diff --git a/framework/buffer/file.go b/framework/buffer/file.go
index dc2b7305..00259849 100644
--- a/framework/buffer/file.go
+++ b/framework/buffer/file.go
@@ -19,10 +19,10 @@ along with this program.  If not, see <https://www.gnu.org/licenses/>.
 package buffer
 
 import (
+	"crypto/rand"
 	"encoding/hex"
 	"fmt"
 	"io"
-	"math/rand"
 	"os"
 	"path/filepath"
 )
diff --git a/framework/cfgparser/imports.go b/framework/cfgparser/imports.go
index d8276d22..8078dd8d 100644
--- a/framework/cfgparser/imports.go
+++ b/framework/cfgparser/imports.go
@@ -89,7 +89,7 @@ func (ctx *parseContext) resolveImport(node Node, name string, expansionDepth in
 			src, err = os.Open(file + ".conf")
 			if err != nil {
 				if os.IsNotExist(err) {
-					return nil, NodeErr(node, "unknown import: "+name)
+					return nil, NodeErr(node, "unknown import: %s", name)
 				}
 				return nil, err
 			}
diff --git a/framework/cfgparser/parse_test.go b/framework/cfgparser/parse_test.go
index 9488e580..32929b9f 100644
--- a/framework/cfgparser/parse_test.go
+++ b/framework/cfgparser/parse_test.go
@@ -583,7 +583,6 @@ func TestRead(t *testing.T) {
 	os.Setenv("TESTING_VARIABLE2", "ABC2 DEF2")
 
 	for _, case_ := range cases {
-		case_ := case_
 		t.Run(case_.name, func(t *testing.T) {
 			tree, err := Read(strings.NewReader(case_.cfg), "test")
 			if !case_.fail && err != nil {
diff --git a/framework/config/tls/server.go b/framework/config/tls/server.go
index c23fdc32..4fe8e8d3 100644
--- a/framework/config/tls/server.go
+++ b/framework/config/tls/server.go
@@ -113,10 +113,6 @@ func readTLSBlock(globals map[string]interface{}, blockNode config.Node) (*TLSCo
 		return nil, err
 	}
 
-	if len(baseCfg.CipherSuites) != 0 {
-		baseCfg.PreferServerCipherSuites = true
-	}
-
 	baseCfg.MinVersion = tlsVersions[0]
 	baseCfg.MaxVersion = tlsVersions[1]
 	log.Debugf("tls: min version: %x, max version: %x", tlsVersions[0], tlsVersions[1])
diff --git a/framework/log/log.go b/framework/log/log.go
index 98fb3a81..f9092a44 100644
--- a/framework/log/log.go
+++ b/framework/log/log.go
@@ -80,7 +80,8 @@ func (l Logger) Println(val ...interface{}) {
 
 // Msg writes an event log message in a machine-readable format (currently
 // JSON).
-//   name: msg\t{"key":"value","key2":"value2"}
+//
+//	name: msg\t{"key":"value","key2":"value2"}
 //
 // Key-value pairs are built from fields slice which should contain key strings
 // followed by corresponding values.  That is, for example, []interface{"key",
@@ -102,7 +103,9 @@ func (l Logger) Msg(msg string, fields ...interface{}) {
 // JSON) containing information about the error. If err does have a Fields
 // method that returns map[string]interface{}, its result will be added to the
 // message.
-//   name: msg\t{"key":"value","key2":"value2"}
+//
+//	name: msg\t{"key":"value","key2":"value2"}
+//
 // Additionally, values from fields will be added to it, as handled by
 // Logger.Msg.
 //
diff --git a/internal/check/dnsbl/dnsbl.go b/internal/check/dnsbl/dnsbl.go
index 76cc7e34..2c91c838 100644
--- a/internal/check/dnsbl/dnsbl.go
+++ b/internal/check/dnsbl/dnsbl.go
@@ -301,7 +301,6 @@ func (bl *DNSBL) checkLists(ctx context.Context, ip net.IP, ehlo, mailFrom strin
 	)
 
