diff --git a/.golangci.yml b/.golangci.yml
index faedfe93..c8e246a3 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -72,6 +72,9 @@ linters-settings:
   nolintlint:
     require-explanation: true
     require-specific: true
+  gosec:
+    excludes:
+      - G115 # G115: integer overflow conversion; TODO: currently too many (false) positives in generated code that need to be verified
   revive:
     # revive is more configurable than static check, so likely the preferred alternative to static-check
     # (once the perf issue is solved: https://github.com/golangci/golangci-lint/issues/2997)
diff --git a/hvsock_test.go b/hvsock_test.go
index f492f47f..b6b1b440 100644
--- a/hvsock_test.go
+++ b/hvsock_test.go
@@ -608,7 +608,7 @@ func (u testUtil) Wait(ch <-chan struct{}, d time.Duration, msgs ...string) {
 	case <-ch:
 	case <-t.C:
 		u.T.Helper()
-		u.T.Fatalf(msgJoin(msgs, "timed out after %v"), d)
+		u.T.Fatal(msgJoin(msgs, fmt.Sprintf("timed out after %v", d)))
 	}
 }
 
@@ -619,7 +619,7 @@ func (u testUtil) WaitErr(ch <-chan error, d time.Duration, msgs ...string) {
 	case err := <-ch:
 		if err != nil {
 			u.T.Helper()
-			u.T.Fatalf(msgJoin(msgs, "%v"), err)
+			u.T.Fatalf(msgJoin(msgs, err.Error()))
 		}
 	case <-t.C:
 		u.T.Helper()
@@ -632,7 +632,7 @@ func (u testUtil) Assert(b bool, msgs ...string) {
 		return
 	}
 	u.T.Helper()
-	u.T.Fatalf(msgJoin(msgs, "failed assertion"))
+	u.T.Fatal(msgJoin(msgs, "failed assertion"))
 }
 
 func (u testUtil) Is(err, target error, msgs ...string) {
@@ -640,7 +640,7 @@ func (u testUtil) Is(err, target error, msgs ...string) {
 		return
 	}
 	u.T.Helper()
-	u.T.Fatalf(msgJoin(msgs, "got error %q; wanted %q"), err, target)
+	u.T.Fatal(msgJoin(msgs, fmt.Sprintf("got error %q; wanted %q", err, target)))
 }
 
 func (u testUtil) Must(err error, msgs ...string) {
@@ -648,7 +648,7 @@ func (u testUtil) Must(err error, msgs ...string) {
 		return
 	}
 	u.T.Helper()
-	u.T.Fatalf(msgJoin(msgs, "%v"), err)
+	u.T.Fatal(msgJoin(msgs, err.Error()))
 }
 
 // Check stops execution if testing failed in another go-routine.
diff --git a/wim/lzx/lzx.go b/wim/lzx/lzx.go
index e5db8260..a9ba850b 100644
--- a/wim/lzx/lzx.go
+++ b/wim/lzx/lzx.go
@@ -100,7 +100,7 @@ func (f *decompressor) ensureAtLeast(n int) error {
 	}
 	n, err := io.ReadAtLeast(f.r, f.b[f.bv-f.bo:], n)
 	if err != nil {
-		if err == io.EOF { //nolint:errorlint
+		if err == io.EOF {
 			err = io.ErrUnexpectedEOF
 		} else {
 			f.fail(err)
@@ -117,7 +117,7 @@ func (f *decompressor) ensureAtLeast(n int) error {
 // Otherwise, on error, it sets f.err.
 func (f *decompressor) feed() bool {
 	err := f.ensureAtLeast(2)
-	if err == io.ErrUnexpectedEOF { //nolint:errorlint // returns io.ErrUnexpectedEOF by contract
+	if err == io.ErrUnexpectedEOF {
 		return false
 	}
 	f.c |= (uint32(f.b[f.bo+1])<<8 | uint32(f.b[f.bo])) << (16 - f.nbits)
@@ -153,28 +153,28 @@ func buildTable(codelens []byte) *huffman {
 	// Determine the number of codes of each length, and the
 	// maximum length.
 	var count [maxTreePathLen + 1]uint
-	var max byte
+	var clMax byte
 	for _, cl := range codelens {
 		count[cl]++
-		if max < cl {
-			max = cl
+		if clMax < cl {
+			clMax = cl
 		}
 	}
 
-	if max == 0 {
+	if clMax == 0 {
 		return &huffman{}
 	}
 
 	// Determine the first code of each length.
 	var first [maxTreePathLen + 1]uint
 	code := uint(0)
-	for i := byte(1); i <= max; i++ {
+	for i := byte(1); i <= clMax; i++ {
 		code <<= 1
 		first[i] = code
 		code += count[i]
 	}
 
-	if code != 1<<max {
+	if code != 1<<clMax {
 		return nil
 	}
 
@@ -182,14 +182,14 @@ func buildTable(codelens []byte) *huffman {
 	// put all possible suffixes for the code into the table, too.
 	// For max > tablebits, split long codes into additional tables
 	// of suffixes of max-tablebits length.
-	h := &huffman{maxbits: max}
-	if max > tablebits {
+	h := &huffman{maxbits: clMax}
+	if clMax > tablebits {
 		core := first[tablebits+1] / 2 // Number of codes that fit without extra tables
 		nextra := 1<<tablebits - core  // Number of extra entries
 		h.extra = make([][]uint16, nextra)
 		for code := core; code < 1<<tablebits; code++ {
 			h.table[code] = uint16(code - core)
-			h.extra[code-core] = make([]uint16, 1<<(max-tablebits))
+			h.extra[code-core] = make([]uint16, 1<<(clMax-tablebits))
 		}
 	}
 
@@ -206,8 +206,8 @@ func buildTable(codelens []byte) *huffman {
 			} else {
 				prefix := code >> (cl - tablebits)
 				suffix := code & (1<<(cl-tablebits) - 1)
-				extendedCode := suffix << (max - cl)
-				for j := uint(0); j < 1<<(max-cl); j++ {
+				extendedCode := suffix << (clMax - cl)
+				for j := uint(0); j < 1<<(clMax-cl); j++ {
 					h.extra[h.table[prefix]][extendedCode+j] = v
 				}
 			}