diff --git a/cache/blobs.go b/cache/blobs.go
index 87cf5f2fb..34a22bc52 100644
--- a/cache/blobs.go
+++ b/cache/blobs.go
@@ -70,7 +70,6 @@ func computeBlobChain(ctx context.Context, sr *immutableRef, createIfNeeded bool
 	switch sr.kind() {
 	case Merge:
 		for _, parent := range sr.mergeParents {
-			parent := parent
 			eg.Go(func() error {
 				return computeBlobChain(ctx, parent, createIfNeeded, comp, s, filter)
 			})
diff --git a/cache/contenthash/checksum.go b/cache/contenthash/checksum.go
index d2c6b0118..786c5f73e 100644
--- a/cache/contenthash/checksum.go
+++ b/cache/contenthash/checksum.go
@@ -569,8 +569,8 @@ func (cc *cacheContext) includedPaths(ctx context.Context, m *mount, p string, o
 		//
 		// When wildcards are enabled, this translation applies to the
 		// portion of 'p' before any wildcards.
-		if strings.HasPrefix(fn, resolvedPrefix) {
-			fn = origPrefix + strings.TrimPrefix(fn, resolvedPrefix)
+		if after, ok := strings.CutPrefix(fn, resolvedPrefix); ok {
+			fn = origPrefix + after
 		}
 
 		for len(parentDirHeaders) != 0 {
diff --git a/cache/contenthash/path_test.go b/cache/contenthash/path_test.go
index a6d895a5f..3af813e47 100644
--- a/cache/contenthash/path_test.go
+++ b/cache/contenthash/path_test.go
@@ -104,7 +104,6 @@ func TestRootPathSymlinks(t *testing.T) {
 		{"link3/link1/../link1/final", true, "/target"},             // link3/target2
 		{"link3/link1/../link1/final", false, "/link1/final"},       // link3/target2
 	} {
-		test := test // capture range variable
 		t.Run(fmt.Sprintf("resolve(%q,followTrailing=%v)", test.path, test.followTrailing), func(t *testing.T) {
 			t.Parallel()
 
diff --git a/cache/contenthash/tarsum.go b/cache/contenthash/tarsum.go
index fb702962c..d1e91dc3c 100644
--- a/cache/contenthash/tarsum.go
+++ b/cache/contenthash/tarsum.go
@@ -49,8 +49,7 @@ func v1TarHeaderSelect(h *tar.Header) (orderedHeaders [][2]string) {
 	// Get extended attributes.
 	xAttrKeys := make([]string, 0, len(h.PAXRecords))
 	for k := range pax {
-		if strings.HasPrefix(k, "SCHILY.xattr.") {
-			k = strings.TrimPrefix(k, "SCHILY.xattr.")
+		if k, ok := strings.CutPrefix(k, "SCHILY.xattr."); ok {
 			if k == "security.capability" || !strings.HasPrefix(k, "security.") && !strings.HasPrefix(k, "system.") {
 				xAttrKeys = append(xAttrKeys, k)
 			}
diff --git a/cache/manager_test.go b/cache/manager_test.go
index fd03bab81..7d86fff73 100644
--- a/cache/manager_test.go
+++ b/cache/manager_test.go
@@ -1731,7 +1731,6 @@ func TestGetRemotes(t *testing.T) {
 	for _, ir := range refs {
 		ir := ir.(*immutableRef)
 		for _, compressionType := range []compression.Type{compression.Uncompressed, compression.Gzip, compression.EStargz, compression.Zstd} {
-			compressionType := compressionType
 			refCfg := config.RefConfig{Compression: compression.New(compressionType).SetForce(true)}
 			eg.Go(func() error {
 				remotes, err := ir.GetRemotes(egctx, true, refCfg, false, nil)
@@ -1820,7 +1819,6 @@ func TestGetRemotes(t *testing.T) {
 		variantsMapMu.Unlock()
 		require.True(t, ok, ir.ID())
 		for _, compressionType := range []compression.Type{compression.Uncompressed, compression.Gzip, compression.EStargz, compression.Zstd} {
-			compressionType := compressionType
 			refCfg := config.RefConfig{Compression: compression.New(compressionType)}
 			eg.Go(func() error {
 				remotes, err := ir.GetRemotes(egctx, false, refCfg, true, nil)
@@ -1877,7 +1875,6 @@ func checkVariantsCoverage(ctx context.Context, t *testing.T, variants idxToVari
 	// check the lowers as well
 	eg, egctx := errgroup.WithContext(ctx)
 	for _, lowers := range got {
-		lowers := lowers
 		eg.Go(func() error {
 			checkVariantsCoverage(egctx, t, variants, idx-1, lowers, nil) // expect all compression variants
 			return nil
diff --git a/cache/refs.go b/cache/refs.go
index eeee69dad..209da046f 100644
--- a/cache/refs.go
+++ b/cache/refs.go
@@ -1026,7 +1026,6 @@ func (sr *immutableRef) Extract(ctx context.Context, s session.Group) (rerr erro
 func (sr *immutableRef) withRemoteSnapshotLabelsStargzMode(ctx context.Context, s session.Group, f func()) error {
 	dhs := sr.descHandlers
 	for _, r := range sr.layerChain() {
-		r := r
 		info, err := r.cm.Snapshotter.Stat(ctx, r.getSnapshotID())
 		if err != nil && !cerrdefs.IsNotFound(err) {
 			return err
@@ -1069,7 +1068,6 @@ func (sr *immutableRef) prepareRemoteSnapshotsStargzMode(ctx context.Context, s
 	_, err := g.Do(ctx, sr.ID()+"-prepare-remote-snapshot", func(ctx context.Context) (_ *leaseutil.LeaseRef, rerr error) {
 		dhs := sr.descHandlers
 		for _, r := range sr.layerChain() {
-			r := r
 			snapshotID := r.getSnapshotID()
 			if _, err := r.cm.Snapshotter.Stat(ctx, snapshotID); err == nil {
 				continue
@@ -1635,16 +1633,16 @@ func readonlyOverlay(opt []string) []string {
 	out := make([]string, 0, len(opt))
 	upper := ""
 	for _, o := range opt {
-		if strings.HasPrefix(o, "upperdir=") {
-			upper = strings.TrimPrefix(o, "upperdir=")
+		if after, ok := strings.CutPrefix(o, "upperdir="); ok {
+			upper = after
 		} else if !strings.HasPrefix(o, "workdir=") {
 			out = append(out, o)
 		}
 	}
 	if upper != "" {
 		for i, o := range out {
-			if strings.HasPrefix(o, "lowerdir=") {
-				out[i] = "lowerdir=" + upper + ":" + strings.TrimPrefix(o, "lowerdir=")
+			if after, ok := strings.CutPrefix(o, "lowerdir="); ok {
+				out[i] = "lowerdir=" + upper + ":" + after
 			}
 		}
 	}
diff --git a/cache/remote.go b/cache/remote.go
index 2983eaaa5..c0e3cc6b4 100644
--- a/cache/remote.go
+++ b/cache/remote.go
@@ -121,7 +121,6 @@ func getAvailableBlobs(ctx context.Context, cs content.Store, chain *solver.Remo
 	}
 	var res []*solver.Remote
 	for _, desc := range descs {
-		desc := desc
 		if len(parents) == 0 { // bottommost ref
 			res = append(res, &solver.Remote{
 				Descriptors: []ocispecs.Descriptor{desc},
@@ -277,7 +276,6 @@ func (mp *lazyMultiProvider) Info(ctx context.Context, dgst digest.Digest) (cont
 func (mp *lazyMultiProvider) Unlazy(ctx context.Context) error {
 	eg, egctx := errgroup.WithContext(ctx)
 	for _, p := range mp.plist {
-		p := p
 		eg.Go(func() error {
 			return p.Unlazy(egctx)
 		})
diff --git a/cache/remotecache/gha/gha_test.go b/cache/remotecache/gha/gha_test.go
index fbae1d627..9434f3dd5 100644
--- a/cache/remotecache/gha/gha_test.go
+++ b/cache/remotecache/gha/gha_test.go
@@ -82,10 +82,10 @@ func testBasicGhaCacheImportExportExtraTimeout(t *testing.T, sb integration.Sand
 
