diff --git a/.golangci.yml b/.golangci.yml
index a7a8acf62..4604a79a3 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -100,6 +100,8 @@ linters:
     staticcheck:
       checks:
         - all
+        # Produces false positives for shared callers of platform-specific unsupported stubs.
+        - -SA4023
     testifylint:
       disable:
         - empty
diff --git a/client/client_export_image_test.go b/client/client_export_image_test.go
index c91c1712a..ac327f595 100644
--- a/client/client_export_image_test.go
+++ b/client/client_export_image_test.go
@@ -308,7 +308,9 @@ func testBuildExportWithForeignLayer(t *testing.T, sb integration.Sandbox) {
 
 		ctx := namespaces.WithNamespace(sb.Context(), "buildkit")
 
-		resolver := docker.NewResolver(docker.ResolverOptions{PlainHTTP: true})
+		resolver := docker.NewResolver(docker.ResolverOptions{
+			Hosts: docker.ConfigureDefaultRegistries(docker.WithPlainHTTP(docker.MatchAllHosts)),
+		})
 		name, desc, err := resolver.Resolve(ctx, target)
 		require.NoError(t, err)
 
@@ -355,7 +357,9 @@ func testBuildExportWithForeignLayer(t *testing.T, sb integration.Sandbox) {
 
 		ctx := namespaces.WithNamespace(sb.Context(), "buildkit")
 
-		resolver := docker.NewResolver(docker.ResolverOptions{PlainHTTP: true})
+		resolver := docker.NewResolver(docker.ResolverOptions{
+			Hosts: docker.ConfigureDefaultRegistries(docker.WithPlainHTTP(docker.MatchAllHosts)),
+		})
 		name, desc, err := resolver.Resolve(ctx, target)
 		require.NoError(t, err)
 
diff --git a/client/policy_test.go b/client/policy_test.go
index ee75ea315..29f70f8ab 100644
--- a/client/policy_test.go
+++ b/client/policy_test.go
@@ -843,12 +843,12 @@ func testSourceMetaPolicySession(t *testing.T, sb integration.Sandbox) {
 			source: func() (*opspb.SourceOp, sourceresolver.Opt) {
 				p := platforms.DefaultSpec()
 				return &opspb.SourceOp{
-						Identifier: "docker-image://docker.io/library/alpine:latest",
-					}, sourceresolver.Opt{
-						ImageOpt: &sourceresolver.ResolveImageOpt{
-							Platform: &p,
-						},
-					}
+					Identifier: "docker-image://docker.io/library/alpine:latest",
+				}, sourceresolver.Opt{
+					ImageOpt: &sourceresolver.ResolveImageOpt{
+						Platform: &p,
+					},
+				}
 			},
 			callbacks: []policysession.PolicyCallback{
 				func(ctx context.Context, req *policysession.CheckPolicyRequest) (*policysession.DecisionResponse, *pb.ResolveSourceMetaRequest, error) {
diff --git a/frontend/gateway/gateway.go b/frontend/gateway/gateway.go
index f4bf29e09..ae13ff0ec 100644
--- a/frontend/gateway/gateway.go
+++ b/frontend/gateway/gateway.go
@@ -327,12 +327,12 @@ func metadataMount(def *opspb.Definition) (*executor.Mount, func(), error) {
 	}
 
 	return &executor.Mount{
-			Src:      &bind{dir},
-			Dest:     "/run/config/buildkit/metadata",
-			Readonly: true,
-		}, func() {
-			os.RemoveAll(dir)
-		}, nil
+		Src:      &bind{dir},
+		Dest:     "/run/config/buildkit/metadata",
+		Readonly: true,
+	}, func() {
+		os.RemoveAll(dir)
+	}, nil
 }
 
 type bind struct {
diff --git a/hack/dockerfiles/lint.Dockerfile b/hack/dockerfiles/lint.Dockerfile
index 3e7d47e73..fff471d3d 100644
--- a/hack/dockerfiles/lint.Dockerfile
+++ b/hack/dockerfiles/lint.Dockerfile
@@ -5,6 +5,7 @@ ARG ALPINE_VERSION=3.23
 ARG XX_VERSION=1.10.0
 ARG PROTOLINT_VERSION=0.56.4
 ARG GOLANGCI_LINT_VERSION=v2.12.2
+ARG STATICCHECK_VERSION=v0.8.0-rc.1
 ARG GOLANGCI_FROM_SOURCE=false
 ARG GOPLS_VERSION=v0.38.0
 # GOPLS_ANALYZERS defines gopls analyzers to be run. disabled by default: deprecated simplifyrange unusedfunc unusedvariable
@@ -18,7 +19,9 @@ FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
 FROM golang-base AS golangci-build
 WORKDIR /src
 ARG GOLANGCI_LINT_VERSION
+ARG STATICCHECK_VERSION
 ADD https://github.com/golangci/golangci-lint.git#${GOLANGCI_LINT_VERSION} .
+RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/ go get honnef.co/go/tools@${STATICCHECK_VERSION}
 RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/ go mod download
 RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/ mkdir -p out && go build -o /out/golangci-lint ./cmd/golangci-lint
 
diff --git a/solver/llbsolver/ops/exec_binfmt.go b/solver/llbsolver/ops/exec_binfmt.go
index 460ec4014..5e8d0fdb3 100644
--- a/solver/llbsolver/ops/exec_binfmt.go
+++ b/solver/llbsolver/ops/exec_binfmt.go
@@ -71,12 +71,12 @@ func (m *staticEmulatorMount) Mount() ([]mount.Mount, func() error, error) {
 
 	ret = true
 	return []mount.Mount{{
-			Type:    "bind",
-			Source:  filepath.Join(tmpdir, qemuMountName),
-			Options: []string{"ro", "bind"},
-		}}, func() error {
-			return os.RemoveAll(tmpdir)
-		}, nil
+		Type:    "bind",
+		Source:  filepath.Join(tmpdir, qemuMountName),
+		Options: []string{"ro", "bind"},
+	}}, func() error {
+		return os.RemoveAll(tmpdir)
+	}, nil
 }
 
 func (m *staticEmulatorMount) IdentityMapping() *user.IdentityMapping {