diff --git a/.github/workflows/coder.yaml b/.github/workflows/coder.yaml
index e3d57e776802a..af661d0833056 100644
--- a/.github/workflows/coder.yaml
+++ b/.github/workflows/coder.yaml
@@ -42,7 +42,7 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v3.1.0
         with:
-          version: v1.45.2
+          version: v1.46.0
 
   style-lint-typescript:
     name: "style/lint/typescript"
diff --git a/.golangci.yaml b/.golangci.yaml
index ed62c51c68121..52945243f2772 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -77,7 +77,7 @@ linters-settings:
       # - sloppyReassign
       - sloppyTypeAssert
       - sortSlice
-      # - sprintfQuotedString
+      - sprintfQuotedString
       - sqlQuery
       # - stringConcatSimplify
       # - stringXbytes
@@ -105,6 +105,13 @@ linters-settings:
         failOn: all
         rules: rules.go
 
+  staticcheck:
+    # https://staticcheck.io/docs/options#checks
+    # We disable SA1019 because it gets angry about our usage of xerrors. We
+    # intentionally xerrors because stack frame support didn't make it into the
+    # stdlib port.
+    checks: ["all", "-SA1019"]
+
   goimports:
     local-prefixes: coder.com,cdr.dev,go.coder.com,github.com/cdr,github.com/coder
 
@@ -235,7 +242,7 @@ linters:
     # without testing any exported functions. This is enabled to promote
     # decomposing a package before testing it's internals. A function caller
     # should be able to test most of the functionality from exported functions.
-    # 
+    #
     # There are edge-cases to this rule, but they should be carefully considered
     # to avoid structural inconsistency.
     - testpackage
diff --git a/cli/gitssh_test.go b/cli/gitssh_test.go
index 570ae57ef7ca9..2db9131c3c7be 100644
--- a/cli/gitssh_test.go
+++ b/cli/gitssh_test.go
@@ -60,7 +60,7 @@ func TestGitSSH(t *testing.T) {
 
 		// start workspace agent
 		cmd, root := clitest.New(t, "agent", "--agent-token", agentToken, "--agent-url", client.URL.String())
-		agentClient := &*client
+		agentClient := client
 		clitest.SetupConfig(t, agentClient, root)
 		ctx, cancelFunc := context.WithCancel(context.Background())
 		defer cancelFunc()
diff --git a/cli/ssh.go b/cli/ssh.go
index 937b64226eaf0..9dc6af13c0de2 100644
--- a/cli/ssh.go
+++ b/cli/ssh.go
@@ -3,10 +3,8 @@ package cli
 import (
 	"context"
 	"io"
-	"net"
 	"os"
 	"strings"
-	"time"
 
 	"github.com/google/uuid"
 	"github.com/mattn/go-isatty"
@@ -181,32 +179,3 @@ func ssh() *cobra.Command {
 
 	return cmd
 }
-
-type stdioConn struct {
-	io.Reader
-	io.Writer
-}
-
-func (*stdioConn) Close() (err error) {
-	return nil
-}
-
-func (*stdioConn) LocalAddr() net.Addr {
-	return nil
-}
-
-func (*stdioConn) RemoteAddr() net.Addr {
-	return nil
-}
-
-func (*stdioConn) SetDeadline(_ time.Time) error {
-	return nil
-}
-
-func (*stdioConn) SetReadDeadline(_ time.Time) error {
-	return nil
-}
-
-func (*stdioConn) SetWriteDeadline(_ time.Time) error {
-	return nil
-}
diff --git a/coderd/audit/backends/postgres.go b/coderd/audit/backends/postgres.go
index db02580c8e1d0..631fcb0d01f4e 100644
--- a/coderd/audit/backends/postgres.go
+++ b/coderd/audit/backends/postgres.go
@@ -31,20 +31,7 @@ func (b *postgresBackend) Decision() audit.FilterDecision {
 }
 