 	scope := "buildkit-" + t.Name()
 	if ref := os.Getenv("GITHUB_REF"); ref != "" {
-		if strings.HasPrefix(ref, "refs/heads/") {
-			scope += "-" + strings.TrimPrefix(ref, "refs/heads/")
-		} else if strings.HasPrefix(ref, "refs/tags/") {
-			scope += "-" + strings.TrimPrefix(ref, "refs/tags/")
+		if after, ok := strings.CutPrefix(ref, "refs/heads/"); ok {
+			scope += "-" + after
+		} else if after, ok := strings.CutPrefix(ref, "refs/tags/"); ok {
+			scope += "-" + after
 		} else if strings.HasPrefix(ref, "refs/pull/") {
 			scope += "-pr" + strings.TrimPrefix(strings.TrimSuffix(strings.TrimSuffix(ref, "/head"), "/merge"), "refs/pull/")
 		}
diff --git a/client/build_test.go b/client/build_test.go
index 2198dce55..72055706c 100644
--- a/client/build_test.go
+++ b/client/build_test.go
@@ -1469,7 +1469,6 @@ func testClientGatewayExecError(t *testing.T, sb integration.Sandbox) {
 		}}
 
 		for _, tt := range tests {
-			tt := tt
 			t.Run(tt.Name, func(t *testing.T) {
 				def, err := tt.State.Marshal(ctx)
 				require.NoError(t, err)
@@ -1722,7 +1721,6 @@ func testClientGatewayExecFileActionError(t *testing.T, sb integration.Sandbox)
 		}}
 
 		for _, tt := range tests {
-			tt := tt
 			t.Run(tt.Name, func(t *testing.T) {
 				def, err := tt.State.Marshal(ctx)
 				require.NoError(t, err)
diff --git a/client/client.go b/client/client.go
index 2ca45ca5f..ff3b6669b 100644
--- a/client/client.go
+++ b/client/client.go
@@ -151,7 +151,8 @@ func New(ctx context.Context, address string, opts ...ClientOpt) (*Client, error
 	gopts = append(gopts, grpc.WithStreamInterceptor(grpcerrors.StreamClientInterceptor))
 	gopts = append(gopts, customDialOptions...)
 