 	for _, list := range bl.bls {
-		list := list
 		eg.Go(func() error {
 			err := bl.checkList(ctx, list, ip, ehlo, mailFrom)
 			if err != nil {
diff --git a/internal/endpoint/dovecot_sasld/dovecot_sasl.go b/internal/endpoint/dovecot_sasld/dovecot_sasl.go
index f1184e86..77eedd0e 100644
--- a/internal/endpoint/dovecot_sasld/dovecot_sasl.go
+++ b/internal/endpoint/dovecot_sasld/dovecot_sasl.go
@@ -81,7 +81,6 @@ func (endp *Endpoint) Init(cfg *config.Map) error {
 	endp.srv.Log = stdlog.New(endp.log, "", 0)
 
 	for _, mech := range endp.saslAuth.SASLMechanisms() {
-		mech := mech
 		endp.srv.AddMechanism(mech, mechInfo[mech], func(req *dovecotsasl.AuthReq) sasl.Server {
 			var remoteAddr net.Addr
 			if req.RemoteIP != nil && req.RemotePort != 0 {
diff --git a/internal/endpoint/imap/imap.go b/internal/endpoint/imap/imap.go
index 3525b8ed..191d93d2 100644
--- a/internal/endpoint/imap/imap.go
+++ b/internal/endpoint/imap/imap.go
@@ -139,7 +139,6 @@ func (endp *Endpoint) Init(cfg *config.Map) error {
 	}
 
 	for _, mech := range endp.saslAuth.SASLMechanisms() {
-		mech := mech
 		endp.serv.EnableAuth(mech, func(c imapserver.Conn) sasl.Server {
 			return endp.saslAuth.CreateSASL(mech, c.Info().RemoteAddr, func(identity string, data auth.ContextData) error {
 				return endp.openAccount(c, identity)
@@ -174,7 +173,6 @@ func (endp *Endpoint) setupListeners(addresses []config.Endpoint) error {
 		endp.listeners = append(endp.listeners, l)
 
 		endp.listenersWg.Add(1)
-		addr := addr
 		go func() {
 			if err := endp.serv.Serve(l); err != nil && !strings.HasSuffix(err.Error(), "use of closed network connection") {
 				endp.Log.Printf("imap: failed to serve %s: %s", addr, err)
diff --git a/internal/endpoint/openmetrics/om.go b/internal/endpoint/openmetrics/om.go
index 3d362f97..874a333d 100644
--- a/internal/endpoint/openmetrics/om.go
+++ b/internal/endpoint/openmetrics/om.go
@@ -60,7 +60,6 @@ func (e *Endpoint) Init(cfg *config.Map) error {
 	e.serv.Handler = e.mux
 
 	for _, a := range e.addrs {
-		a := a
 		endp, err := config.ParseEndpoint(a)
 		if err != nil {
 			return fmt.Errorf("%s: malformed endpoint: %v", modName, err)
diff --git a/internal/endpoint/smtp/smtp.go b/internal/endpoint/smtp/smtp.go
index 28ba85e2..004d92e5 100644
--- a/internal/endpoint/smtp/smtp.go
+++ b/internal/endpoint/smtp/smtp.go
@@ -24,7 +24,6 @@ import (
 	"crypto/tls"
 	"fmt"
 	"io"
-	"math/rand"
 	"net"
 	"os"
 	"path/filepath"
@@ -346,7 +345,6 @@ func (endp *Endpoint) setupListeners(addresses []config.Endpoint) error {
 		endp.listeners = append(endp.listeners, l)
 
 		endp.listenersWg.Add(1)
-		addr := addr
 		go func() {
 			if err := endp.serv.Serve(l); err != nil {
 				endp.Log.Printf("failed to serve %s: %s", addr, err)
@@ -431,6 +429,4 @@ func init() {
 	module.RegisterEndpoint("smtp", New)
 	module.RegisterEndpoint("submission", New)
 	module.RegisterEndpoint("lmtp", New)
-
-	rand.Seed(time.Now().UnixNano())
 }
diff --git a/internal/endpoint/smtp/smtp_test.go b/internal/endpoint/smtp/smtp_test.go
index c295d7c8..fa46c279 100644
--- a/internal/endpoint/smtp/smtp_test.go
+++ b/internal/endpoint/smtp/smtp_test.go
@@ -583,7 +583,6 @@ func TestMain(m *testing.M) {
 	flag.Parse()
 
 	if *remoteSmtpPort == "random" {
-		rand.Seed(time.Now().UnixNano())
 		*remoteSmtpPort = strconv.Itoa(rand.Intn(65536-10000) + 10000)
 	}
 