 func (b *postgresBackend) Export(ctx context.Context, alog database.AuditLog) error {
-	_, err := b.db.InsertAuditLog(ctx, database.InsertAuditLogParams{
-		ID:             alog.ID,
-		Time:           alog.Time,
-		UserID:         alog.UserID,
-		OrganizationID: alog.OrganizationID,
-		Ip:             alog.Ip,
-		UserAgent:      alog.UserAgent,
-		ResourceType:   alog.ResourceType,
-		ResourceID:     alog.ResourceID,
-		ResourceTarget: alog.ResourceTarget,
-		Action:         alog.Action,
-		Diff:           alog.Diff,
-		StatusCode:     alog.StatusCode,
-	})
+	_, err := b.db.InsertAuditLog(ctx, database.InsertAuditLogParams(alog))
 	if err != nil {
 		return xerrors.Errorf("insert audit log: %w", err)
 	}
diff --git a/coderd/coderdtest/coderdtest.go b/coderd/coderdtest/coderdtest.go
index e205e272db3ce..a77f6bde5575a 100644
--- a/coderd/coderdtest/coderdtest.go
+++ b/coderd/coderdtest/coderdtest.go
@@ -77,9 +77,9 @@ func New(t *testing.T, options *Options) *codersdk.Client {
 	db := databasefake.New()
 	pubsub := database.NewPubsubInMemory()
 	if os.Getenv("DB") != "" {
-		connectionURL, close, err := postgres.Open()
+		connectionURL, closePg, err := postgres.Open()
 		require.NoError(t, err)
-		t.Cleanup(close)
+		t.Cleanup(closePg)
 		sqlDB, err := sql.Open("postgres", connectionURL)
 		require.NoError(t, err)
 		t.Cleanup(func() {
diff --git a/coderd/database/databasefake/databasefake.go b/coderd/database/databasefake/databasefake.go
index f1ec50bbbbe2f..57fabb6e82117 100644
--- a/coderd/database/databasefake/databasefake.go
+++ b/coderd/database/databasefake/databasefake.go
@@ -1733,20 +1733,7 @@ func (q *fakeQuerier) InsertAuditLog(_ context.Context, arg database.InsertAudit
 	q.mutex.Lock()
 	defer q.mutex.Unlock()
 
-	alog := database.AuditLog{
-		ID:             arg.ID,
-		Time:           arg.Time,
-		UserID:         arg.UserID,
-		OrganizationID: arg.OrganizationID,
-		Ip:             arg.Ip,
-		UserAgent:      arg.UserAgent,
-		ResourceType:   arg.ResourceType,
-		ResourceID:     arg.ResourceID,
-		ResourceTarget: arg.ResourceTarget,
-		Action:         arg.Action,
-		Diff:           arg.Diff,
-		StatusCode:     arg.StatusCode,
-	}
+	alog := database.AuditLog(arg)
 
 	q.auditLogs = append(q.auditLogs, alog)
 	slices.SortFunc(q.auditLogs, func(a, b database.AuditLog) bool {
diff --git a/coderd/database/postgres/postgres_test.go b/coderd/database/postgres/postgres_test.go
index 8efac0f99a030..178a434c3be69 100644
--- a/coderd/database/postgres/postgres_test.go
+++ b/coderd/database/postgres/postgres_test.go
@@ -6,12 +6,11 @@ import (
 	"database/sql"
 	"testing"
 
+	_ "github.com/lib/pq"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/goleak"
 
 	"github.com/coder/coder/coderd/database/postgres"
-
-	_ "github.com/lib/pq"
 )
 
 func TestMain(m *testing.M) {
@@ -26,9 +25,9 @@ func TestPostgres(t *testing.T) {
 		return
 	}
 