-	//nolint:staticcheck // ignore SA1019 NewClient has different behavior and needs to be tested
+	// ignore SA1019 NewClient has different behavior and needs to be tested
+	//nolint:staticcheck
 	conn, err := grpc.DialContext(ctx, address, gopts...)
 	if err != nil {
 		return nil, errors.Wrapf(err, "failed to dial %q . make sure buildkitd is running", address)
diff --git a/client/client_test.go b/client/client_test.go
index f95055c69..89ae22bad 100644
--- a/client/client_test.go
+++ b/client/client_test.go
@@ -1306,15 +1306,12 @@ func testFrontendImageNaming(t *testing.T, sb integration.Sandbox) {
 
 	// A caller provided name takes precedence over one returned by the frontend. Iterate over both options.
 	for _, winner := range []string{"frontend", "caller"} {
-		winner := winner // capture loop variable.
-
 		// The double layer of `t.Run` here is required so
 		// that the inner-most tests (with the actual
 		// functionality) have definitely completed before the
 		// sandbox and registry cleanups (defered above) are run.
 		t.Run(winner, func(t *testing.T) {
 			for _, exp := range []string{ExporterOCI, ExporterDocker, ExporterImage} {
-				exp := exp // capture loop variable.
 				t.Run(exp, func(t *testing.T) {
 					destDir := t.TempDir()
 
@@ -4796,7 +4793,6 @@ func testPullZstdImage(t *testing.T, sb integration.Sandbox) {
 	integration.SkipOnPlatform(t, "windows")
 	workers.CheckFeatureCompat(t, sb, workers.FeatureDirectPush)
 	for _, ociMediaTypes := range []bool{true, false} {
-		ociMediaTypes := ociMediaTypes
 		t.Run(t.Name()+fmt.Sprintf("/ociMediaTypes=%t", ociMediaTypes), func(t *testing.T) {
 			c, err := New(sb.Context(), sb.Address())
 			require.NoError(t, err)
@@ -5888,7 +5884,6 @@ func testCacheExportIgnoreError(t *testing.T, sb integration.Sandbox) {
 	for _, ignoreError := range ignoreErrorValues {
 		ignoreErrStr := strconv.FormatBool(ignoreError)
 		for n, test := range tests {
-			n := n
 			require.Equal(t, 1, len(test.Exports))
 			require.Equal(t, 1, len(test.CacheExports))
 			require.NotEmpty(t, test.CacheExports[0].Attrs)
@@ -6464,9 +6459,7 @@ func testRegistryEmptyCacheExport(t *testing.T, sb integration.Sandbox) {
 	)
 
 	for _, ociMediaTypes := range []bool{true, false} {
-		ociMediaTypes := ociMediaTypes
 		for _, imageManifest := range []bool{true, false} {
-			imageManifest := imageManifest
 			if imageManifest && !ociMediaTypes {
 				// invalid configuration for remote cache
 				continue
@@ -11296,7 +11289,6 @@ func testSourcePolicy(t *testing.T, sb integration.Sandbox) {
 		},
 	}
 	for i, tc := range testCases {
-		tc := tc
 		t.Run(strconv.Itoa(i), func(t *testing.T) {
 			_, err = c.Build(sb.Context(), SolveOpt{SourcePolicy: tc.srcPol}, "", frontend, nil)
 			if tc.expectedErr == "" {
diff --git a/client/llb/definition_test.go b/client/llb/definition_test.go
index 4e8bed333..ef71bd194 100644
--- a/client/llb/definition_test.go
+++ b/client/llb/definition_test.go
@@ -27,7 +27,6 @@ func TestDefinitionEquivalence(t *testing.T) {
 		{"platform constraint", Image("ref", LinuxArm64)},
 		{"mount", Image("busybox").Run(Shlex(`sh -c "echo foo > /out/foo"`)).AddMount("/out", Scratch())},
 	} {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -144,7 +143,6 @@ func TestDefinitionNil(t *testing.T) {
 func testParallelWalk(ctx context.Context, out Output) error {
 	eg, egCtx := errgroup.WithContext(ctx)
 	for _, o := range out.Vertex(ctx, nil).Inputs() {
-		o := o
 		eg.Go(func() error {
 			return testParallelWalk(egCtx, o)
 		})
diff --git a/client/llb/llbtest/platform_test.go b/client/llb/llbtest/platform_test.go
index 8fbae50b9..5b2366e5d 100644
--- a/client/llb/llbtest/platform_test.go
+++ b/client/llb/llbtest/platform_test.go
@@ -229,8 +229,8 @@ func getenv(e solver.Edge, k string) (string, bool) {
 	env := toOp(e).GetExec().Meta.Env
 	k = k + "="
 	for _, e := range env {
-		if strings.HasPrefix(e, k) {
-			return strings.TrimPrefix(e, k), true
+		if after, ok := strings.CutPrefix(e, k); ok {
+			return after, true
 		}
 	}
 	return "", false
diff --git a/client/solve.go b/client/solve.go
index d9a177fd6..603211261 100644
--- a/client/solve.go
+++ b/client/solve.go
@@ -402,8 +402,7 @@ func prepareSyncedFiles(def *llb.Definition, localMounts map[string]fsutil.FS) (
 				return nil, errors.Wrap(err, "failed to parse llb proto op")
 			}
 			if src := op.GetSource(); src != nil {
-				if strings.HasPrefix(src.Identifier, "local://") {
-					name := strings.TrimPrefix(src.Identifier, "local://")
+				if name, ok := strings.CutPrefix(src.Identifier, "local://"); ok {
 					mount, ok := localMounts[name]
 					if !ok {
 						return nil, errors.Errorf("local directory %s not enabled", name)
diff --git a/cmd/buildctl/buildctl_test.go b/cmd/buildctl/buildctl_test.go
index fce72a981..c3c6779df 100644
--- a/cmd/buildctl/buildctl_test.go
+++ b/cmd/buildctl/buildctl_test.go
@@ -115,7 +115,6 @@ func TestWriteMetadataFile(t *testing.T) {
 	}
 