diff --git a/internal/msgpipeline/check_runner.go b/internal/msgpipeline/check_runner.go
index ba9c7823..f6df9525 100644
--- a/internal/msgpipeline/check_runner.go
+++ b/internal/msgpipeline/check_runner.go
@@ -125,7 +125,6 @@ func (cr *checkRunner) checkStates(ctx context.Context, checks []module.Check) (
 
 	if len(cr.checkedRcpts) != 0 {
 		for _, rcpt := range cr.checkedRcpts {
-			rcpt := rcpt
 			err := cr.runAndMergeResults(states, func(s module.CheckState) module.CheckResult {
 				// Avoid calling CheckRcpt for the same recipient for the same check
 				// multiple times, even if requested.
@@ -176,7 +175,6 @@ func (cr *checkRunner) runAndMergeResults(states []module.CheckState, runner fun
 	}{}
 
 	for _, state := range states {
-		state := state
 		data.wg.Add(1)
 		go func() {
 			defer func() {
diff --git a/internal/msgpipeline/config_test.go b/internal/msgpipeline/config_test.go
index b7ac666a..24d7e51f 100644
--- a/internal/msgpipeline/config_test.go
+++ b/internal/msgpipeline/config_test.go
@@ -224,7 +224,6 @@ func TestMsgPipelineCfg(t *testing.T) {
 	}
 
 	for _, case_ := range cases {
-		case_ := case_
 		t.Run(case_.name, func(t *testing.T) {
 			cfg, _ := parser.Read(strings.NewReader(case_.str), "literal")
 			parsed, err := parseMsgPipelineRootCfg(nil, cfg)
diff --git a/internal/smtpconn/smtpconn_test.go b/internal/smtpconn/smtpconn_test.go
index 6279add9..b8fd647e 100644
--- a/internal/smtpconn/smtpconn_test.go
+++ b/internal/smtpconn/smtpconn_test.go
@@ -24,7 +24,6 @@ import (
 	"os"
 	"strconv"
 	"testing"
-	"time"
 )
 
 var testPort string
@@ -34,7 +33,6 @@ func TestMain(m *testing.M) {
 	flag.Parse()
 
 	if *remoteSmtpPort == "random" {
-		rand.Seed(time.Now().UnixNano())
 		*remoteSmtpPort = strconv.Itoa(rand.Intn(65536-10000) + 10000)
 	}
 
diff --git a/internal/target/remote/remote.go b/internal/target/remote/remote.go
index 3e661c4f..d4c42ed6 100644
--- a/internal/target/remote/remote.go
+++ b/internal/target/remote/remote.go
@@ -406,8 +406,6 @@ func (rd *remoteDelivery) BodyNonAtomic(ctx context.Context, c module.StatusColl
 	var wg sync.WaitGroup
 
 	for i, conn := range rd.connections {
-		i := i
-		conn := conn
 		wg.Add(1)
 		go func() {
 			defer wg.Done()
diff --git a/internal/updatepipe/unix_pipe.go b/internal/updatepipe/unix_pipe.go
index d2e2ce80..a8249f90 100644
--- a/internal/updatepipe/unix_pipe.go
+++ b/internal/updatepipe/unix_pipe.go
@@ -34,7 +34,8 @@ import (
 // Listen goroutine can be running.
 //
 // The socket is stream-oriented and consists of the following messages:
-//		SENDER_ID;JSON_SERIALIZED_INTERNAL_OBJECT\n
+//
+//	SENDER_ID;JSON_SERIALIZED_INTERNAL_OBJECT\n
 //
 // And SENDER_ID is Process ID and UnixSockPipe address concated as a string.
 // It is used to deduplicate updates sent to Push and recevied via Listen.
diff --git a/maddy.go b/maddy.go
index 16aa0eb0..e6a05cf1 100644
--- a/maddy.go
+++ b/maddy.go
@@ -385,7 +385,6 @@ func RegisterModules(globals map[string]interface{}, nodes []config.Node) (endpo
 			return nil, nil, err
 		}
 
-		block := block
 		module.RegisterInstance(inst, config.NewMap(globals, block))
 		for _, alias := range modAliases {
 			if module.HasInstance(alias) {