-	connect, close, err := postgres.Open()
+	connect, closePg, err := postgres.Open()
 	require.NoError(t, err)
-	defer close()
+	defer closePg()
 	db, err := sql.Open("postgres", connect)
 	require.NoError(t, err)
 	err = db.Ping()
diff --git a/coderd/database/pubsub_test.go b/coderd/database/pubsub_test.go
index 9a4eb72999b8c..1312326a20a73 100644
--- a/coderd/database/pubsub_test.go
+++ b/coderd/database/pubsub_test.go
@@ -27,9 +27,9 @@ func TestPubsub(t *testing.T) {
 		ctx, cancelFunc := context.WithCancel(context.Background())
 		defer cancelFunc()
 
-		connectionURL, close, err := postgres.Open()
+		connectionURL, closePg, err := postgres.Open()
 		require.NoError(t, err)
-		defer close()
+		defer closePg()
 		db, err := sql.Open("postgres", connectionURL)
 		require.NoError(t, err)
 		defer db.Close()
@@ -56,9 +56,9 @@ func TestPubsub(t *testing.T) {
 		t.Parallel()
 		ctx, cancelFunc := context.WithCancel(context.Background())
 		defer cancelFunc()
-		connectionURL, close, err := postgres.Open()
+		connectionURL, closePg, err := postgres.Open()
 		require.NoError(t, err)
-		defer close()
+		defer closePg()
 		db, err := sql.Open("postgres", connectionURL)
 		require.NoError(t, err)
 		defer db.Close()
diff --git a/coderd/httpmw/oauth2.go b/coderd/httpmw/oauth2.go
index b61aa09e4990b..ba14f8dafdfc0 100644
--- a/coderd/httpmw/oauth2.go
+++ b/coderd/httpmw/oauth2.go
@@ -48,7 +48,7 @@ func ExtractOAuth2(config OAuth2Config) func(http.Handler) http.Handler {
 		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 			if config == nil {
 				httpapi.Write(rw, http.StatusPreconditionRequired, httpapi.Response{
-					Message: fmt.Sprintf("The oauth2 method requested is not configured!"),
+					Message: "The oauth2 method requested is not configured!",
 				})
 				return
 			}
diff --git a/coderd/members.go b/coderd/members.go
index cff26042619ea..670e43fb68800 100644
--- a/coderd/members.go
+++ b/coderd/members.go
@@ -2,7 +2,6 @@ package coderd
 
 import (
 	"context"
-	"fmt"
 	"net/http"
 
 	"github.com/google/uuid"
@@ -29,7 +28,7 @@ func (api *api) putMemberRoles(rw http.ResponseWriter, r *http.Request) {
 	//	the selected organization. Until then, allow anarchy
 	if apiKey.UserID != user.ID {
 		httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
-			Message: fmt.Sprintf("modifying other users is not supported at this time"),
+			Message: "modifying other users is not supported at this time",
 		})
 		return
 	}
diff --git a/coderd/rbac/authz.go b/coderd/rbac/authz.go
index f11508ad2b099..39cd7ed102906 100644
--- a/coderd/rbac/authz.go
+++ b/coderd/rbac/authz.go
@@ -67,7 +67,7 @@ func (a RegoAuthorizer) Authorize(ctx context.Context, subjectID string, roles [
 
 	results, err := a.query.Eval(ctx, rego.EvalInput(input))
 	if err != nil {
-		return ForbiddenWithInternal(xerrors.Errorf("eval rego: %w, err"), input, results)
+		return ForbiddenWithInternal(xerrors.Errorf("eval rego: %w", err), input, results)
 	}
 