 	for _, tt := range cases {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			fname := path.Join(tmpdir, "metadata_"+tt.name)
 			require.NoError(t, writeMetadataFile(fname, tt.exporterResponse))
diff --git a/cmd/buildkitd/main_oci_worker.go b/cmd/buildkitd/main_oci_worker.go
index f50a9f461..658a334fc 100644
--- a/cmd/buildkitd/main_oci_worker.go
+++ b/cmd/buildkitd/main_oci_worker.go
@@ -366,7 +366,8 @@ func snapshotterFactory(commonRoot string, cfg config.OCIConfig, sm *session.Man
 				grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(defaults.DefaultMaxRecvMsgSize)),
 				grpc.WithDefaultCallOptions(grpc.MaxCallSendMsgSize(defaults.DefaultMaxSendMsgSize)),
 			}
-			//nolint:staticcheck // ignore SA1019 NewClient has different behavior and needs to be tested
+			// ignore SA1019 NewClient has different behavior and needs to be tested
+			//nolint:staticcheck
 			conn, err := grpc.Dial(dialer.DialAddress(address), gopts...)
 			if err != nil {
 				return nil, errors.Wrapf(err, "failed to dial %q", address)
@@ -487,8 +488,8 @@ func sourceWithSession(hosts docker.RegistryHosts, sm *session.Manager) sgzsourc
 		// to the snapshotter API. So, first, get all these IDs
 		var ids []string
 		for k := range labels {
-			if strings.HasPrefix(k, targetRefLabel+".") {
-				ids = append(ids, strings.TrimPrefix(k, targetRefLabel+"."))
+			if after, ok := strings.CutPrefix(k, targetRefLabel+"."); ok {
+				ids = append(ids, after)
 			}
 		}
 
diff --git a/contrib/cdisetup/nvidia/nvidia.go b/contrib/cdisetup/nvidia/nvidia.go
index 88b70b419..00063c338 100644
--- a/contrib/cdisetup/nvidia/nvidia.go
+++ b/contrib/cdisetup/nvidia/nvidia.go
@@ -284,8 +284,7 @@ func getOSID() (string, error) {
 	scanner := bufio.NewScanner(file)
 	for scanner.Scan() {
 		line := scanner.Text()
-		if strings.HasPrefix(line, "ID=") {
-			id := strings.TrimPrefix(line, "ID=")
+		if id, ok := strings.CutPrefix(line, "ID="); ok {
 			return strings.Trim(id, `"`), nil // Remove potential quotes
 		}
 	}
diff --git a/executor/oci/resolvconf_test.go b/executor/oci/resolvconf_test.go
index 5de1f12c7..a88606716 100644
--- a/executor/oci/resolvconf_test.go
+++ b/executor/oci/resolvconf_test.go
@@ -103,7 +103,6 @@ func TestResolvConf(t *testing.T) {
 	}
 
 	for _, tt := range cases {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ctx := context.Background()
 			tempDir := t.TempDir()
diff --git a/exporter/containerimage/export.go b/exporter/containerimage/export.go
index 58d2623b4..f9a00ae4c 100644
--- a/exporter/containerimage/export.go
+++ b/exporter/containerimage/export.go
@@ -333,7 +333,6 @@ func (e *imageExporterInstance) Export(ctx context.Context, src *exporter.Source
 					}
 					eg, ctx := errgroup.WithContext(ctx)
 					for _, ref := range refs {
-						ref := ref
 						eg.Go(func() error {
 							remotes, err := ref.GetRemotes(ctx, false, e.opts.RefCfg, false, session.NewGroup(sessionID))
 							if err != nil {
diff --git a/exporter/oci/export.go b/exporter/oci/export.go
index c1bee4e4c..c6650b0a2 100644
--- a/exporter/oci/export.go
+++ b/exporter/oci/export.go
@@ -235,7 +235,6 @@ func (e *imageExporterInstance) Export(ctx context.Context, src *exporter.Source
 	eg, egCtx := errgroup.WithContext(ctx)
 	mprovider := contentutil.NewMultiProvider(e.opt.ImageWriter.ContentStore())
 	for _, ref := range refs {
-		ref := ref
 		eg.Go(func() error {
 			remotes, err := ref.GetRemotes(egCtx, false, e.opts.RefCfg, false, session.NewGroup(sessionID))
 			if err != nil {
diff --git a/exporter/verifier/opts.go b/exporter/verifier/opts.go
index 1e580c57f..b9f13b494 100644
--- a/exporter/verifier/opts.go
+++ b/exporter/verifier/opts.go
@@ -32,8 +32,8 @@ func CaptureFrontendOpts[T comparable](m map[string]string, res *result.Result[T
 
 	req.Labels = map[string]string{}
 	for k, v := range m {
-		if strings.HasPrefix(k, labelsPrefix) {
-			req.Labels[strings.TrimPrefix(k, labelsPrefix)] = v
+		if after, ok := strings.CutPrefix(k, labelsPrefix); ok {
+			req.Labels[after] = v
 		}
 	}
 	req.Request = m[keyRequestID]
diff --git a/frontend/attestations/parse.go b/frontend/attestations/parse.go
index a3d5ff5db..2b2ed2499 100644
--- a/frontend/attestations/parse.go
+++ b/frontend/attestations/parse.go
@@ -43,12 +43,12 @@ func Validate(values map[string]map[string]string) (map[string]map[string]string
 func Parse(values map[string]string) (map[string]map[string]string, error) {
 	attests := make(map[string]string)
 	for k, v := range values {
-		if strings.HasPrefix(k, "attest:") {
-			attests[strings.ToLower(strings.TrimPrefix(k, "attest:"))] = v
+		if after, ok := strings.CutPrefix(k, "attest:"); ok {
+			attests[strings.ToLower(after)] = v
 			continue
 		}
-		if strings.HasPrefix(k, "build-arg:BUILDKIT_ATTEST_") {
-			attests[strings.ToLower(strings.TrimPrefix(k, "build-arg:BUILDKIT_ATTEST_"))] = v
+		if after, ok := strings.CutPrefix(k, "build-arg:BUILDKIT_ATTEST_"); ok {
+			attests[strings.ToLower(after)] = v
 			continue
 		}
 	}
diff --git a/frontend/dockerfile/dockerfile_test.go b/frontend/dockerfile/dockerfile_test.go
index ac47a37f4..3a6ef3e67 100644
--- a/frontend/dockerfile/dockerfile_test.go
+++ b/frontend/dockerfile/dockerfile_test.go
@@ -6993,7 +6993,6 @@ RUN  reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Param
 		},
 	}
 	for _, tt := range cases {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			_, err = f.Solve(sb.Context(), c, client.SolveOpt{
 				FrontendAttrs: tt.attrs,
diff --git a/frontend/dockerfile/instructions/parse.go b/frontend/dockerfile/instructions/parse.go
index 01a7c7ecd..b44a6a384 100644
--- a/frontend/dockerfile/instructions/parse.go
+++ b/frontend/dockerfile/instructions/parse.go
@@ -831,8 +831,8 @@ func getComment(comments []string, name string) string {
 		return ""
 	}
 	for _, line := range comments {
-		if strings.HasPrefix(line, name+" ") {
-			return strings.TrimPrefix(line, name+" ")
+		if after, ok := strings.CutPrefix(line, name+" "); ok {
+			return after
 		}
 	}
 	return ""
diff --git a/frontend/dockerfile/instructions/parse_test.go b/frontend/dockerfile/instructions/parse_test.go
index e1adaa6d7..d3ae1e282 100644
--- a/frontend/dockerfile/instructions/parse_test.go
+++ b/frontend/dockerfile/instructions/parse_test.go
@@ -153,7 +153,6 @@ func TestParseOptInterval(t *testing.T) {
 
 func TestNilLinter(t *testing.T) {
 	for cmd := range command.Commands {
-		cmd := cmd
 		t.Run(cmd, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/frontend/dockerfile/shell/lex_test.go b/frontend/dockerfile/shell/lex_test.go
index cb8ffda4a..aa18532fa 100644
--- a/frontend/dockerfile/shell/lex_test.go
+++ b/frontend/dockerfile/shell/lex_test.go
@@ -585,7 +585,6 @@ func TestProcessWithMatches(t *testing.T) {
 	}
 
 	for _, c := range tc {
-		c := c
 		t.Run(c.input, func(t *testing.T) {
 			result, err := shlex.ProcessWordWithMatches(c.input, envsFromMap(c.envs))
 			w := result.Result
diff --git a/frontend/dockerui/attr.go b/frontend/dockerui/attr.go
index 259100b46..e06d70e20 100644
--- a/frontend/dockerui/attr.go
+++ b/frontend/dockerui/attr.go
@@ -128,8 +128,8 @@ func parseSourceDateEpoch(v string) (*time.Time, error) {
 func parseLocalSessionIDs(opt map[string]string) map[string]string {
 	m := map[string]string{}
 	for k, v := range opt {
-		if strings.HasPrefix(k, localSessionIDPrefix) {
-			m[strings.TrimPrefix(k, localSessionIDPrefix)] = v
+		if after, ok := strings.CutPrefix(k, localSessionIDPrefix); ok {
+			m[after] = v
 		}
 	}
 	return m
@@ -138,8 +138,8 @@ func parseLocalSessionIDs(opt map[string]string) map[string]string {
 func filter(opt map[string]string, key string) map[string]string {
 	m := map[string]string{}
 	for k, v := range opt {
-		if strings.HasPrefix(k, key) {
-			m[strings.TrimPrefix(k, key)] = v
+		if after, ok := strings.CutPrefix(k, key); ok {
+			m[after] = v
 		}
 	}
 	return m
diff --git a/frontend/dockerui/build.go b/frontend/dockerui/build.go
index 6ced71d67..233329b61 100644
--- a/frontend/dockerui/build.go
+++ b/frontend/dockerui/build.go
@@ -22,7 +22,6 @@ func (bc *Client) Build(ctx context.Context, fn BuildFunc) (*ResultBuilder, erro
 
 	targets := make([]*ocispecs.Platform, 0, len(bc.TargetPlatforms))
 	for _, p := range bc.TargetPlatforms {
-		p := p
 		targets = append(targets, &p)
 	}
 	if len(targets) == 0 {
@@ -106,7 +105,6 @@ func (rb *ResultBuilder) Finalize() (*client.Result, error) {
 func (rb *ResultBuilder) EachPlatform(ctx context.Context, fn func(ctx context.Context, id string, p ocispecs.Platform) error) error {
 	eg, ctx := errgroup.WithContext(ctx)
 	for _, p := range rb.expPlatforms.Platforms {
-		p := p
 		eg.Go(func() error {
 			return fn(ctx, p.ID, p.Platform)
 		})
diff --git a/frontend/gateway/container/container.go b/frontend/gateway/container/container.go
index 59b447b00..df34d9157 100644
--- a/frontend/gateway/container/container.go
+++ b/frontend/gateway/container/container.go
@@ -105,13 +105,11 @@ func NewContainer(ctx context.Context, cm cache.Manager, exec executor.Executor,
 	ctr.mounts = p.Mounts
 
 	for _, o := range p.OutputRefs {
-		o := o
 		ctr.cleanup = append(ctr.cleanup, func() error {
 			return o.Ref.Release(context.TODO())
 		})
 	}
 	for _, active := range p.Actives {
-		active := active
 		ctr.cleanup = append(ctr.cleanup, func() error {
 			return active.Ref.Release(context.TODO())
 		})
diff --git a/frontend/gateway/gateway.go b/frontend/gateway/gateway.go
index a42fc617e..90ea7dfa5 100644
--- a/frontend/gateway/gateway.go
+++ b/frontend/gateway/gateway.go
@@ -91,8 +91,8 @@ type gatewayFrontend struct {
 func filterPrefix(opts map[string]string, pfx string) map[string]string {
 	m := map[string]string{}
 	for k, v := range opts {
-		if strings.HasPrefix(k, pfx) {
-			m[strings.TrimPrefix(k, pfx)] = v
+		if after, ok := strings.CutPrefix(k, pfx); ok {
+			m[after] = v
 		}
 	}
 	return m
diff --git a/hack/dockerfiles/lint.Dockerfile b/hack/dockerfiles/lint.Dockerfile
index 6ba7b6ad0..6d58cf4d7 100644
--- a/hack/dockerfiles/lint.Dockerfile
+++ b/hack/dockerfiles/lint.Dockerfile
@@ -6,10 +6,9 @@ ARG XX_VERSION=1.6.1
 ARG PROTOLINT_VERSION=0.50.5
 ARG GOLANGCI_LINT_VERSION=v2.1.5
 ARG GOLANGCI_FROM_SOURCE=false
-# v0.31 requires go1.24
-ARG GOPLS_VERSION=v0.30.0
-# GOPLS_ANALYZERS defines gopls analyzers to be run. disabled by default: deprecated unusedvariable simplifyrange
-ARG GOPLS_ANALYZERS="embeddirective fillreturns hostport infertypeargs modernize nonewvars noresultvalues simplifycompositelit simplifyslice unusedparams yield"
+ARG GOPLS_VERSION=v0.33.0
+# GOPLS_ANALYZERS defines gopls analyzers to be run. disabled by default: deprecated simplifyrange unusedfunc unusedvariable
+ARG GOPLS_ANALYZERS="embeddirective fillreturns infertypeargs maprange modernize nonewvars noresultvalues simplifycompositelit simplifyslice unusedparams yield"
 
 FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS golang-base
 FROM --platform=$BUILDPLATFORM yoheimuta/protolint:${PROTOLINT_VERSION} AS protolint-base
diff --git a/session/filesync/filesync.go b/session/filesync/filesync.go
index 2a402e445..230493f16 100644
--- a/session/filesync/filesync.go
+++ b/session/filesync/filesync.go
@@ -336,8 +336,8 @@ func (sp *SyncTarget) DiffCopy(stream FileSend_DiffCopyServer) (err error) {
 	opts, _ := metadata.FromIncomingContext(stream.Context()) // if no metadata continue with empty object
 	md := map[string]string{}
 	for k, v := range opts {
-		if strings.HasPrefix(k, keyExporterMetaPrefix) {
-			md[strings.TrimPrefix(k, keyExporterMetaPrefix)] = strings.Join(v, ",")
+		if after, ok0 := strings.CutPrefix(k, keyExporterMetaPrefix); ok0 {
+			md[after] = strings.Join(v, ",")
 		}
 	}
 	wc, err := f(md)
diff --git a/snapshot/diffapply_linux.go b/snapshot/diffapply_linux.go
index 3bb4216f4..6ddc06c66 100644
--- a/snapshot/diffapply_linux.go
+++ b/snapshot/diffapply_linux.go
@@ -166,10 +166,10 @@ func applierFor(dest Mountable, tryCrossSnapshotLink, userxattr bool) (_ *applie
 
 	if overlay.IsOverlayMountType(mnt) {
 		for _, opt := range mnt.Options {
-			if strings.HasPrefix(opt, "upperdir=") {
-				a.root = strings.TrimPrefix(opt, "upperdir=")
-			} else if strings.HasPrefix(opt, "lowerdir=") {
-				a.lowerdirs = strings.Split(strings.TrimPrefix(opt, "lowerdir="), ":")
+			if after, ok := strings.CutPrefix(opt, "upperdir="); ok {
+				a.root = after
+			} else if after, ok := strings.CutPrefix(opt, "lowerdir="); ok {
+				a.lowerdirs = strings.Split(after, ":")
 			}
 		}
 		if a.root == "" {
diff --git a/snapshot/snapshotter_test.go b/snapshot/snapshotter_test.go
index a9cb00816..21c4dc6bd 100644
--- a/snapshot/snapshotter_test.go
+++ b/snapshot/snapshotter_test.go
@@ -106,7 +106,6 @@ func newSnapshotter(ctx context.Context, t *testing.T, snapshotterName string) (
 
 func TestMerge(t *testing.T) {
 	for _, snName := range []string{"overlayfs", "native", "native-nohardlink"} {
-		snName := snName
 		t.Run(snName, func(t *testing.T) {
 			t.Parallel()
 			if snName == "overlayfs" {
@@ -310,7 +309,6 @@ func TestMerge(t *testing.T) {
 
 func TestHardlinks(t *testing.T) {
 	for _, snName := range []string{"overlayfs", "native"} {
-		snName := snName
 		t.Run(snName, func(t *testing.T) {
 			t.Parallel()
 			if snName == "overlayfs" {
@@ -376,7 +374,6 @@ func TestHardlinks(t *testing.T) {
 func TestMergeFileCapabilities(t *testing.T) {
 	requireRoot(t)
 	for _, snName := range []string{"overlayfs", "native", "native-nohardlink"} {
-		snName := snName
 		t.Run(snName, func(t *testing.T) {
 			t.Parallel()
 
@@ -410,7 +407,6 @@ func TestMergeFileCapabilities(t *testing.T) {
 
 func TestUsage(t *testing.T) {
 	for _, snName := range []string{"overlayfs", "native", "native-nohardlink"} {
-		snName := snName
 		t.Run(snName, func(t *testing.T) {
 			t.Parallel()
 			if snName == "overlayfs" {
diff --git a/solver/combinedcache.go b/solver/combinedcache.go
index db99aaf0d..60d9ae47c 100644
--- a/solver/combinedcache.go
+++ b/solver/combinedcache.go
@@ -131,7 +131,6 @@ func (cm *combinedCacheManager) Records(ctx context.Context, ck *CacheKey) ([]*C
 
 	eg, _ := errgroup.WithContext(context.TODO())
 	for _, c := range cms {
-		c := c
 		eg.Go(func() error {
 			recs, err := c.Records(ctx, ck)
 			if err != nil {
diff --git a/solver/llbsolver/ops/exec_test.go b/solver/llbsolver/ops/exec_test.go
index 629f8a2dc..e0a5af9a5 100644
--- a/solver/llbsolver/ops/exec_test.go
+++ b/solver/llbsolver/ops/exec_test.go
@@ -107,7 +107,6 @@ func TestExecOpCacheMap(t *testing.T) {
 
 	ctx := context.Background()
 	for _, tc := range testCases {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -192,7 +191,6 @@ func TestExecOpContentCache(t *testing.T) {
 
 	ctx := context.Background()
 	for _, tc := range testCases {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/solver/scheduler_test.go b/solver/scheduler_test.go
index c5ddceec8..823ff99a1 100644
--- a/solver/scheduler_test.go
+++ b/solver/scheduler_test.go
@@ -736,7 +736,7 @@ func TestHugeGraph(t *testing.T) {
 	nodes := 1000
 
 	g, v := generateSubGraph(nodes)
-	// printGraph(g, "")
+	// PrintGraph(g, "")
 	g.Vertex.(*vertexSum).setupCallCounters()
 
 	res, err := j0.Build(ctx, g)
@@ -3925,12 +3925,11 @@ func (v *vertexSubBuild) Acquire(ctx context.Context) (ReleaseFunc, error) {
 	return func() {}, nil
 }
 
-//nolint:unused
-func printGraph(e Edge, pfx string) {
+func PrintGraph(e Edge, pfx string) {
 	name := e.Vertex.Name()
 	fmt.Printf("%s %d %s\n", pfx, e.Index, name)
 	for _, inp := range e.Vertex.Inputs() {
-		printGraph(inp, pfx+"-->")
+		PrintGraph(inp, pfx+"-->")
 	}
 }
 
diff --git a/source/git/identifier_test.go b/source/git/identifier_test.go
index 6f9bc7e55..c272f581e 100644
--- a/source/git/identifier_test.go
+++ b/source/git/identifier_test.go
@@ -110,7 +110,6 @@ func TestNewGitIdentifier(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.url, func(t *testing.T) {
 			gi, err := NewGitIdentifier(tt.url)
 			require.NoError(t, err)
diff --git a/sourcepolicy/matcher_test.go b/sourcepolicy/matcher_test.go
index 7951f3e0c..7df31cf7c 100644
--- a/sourcepolicy/matcher_test.go
+++ b/sourcepolicy/matcher_test.go
@@ -318,7 +318,6 @@ func TestMatch(t *testing.T) {
 	}
 
 	for _, tc := range cases {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			matches, err := match(&selectorCache{Selector: tc.src}, tc.ref, tc.attrs)
 			if !tc.xErr {
diff --git a/util/gitutil/git_ref_test.go b/util/gitutil/git_ref_test.go
index fe4d094b6..d470a09fc 100644
--- a/util/gitutil/git_ref_test.go
+++ b/util/gitutil/git_ref_test.go
@@ -140,7 +140,6 @@ func TestParseGitRef(t *testing.T) {
 		},
 	}
 	for _, tt := range cases {
-		tt := tt
 		t.Run(tt.ref, func(t *testing.T) {
 			got, err := ParseGitRef(tt.ref)
 			if tt.expected == nil {
diff --git a/util/overlay/overlay_linux.go b/util/overlay/overlay_linux.go
index 223c6655d..076e83479 100644
--- a/util/overlay/overlay_linux.go
+++ b/util/overlay/overlay_linux.go
@@ -86,10 +86,10 @@ func GetOverlayLayers(m mount.Mount) ([]string, error) {
 	var uFound bool
 	var l []string // l[0] = bottommost
 	for _, o := range m.Options {
-		if strings.HasPrefix(o, "upperdir=") {
-			u, uFound = strings.TrimPrefix(o, "upperdir="), true
-		} else if strings.HasPrefix(o, "lowerdir=") {
-			l = strings.Split(strings.TrimPrefix(o, "lowerdir="), ":")
+		if after, ok := strings.CutPrefix(o, "upperdir="); ok {
+			u, uFound = after, true
+		} else if after, ok := strings.CutPrefix(o, "lowerdir="); ok {
+			l = strings.Split(after, ":")
 			for i, j := 0, len(l)-1; i < j; i, j = i+1, j-1 {
 				l[i], l[j] = l[j], l[i] // make l[0] = bottommost
 			}
diff --git a/util/purl/image_test.go b/util/purl/image_test.go
index ea94bc9da..58ae6f96e 100644
--- a/util/purl/image_test.go
+++ b/util/purl/image_test.go
@@ -73,7 +73,6 @@ func TestRefToPURL(t *testing.T) {
 	}
 
