diff --git a/x/feegrant/simulation/operations.go b/x/feegrant/simulation/operations.go
index 173a6478f9e7..de01159da746 100644
--- a/x/feegrant/simulation/operations.go
+++ b/x/feegrant/simulation/operations.go
@@ -16,8 +16,6 @@ import (
 )
 
 // Simulation operation weights constants
-//
-//nolint:gosec // These aren't harcoded credentials.
 const (
 	OpWeightMsgGrantAllowance        = "op_weight_msg_grant_fee_allowance"
 	OpWeightMsgRevokeAllowance       = "op_weight_msg_grant_revoke_allowance"
diff --git a/x/upgrade/internal/conv/string_test.go b/x/upgrade/internal/conv/string_test.go
index 484d0a31ea62..dfaaa038cbd8 100644
--- a/x/upgrade/internal/conv/string_test.go
+++ b/x/upgrade/internal/conv/string_test.go
@@ -26,7 +26,7 @@ func (s *StringSuite) TestUnsafeStrToBytes() {
 		b := unsafeConvertStr()
 		runtime.GC()
 		<-time.NewTimer(2 * time.Millisecond).C
-		b2 := append(b, 'd') //nolint:gocritic // append is fine here
+		b2 := append(b, 'd')
 		s.Equal("abc", string(b))
 		s.Equal("abcd", string(b2))
 	}
diff --git a/x/upgrade/keeper/grpc_query.go b/x/upgrade/keeper/grpc_query.go
index ba042693d96e..d0c30c36423e 100644
--- a/x/upgrade/keeper/grpc_query.go
+++ b/x/upgrade/keeper/grpc_query.go
@@ -37,17 +37,15 @@ func (k Keeper) AppliedPlan(c context.Context, req *types.QueryAppliedPlanReques
 }
 
 // UpgradedConsensusState implements the Query/UpgradedConsensusState gRPC method
-//
-//nolint:staticcheck
-func (k Keeper) UpgradedConsensusState(c context.Context, req *types.QueryUpgradedConsensusStateRequest) (*types.QueryUpgradedConsensusStateResponse, error) {
+func (k Keeper) UpgradedConsensusState(c context.Context, req *types.QueryUpgradedConsensusStateRequest) (*types.QueryUpgradedConsensusStateResponse, error) { //nolint:staticcheck // we're using a deprecated call for compatibility
 	ctx := sdk.UnwrapSDKContext(c)
 
 	consState, found := k.GetUpgradedConsensusState(ctx, req.LastHeight)
 	if !found {
-		return &types.QueryUpgradedConsensusStateResponse{}, nil
+		return &types.QueryUpgradedConsensusStateResponse{}, nil //nolint:staticcheck // we're using a deprecated call for compatibility
 	}
 
-	return &types.QueryUpgradedConsensusStateResponse{
+	return &types.QueryUpgradedConsensusStateResponse{ //nolint:staticcheck // we're using a deprecated call for compatibility
 		UpgradedConsensusState: consState,
 	}, nil
 }
diff --git a/x/upgrade/keeper/keeper_test.go b/x/upgrade/keeper/keeper_test.go
index eed7f80ab3e7..0e699806d18b 100644
--- a/x/upgrade/keeper/keeper_test.go
+++ b/x/upgrade/keeper/keeper_test.go
@@ -280,7 +280,7 @@ func (s *KeeperTestSuite) TestMigrations() {
 	vmBefore := s.upgradeKeeper.GetModuleVersionMap(s.ctx)
 	s.upgradeKeeper.SetUpgradeHandler("dummy", func(_ sdk.Context, _ types.Plan, vm module.VersionMap) (module.VersionMap, error) {
 		// simulate upgrading the bank module
-		vm["bank"] = vm["bank"] + 1 //nolint:gocritic
+		vm["bank"]++
 		return vm, nil
 	})
 	dummyPlan := types.Plan{
diff --git a/x/upgrade/module.go b/x/upgrade/module.go
index ba20b20bf6c2..298fe6f1f0a9 100644
--- a/x/upgrade/module.go
+++ b/x/upgrade/module.go
@@ -171,8 +171,7 @@ func init() {
 	)
 }
 
-//nolint:revive
-type UpgradeInputs struct {
+type ModuleInputs struct {
 	depinject.In
 
 	Config *modulev1.Module
@@ -182,8 +181,7 @@ type UpgradeInputs struct {
 	AppOpts servertypes.AppOptions `optional:"true"`
 }
 
-//nolint:revive
-type UpgradeOutputs struct {
+type ModuleOutputs struct {
 	depinject.Out
 
 	UpgradeKeeper *keeper.Keeper
@@ -192,7 +190,7 @@ type UpgradeOutputs struct {
 	BaseAppOption runtime.BaseAppOption
 }
 
-func ProvideModule(in UpgradeInputs) UpgradeOutputs {
+func ProvideModule(in ModuleInputs) ModuleOutputs {
 	var (
 		homePath           string
 		skipUpgradeHeights = make(map[int64]bool)
@@ -220,7 +218,7 @@ func ProvideModule(in UpgradeInputs) UpgradeOutputs {
 	m := NewAppModule(k)
 	gh := govv1beta1.HandlerRoute{RouteKey: types.RouterKey, Handler: NewSoftwareUpgradeProposalHandler(k)}
 
-	return UpgradeOutputs{UpgradeKeeper: k, Module: m, GovHandler: gh, BaseAppOption: baseappOpt}
+	return ModuleOutputs{UpgradeKeeper: k, Module: m, GovHandler: gh, BaseAppOption: baseappOpt}
 }
 
 func PopulateVersionMap(upgradeKeeper *keeper.Keeper, modules map[string]appmodule.AppModule) {
diff --git a/x/upgrade/plan/downloader_test.go b/x/upgrade/plan/downloader_test.go
index 7a48275ef687..ef0f727550ab 100644
--- a/x/upgrade/plan/downloader_test.go
+++ b/x/upgrade/plan/downloader_test.go
@@ -65,9 +65,7 @@ type TestZip []*TestFile
 
 func NewTestZip(testFiles ...*TestFile) TestZip {
 	tz := make([]*TestFile, len(testFiles))
-	for i, tf := range testFiles { //nolint:gosimple
-		tz[i] = tf
-	}
+	copy(tz, testFiles)
 	return tz
 }
 
diff --git a/x/upgrade/types/storeloader_test.go b/x/upgrade/types/storeloader_test.go
index 26926a4e0be2..cb9b678b0b56 100644
--- a/x/upgrade/types/storeloader_test.go
+++ b/x/upgrade/types/storeloader_test.go
@@ -74,7 +74,7 @@ func TestSetLoader(t *testing.T) {
 	data, err := json.Marshal(upgradeInfo)
 	require.NoError(t, err)
 
-	err = os.WriteFile(upgradeInfoFilePath, data, 0o644) //nolint:gosec
+	err = os.WriteFile(upgradeInfoFilePath, data, 0o600)
 	require.NoError(t, err)
 
 	// make sure it exists before running everything