyProber) Probe() error {
 	g := errgroup.Group{}
 
 	for _, target := range p.targets {
-		g.Go(func() error {
-			return func(target apv1beta2.PlanCommandTargetStatus) error {
-				return p.probeOne(target)
-			}(target)
-		})
+		g.Go(func() error { return p.probeOne(target) })
 	}
 
 	return g.Wait()
diff --git a/pkg/autopilot/controller/root_controller.go b/pkg/autopilot/controller/root_controller.go
index 41db827c6eb7..b332a7439d8a 100644
--- a/pkg/autopilot/controller/root_controller.go
+++ b/pkg/autopilot/controller/root_controller.go
@@ -250,9 +250,7 @@ func (c *rootController) startSubControllers(ctx context.Context, event LeaseEve
 
 	ctx, cancel := context.WithCancel(ctx)
 
-	//wg := sync.WaitGroup{}
 	g, ctx := errgroup.WithContext(ctx)
-	//wg.Add(1)
 
 	g.Go(func() error {
 		logger.Info("Starting controller-runtime subhandlers")
diff --git a/pkg/autopilot/controller/signal/k0s/cordon.go b/pkg/autopilot/controller/signal/k0s/cordon.go
index 0768ca62b82d..d449990284f0 100644
--- a/pkg/autopilot/controller/signal/k0s/cordon.go
+++ b/pkg/autopilot/controller/signal/k0s/cordon.go
@@ -171,7 +171,7 @@ func (r *cordoning) drainNode(ctx context.Context, signalNode crcli.Object) erro
 			}
 		}
 
-		//otherwise get node from client
+		// otherwise get node from client
 		if err := r.client.Get(ctx, crcli.ObjectKey{Name: nodeName}, node); err != nil {
 			return fmt.Errorf("failed to get node: %w", err)
 		}
diff --git a/pkg/autopilot/controller/signal/k0s/uncordon.go b/pkg/autopilot/controller/signal/k0s/uncordon.go
index 878fcdd2f247..0f03fa9316f4 100644
--- a/pkg/autopilot/controller/signal/k0s/uncordon.go
+++ b/pkg/autopilot/controller/signal/k0s/uncordon.go
@@ -171,7 +171,7 @@ func (r *uncordoning) unCordonNode(ctx context.Context, signalNode crcli.Object)
 			}
 		}
 
-		//otherwise get node from client
+		// otherwise get node from client
 		if err := r.client.Get(ctx, crcli.ObjectKey{Name: nodeName}, node); err != nil {
 			return fmt.Errorf("failed to get node: %w", err)
 		}
diff --git a/pkg/backup/filesystem_unix_test.go b/pkg/backup/filesystem_unix_test.go
index 64fcd3770144..6ecfda141d59 100644
--- a/pkg/backup/filesystem_unix_test.go
+++ b/pkg/backup/filesystem_unix_test.go
@@ -105,7 +105,7 @@ func TestFileSystemStepRestore(t *testing.T) {
 		step := NewFileSystemStep(src)
 		require.NoError(t, step.Restore(src, dst), "Unable to copy empty dir")
 
-		//rmdir will fail if the directory has anything at all
+		// rmdir will fail if the directory has anything at all
 		require.NoError(t, os.Remove(dst), "Unable to remove supposedly empty dir")
 	})
 
diff --git a/pkg/component/worker/nllb/reconciler.go b/pkg/component/worker/nllb/reconciler.go
index a88a45fb4a07..822ad909e8e5 100644
--- a/pkg/component/worker/nllb/reconciler.go
+++ b/pkg/component/worker/nllb/reconciler.go
@@ -104,7 +104,7 @@ func NewReconciler(
 	runtimeDir := os.Getenv("XDG_RUNTIME_DIR")
 	if runtimeDir == "" {
 		if runtime.GOOS == "windows" {
-			runtimeDir = filepath.Join(k0sVars.DataDir)
+			runtimeDir = k0sVars.DataDir
 		} else {
 			runtimeDir = "/run/k0s"
 		}
diff --git a/pkg/k0scloudprovider/provider.go b/pkg/k0scloudprovider/provider.go
index ef3761f90a7c..5397b038daf2 100644
--- a/pkg/k0scloudprovider/provider.go
+++ b/pkg/k0scloudprovider/provider.go
@@ -66,7 +66,7 @@ func (p *provider) InstancesV2() (cloudprovider.InstancesV2, bool) {
 }
 
 // Zones returns a zones interface. Also returns true if the interface is supported, false otherwise.
-// DEPRECATED: Zones is deprecated in favor of retrieving zone/region information from InstancesV2.
+// Deprecated: Zones is deprecated in favor of retrieving zone/region information from InstancesV2.
 // This interface will not be called if InstancesV2 is enabled.
 func (p *provider) Zones() (cloudprovider.Zones, bool) {
 	// Not supported
diff --git a/pkg/kubernetes/watch/watcher_test.go b/pkg/kubernetes/watch/watcher_test.go
index 57183453f8f6..8213ccc04568 100644
--- a/pkg/kubernetes/watch/watcher_test.go
+++ b/pkg/kubernetes/watch/watcher_test.go
@@ -530,7 +530,7 @@ func TestWatcher(t *testing.T) {
 				switch callsToCondition {
 				case 0:
 					return false, nil
-				default:
+				default: //nolint:gocritic // needed for fallthrough
 					require.Fail(t, "Unexpected call to condition")
 					fallthrough
 				case 1:
diff --git a/pkg/supervisor/logwriter.go b/pkg/supervisor/logwriter.go
index bb2f160b886b..92c12e8b6491 100644
--- a/pkg/supervisor/logwriter.go
+++ b/pkg/supervisor/logwriter.go
@@ -82,7 +82,7 @@ func (w *logWriter) writeBytes(in []byte) {
 			len := w.len
 			for i := 0; i < utf8.MaxRune && i < w.len; i++ {
 				if r, _ := utf8.DecodeLastRune(w.buf[:w.len-i]); r != utf8.RuneError {
-					len = len - i
+					len -= i
 					break
 				}
 			}
diff --git a/pkg/supervisor/supervisor.go b/pkg/supervisor/supervisor.go
index b4dd9568a289..1594ba9551e4 100644
--- a/pkg/supervisor/supervisor.go
+++ b/pkg/supervisor/supervisor.go
@@ -339,7 +339,7 @@ func (s *Supervisor) shouldKillProcess(ph procHandle) (bool, error) {
 		return false, nil
 	}
 
-	//only kill process if it has the _KOS_MANAGED env set
+	// only kill process if it has the _KOS_MANAGED env set
 	if env, err := ph.environ(); err != nil {
 		if errors.Is(err, syscall.ESRCH) {
 			return false, nil
diff --git a/pkg/token/kubeconfig.go b/pkg/token/kubeconfig.go
index d9a4de4387a8..58657340124b 100644
--- a/pkg/token/kubeconfig.go
+++ b/pkg/token/kubeconfig.go
@@ -102,7 +102,7 @@ func loadCACert(k0sVars *config.CfgVars) ([]byte, error) {
 }
 
 func loadToken(ctx context.Context, k0sVars *config.CfgVars, role string, expiry time.Duration) (string, error) {
-	manager, err := NewManager(filepath.Join(k0sVars.AdminKubeConfigPath))
+	manager, err := NewManager(k0sVars.AdminKubeConfigPath)
 	if err != nil {
 		return "", err
 	}