 	for _, tc := range tcases {
-		tc := tc
 		t.Run(tc.ref, func(t *testing.T) {
 			purl, err := RefToPURL(packageurl.TypeDocker, tc.ref, tc.platform)
 			if tc.err {
@@ -138,7 +137,6 @@ func TestPURLToRef(t *testing.T) {
 	}
 
 	for _, tc := range tcases {
-		tc := tc
 		t.Run(tc.purl, func(t *testing.T) {
 			ref, platform, err := PURLToRef(tc.purl)
 			if tc.err {
diff --git a/util/testutil/integration/run.go b/util/testutil/integration/run.go
index 5067ad389..754527a97 100644
--- a/util/testutil/integration/run.go
+++ b/util/testutil/integration/run.go
@@ -168,8 +168,8 @@ func Run(t *testing.T, testCases []Test, opt ...TestOpt) {
 		parts := strings.Split(filter, "/")
 		if len(parts) >= 2 {
 			const prefix = "slice="
-			if strings.HasPrefix(parts[1], prefix) {
-				conf := strings.TrimPrefix(parts[1], prefix)
+			if after, ok0 := strings.CutPrefix(parts[1], prefix); ok0 {
+				conf := after
 				offsetS, totalS, ok := strings.Cut(conf, "-")
 				if !ok {
 					t.Fatalf("invalid slice=%q", conf)
@@ -514,8 +514,8 @@ func prepareValueMatrix(tc testConf) []matrixValue {
 func SkipOnPlatform(t *testing.T, goos string) {
 	skip := false
 	// support for negation
-	if strings.HasPrefix(goos, "!") {
-		goos = strings.TrimPrefix(goos, "!")
+	if after, ok := strings.CutPrefix(goos, "!"); ok {
+		goos = after
 		skip = runtime.GOOS != goos
 	} else {
 		skip = runtime.GOOS == goos
@@ -539,8 +539,8 @@ func UnixOrWindows[T any](unix, windows T) T {
 func lookupTestFilter() (string, bool) {
 	const prefix = "-test.run="
 	for _, arg := range os.Args {
-		if strings.HasPrefix(arg, prefix) {
-			return strings.TrimPrefix(arg, prefix), true
+		if after, ok := strings.CutPrefix(arg, prefix); ok {
+			return after, true
 		}
 	}
 	return "", false
diff --git a/util/urlutil/redact_test.go b/util/urlutil/redact_test.go
index 6a3ea7cec..1b3143c96 100644
--- a/util/urlutil/redact_test.go
+++ b/util/urlutil/redact_test.go
@@ -35,7 +35,6 @@ func TestRedactCredentials(t *testing.T) {
 		},
 	}
 	for _, tt := range cases {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			if g, w := RedactCredentials(tt.url), tt.want; g != w {
 				t.Fatalf("got: %q\nwant: %q", g, w)
diff --git a/util/winlayers/applier.go b/util/winlayers/applier.go
index 6eebbadef..7bfc3ca7f 100644
--- a/util/winlayers/applier.go
+++ b/util/winlayers/applier.go
@@ -76,8 +76,8 @@ func (s *winApplier) Apply(ctx context.Context, desc ocispecs.Descriptor, mounts
 		}
 
 		rc2, discard := filter(rc, func(hdr *tar.Header) bool {
-			if strings.HasPrefix(hdr.Name, "Files/") {
-				hdr.Name = strings.TrimPrefix(hdr.Name, "Files/")
+			if after, ok := strings.CutPrefix(hdr.Name, "Files/"); ok {
+				hdr.Name = after
 				hdr.Linkname = strings.TrimPrefix(hdr.Linkname, "Files/")
 				// TODO: could convert the windows PAX headers to xattr here to reuse
 				// the original ones in diff for parent directories and file modifications
diff --git a/version/ua_test.go b/version/ua_test.go
index ce0c15c67..65bf27f1b 100644
--- a/version/ua_test.go
+++ b/version/ua_test.go
@@ -34,7 +34,6 @@ func TestUserAgent(t *testing.T) {
 		},
 	}
 	for _, tt := range cases {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			Version = tt.version
 			for pname, pver := range tt.products {
diff --git a/worker/base/worker.go b/worker/base/worker.go
index 0329c2888..1922b9dc6 100644
--- a/worker/base/worker.go
+++ b/worker/base/worker.go
@@ -495,7 +495,6 @@ func (w *Worker) FromRemote(ctx context.Context, remote *solver.Remote) (ref cac
 	if len(remote.Descriptors) > 0 {
 		var eg errgroup.Group
 		for _, desc := range remote.Descriptors {
-			desc := desc
 			eg.Go(func() error {
 				if _, err := remote.Provider.Info(ctx, desc.Digest); err != nil {
 					return err