 	if len(results) != 1 {
diff --git a/coderd/userauth.go b/coderd/userauth.go
index 3b6b1f3f37aec..e2b52329b37a7 100644
--- a/coderd/userauth.go
+++ b/coderd/userauth.go
@@ -58,7 +58,7 @@ func (api *api) userOAuth2Github(rw http.ResponseWriter, r *http.Request) {
 	}
 	if selectedMembership == nil {
 		httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
-			Message: fmt.Sprintf("You aren't a member of the authorized Github organizations!"),
+			Message: "You aren't a member of the authorized Github organizations!",
 		})
 		return
 	}
diff --git a/coderd/users.go b/coderd/users.go
index c85a23f3f72bd..f6dc26ccb51fe 100644
--- a/coderd/users.go
+++ b/coderd/users.go
@@ -266,7 +266,7 @@ func (api *api) putUserProfile(rw http.ResponseWriter, r *http.Request) {
 			})
 		}
 		httpapi.Write(rw, http.StatusConflict, httpapi.Response{
-			Message: fmt.Sprintf("user already exists"),
+			Message: "user already exists",
 			Errors:  responseErrors,
 		})
 		return
@@ -391,7 +391,7 @@ func (api *api) putUserRoles(rw http.ResponseWriter, r *http.Request) {
 	apiKey := httpmw.APIKey(r)
 	if apiKey.UserID != user.ID {
 		httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
-			Message: fmt.Sprintf("modifying other users is not supported at this time"),
+			Message: "modifying other users is not supported at this time",
 		})
 		return
 	}
diff --git a/coderd/workspaces.go b/coderd/workspaces.go
index 0ac6ae516507c..aaa7ff8a38c39 100644
--- a/coderd/workspaces.go
+++ b/coderd/workspaces.go
@@ -213,7 +213,7 @@ func (api *api) postWorkspaceBuilds(rw http.ResponseWriter, r *http.Request) {
 			return xerrors.Errorf("insert provisioner job: %w", err)
 		}
 		state := createBuild.ProvisionerState
-		if state == nil || len(state) == 0 {
+		if len(state) == 0 {
 			state = priorHistory.ProvisionerState
 		}
 
diff --git a/codersdk/users.go b/codersdk/users.go
index 4388b0cfd4957..693277608d5b8 100644
--- a/codersdk/users.go
+++ b/codersdk/users.go
@@ -307,7 +307,7 @@ func (c *Client) userByIdentifier(ctx context.Context, ident string) (User, erro
 // Users returns all users according to the request parameters. If no parameters are set,
 // the default behavior is to return all users in a single page.
 func (c *Client) Users(ctx context.Context, req UsersRequest) ([]User, error) {
-	res, err := c.request(ctx, http.MethodGet, fmt.Sprintf("/api/v2/users"), nil,
+	res, err := c.request(ctx, http.MethodGet, "/api/v2/users", nil,
 		req.Pagination.asRequestOption(),
 		func(r *http.Request) {
 			q := r.URL.Query()
diff --git a/scripts/apitypings/main.go b/scripts/apitypings/main.go
index 0891439e723e3..4afcecc9cd2d3 100644
--- a/scripts/apitypings/main.go
+++ b/scripts/apitypings/main.go
@@ -176,7 +176,7 @@ func (g *Generator) generateAll() (*TypescriptTypes, error) {
 				st, _ := obj.Type().Underlying().(*types.Struct)
 				codeBlock, err := g.buildStruct(obj, st)
 				if err != nil {
-					return nil, xerrors.Errorf("generate %q: %w", obj.Name())
+					return nil, xerrors.Errorf("generate %q: %w", obj.Name(), err)
 				}
 				structs[obj.Name()] = codeBlock
 			case *types.Basic:
diff --git a/scripts/datadog-cireport/main.go b/scripts/datadog-cireport/main.go
index 644c1233ce445..2ff2220da6ab0 100644
--- a/scripts/datadog-cireport/main.go
+++ b/scripts/datadog-cireport/main.go
@@ -75,7 +75,7 @@ func main() {
 		"service":              "coder",
 		"_dd.cireport_version": "2",
 
-		"test.traits": fmt.Sprintf(`{"database":["%s"], "category":["%s"]}`,
+		"test.traits": fmt.Sprintf(`{"database":[%q], "category":[%q]}`,
 			os.Getenv("DD_DATABASE"), os.Getenv("DD_CATEGORY")),
 
 		// Additional tags found in DataDog docs. See: