diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 057ed38..d1a6aa5 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -18,9 +18,9 @@ builds:
     env: [CGO_ENABLED=0]
     ldflags:
       - -s -w
-      - -X github.com/MizuchiLabs/mantrae/pkg/build.Version={{.Tag}}
-      - -X github.com/MizuchiLabs/mantrae/pkg/build.Commit={{.Commit}}
-      - -X github.com/MizuchiLabs/mantrae/pkg/build.Date={{.Date}}
+      - -X github.com/mizuchilabs/mantrae/pkg/build.Version={{.Tag}}
+      - -X github.com/mizuchilabs/mantrae/pkg/build.Commit={{.Commit}}
+      - -X github.com/mizuchilabs/mantrae/pkg/build.Date={{.Date}}
     goos:
       - linux
       - darwin
@@ -35,9 +35,9 @@ builds:
     env: [CGO_ENABLED=0]
     ldflags:
       - -s -w
-      - -X github.com/MizuchiLabs/mantrae/pkg/build.Version={{.Tag}}
-      - -X github.com/MizuchiLabs/mantrae/pkg/build.Commit={{.Commit}}
-      - -X github.com/MizuchiLabs/mantrae/pkg/build.Date={{.Date}}
+      - -X github.com/mizuchilabs/mantrae/pkg/build.Version={{.Tag}}
+      - -X github.com/mizuchilabs/mantrae/pkg/build.Commit={{.Commit}}
+      - -X github.com/mizuchilabs/mantrae/pkg/build.Date={{.Date}}
     goos:
       - linux
     goarch:
diff --git a/.ko.yaml b/.ko.yaml
index 9a19b06..83b52e7 100644
--- a/.ko.yaml
+++ b/.ko.yaml
@@ -4,14 +4,21 @@ defaultPlatforms:
   - linux/amd64
 defaultLdflags:
   - -s -w
-  - -X github.com/MizuchiLabs/mantrae/pkg/build.Version={{.Git.Tag}}
-  - -X github.com/MizuchiLabs/mantrae/pkg/build.Commit={{.Git.FullCommit}}
-  - -X github.com/MizuchiLabs/mantrae/pkg/build.Date={{.Date}}
+  - -X github.com/mizuchilabs/mantrae/pkg/build.Version={{.Git.Tag}}
+  - -X github.com/mizuchilabs/mantrae/pkg/build.Commit={{.Git.FullCommit}}
+  - -X github.com/mizuchilabs/mantrae/pkg/build.Date={{.Date}}
+  - -X github.com/mizuchilabs/mantrae/pkg/build.Dirty={{.Git.IsDirty}}
 defaultLabels:
   org.opencontainers.image.title: "{{.Target}}"
-  org.opencontainers.image.version: "{{.Env.VERSION}}"
-  org.opencontainers.image.created: "{{.Env.DATE}}"
+  org.opencontainers.image.description: "Mantrae is a self-hosted, open-source, Traefik dynamic config manager."
+  org.opencontainers.image.version: "{{.Git.Tag}}"
+  org.opencontainers.image.created: "{{.Date}}"
+  org.opencontainers.image.revision: "{{.Git.FullCommit}}"
+  org.opencontainers.image.licenses: "MIT"
   org.opencontainers.image.source: "https://github.com/MizuchiLabs/mantrae"
+  org.opencontainers.image.authors: "Mizuchi Labs <admin@mizuchi.dev>"
+  org.opencontainers.image.url: "https://github.com/MizuchiLabs/mantrae"
+  org.opencontainers.image.documentation: "https://github.com/MizuchiLabs/mantrae#readme"
 
 builds:
   - id: server
diff --git a/Makefile b/Makefile
index f61789d..6796076 100644
--- a/Makefile
+++ b/Makefile
@@ -6,7 +6,7 @@ DATE=$(shell date -u +%Y-%m-%d)
 COMMIT=$(shell git rev-parse --short HEAD)
 
 # Setup the -ldflags option for go build here, interpolate the variable values
-LDFLAGS=-ldflags "-s -w -X github.com/MizuchiLabs/mantrae/pkg/build.Version=${VERSION} -X github.com/MizuchiLabs/mantrae/pkg/build.Date=${DATE} -X github.com/MizuchiLabs/mantrae/pkg/build.Commit=${COMMIT}"
+LDFLAGS=-ldflags "-s -w -X github.com/mizuchilabs/mantrae/pkg/build.Version=${VERSION} -X github.com/MizuchiLabs/mantrae/pkg/build.Date=${DATE} -X github.com/MizuchiLabs/mantrae/pkg/build.Commit=${COMMIT}"
 
 all: clean build
 
@@ -39,6 +39,9 @@ docker-local:
 	go generate ./...
 	KO_DOCKER_REPO=ko.local/mantrae ko build . --bare
 	KO_DOCKER_REPO=ko.local/mantrae-agent ko build ./agent/cmd --bare
+	# Check for vulnerabilities
+	grype --scope all-layers ko.local/mantrae:latest
+	grype --scope all-layers ko.local/mantrae-agent:latest
 
 docker-release:
 	go generate ./...
diff --git a/agent/internal/client/auth.go b/agent/internal/client/auth.go
index 56d4ab0..f6e5d4f 100644
--- a/agent/internal/client/auth.go
+++ b/agent/internal/client/auth.go
@@ -1,3 +1,4 @@
+// Package client for authentication and connection to the mantrae server.
 package client
 
 import (
@@ -39,7 +40,9 @@ func (t *TokenSource) prepare() error {
 	defer t.mu.Unlock()
 
 	// Create token file if it doesn't exist
-	os.MkdirAll("data", 0o755)
+	if err := os.MkdirAll("data", 0o755); err != nil {
+		return err
+	}
 
 	token, ok := os.LookupEnv("TOKEN")
 	if !ok {
@@ -53,7 +56,7 @@ func (t *TokenSource) prepare() error {
 }
 
 // ensure loads token from disk, writes it back, decodes claims and initializes client.
-func (t *TokenSource) ensure(ctx context.Context) error {
+func (t *TokenSource) ensure() error {
 	t.mu.Lock()
 	defer t.mu.Unlock()
 
@@ -90,7 +93,7 @@ func (t *TokenSource) ensure(ctx context.Context) error {
 
 // Refresh does a health‐check, rotates token or falls back on unauthenticated.
 func (t *TokenSource) Refresh(ctx context.Context) {
-	if err := t.ensure(ctx); err != nil {
+	if err := t.ensure(); err != nil {
 		slog.Error("Failed to connect to server", "error", err)
 		return
 	}
@@ -108,11 +111,13 @@ func (t *TokenSource) Refresh(ctx context.Context) {
 	resp, err := t.client.HealthCheck(ctx, req)
 	if connect.CodeOf(err) == connect.CodeUnauthenticated {
 		// remove stored token and retry once from env
-		os.Remove(tokenFile)
+		if err = os.Remove(tokenFile); err != nil {
+			slog.Warn("Could not remove token file", "err", err)
+		}
 		t.mu.Lock()
 		t.token, t.client = "", nil
 		t.mu.Unlock()
-		if err := t.ensure(ctx); err != nil {
+		if err = t.ensure(); err != nil {
 			slog.Error("Failed to connect to server", "error", err)
 			return
 		}
@@ -131,7 +136,9 @@ func (t *TokenSource) Refresh(ctx context.Context) {
 	if nt := resp.Msg.Agent.Token; nt != "" && nt != t.token {
 		t.mu.Lock()
 		t.token = nt
-		os.WriteFile(tokenFile, []byte(nt), 0o600)
+		if err = os.WriteFile(tokenFile, []byte(nt), 0o600); err != nil {
+			slog.Warn("Could not write token file", "err", err)
+		}
 		t.mu.Unlock()
 	}
 	// rotate active IP
@@ -146,7 +153,7 @@ func (t *TokenSource) Refresh(ctx context.Context) {
 func (t *TokenSource) Interceptor() connect.UnaryInterceptorFunc {
 	return func(next connect.UnaryFunc) connect.UnaryFunc {
 		return func(ctx context.Context, req connect.AnyRequest) (connect.AnyResponse, error) {
-			if err := t.ensure(ctx); err != nil {
+			if err := t.ensure(); err != nil {
 				return nil, connect.NewError(connect.CodeUnauthenticated, err)
 			}
 			req.Header().Set("Authorization", "Bearer "+t.token)
@@ -154,7 +161,9 @@ func (t *TokenSource) Interceptor() connect.UnaryInterceptorFunc {
 
 			resp, err := next(ctx, req)
 			if connect.CodeOf(err) == connect.CodeUnauthenticated {
-				os.Remove(tokenFile)
+				if err = os.Remove(tokenFile); err != nil {
+					slog.Warn("Could not remove token file", "err", err)
+				}
 				t.mu.Lock()
 				t.token, t.client = "", nil
 				t.mu.Unlock()
diff --git a/agent/internal/client/client.go b/agent/internal/client/client.go
index 84a606f..b275155 100644
--- a/agent/internal/client/client.go
+++ b/agent/internal/client/client.go
@@ -34,7 +34,9 @@ func Client(ctx context.Context) {
 		case <-healthTicker.C:
 			t.Refresh(ctx)
 		case <-containerTicker.C:
-			t.Update(ctx)
+			if err := t.Update(ctx); err != nil {
+				slog.Error("Failed to send update", "error", err)
+			}
 		case <-ctx.Done():
 			return
 		}
@@ -43,6 +45,7 @@ func Client(ctx context.Context) {
 
 func (t *TokenSource) Update(ctx context.Context) error {
 	if t.activeIP == "" {
+		slog.Warn("No active IP, skipping update")
 		return nil
 	}
 
@@ -404,7 +407,7 @@ func (t *TokenSource) cleanup(
 	}
 	for _, r := range routers.Msg.Routers {
 		if _, ok := syncedRouters[r.Name]; !ok {
-			if _, err := routerClient.DeleteRouter(
+			if _, err = routerClient.DeleteRouter(
 				ctx,
 				connect.NewRequest(&mantraev1.DeleteRouterRequest{Id: r.Id, Type: r.Type}),
 			); err != nil {
@@ -429,7 +432,7 @@ func (t *TokenSource) cleanup(
 
 	for _, s := range services.Msg.Services {
 		if _, ok := syncedServices[s.Name]; !ok {
-			if _, err := serviceClient.DeleteService(
+			if _, err = serviceClient.DeleteService(
 				ctx,
 				connect.NewRequest(&mantraev1.DeleteServiceRequest{Id: s.Id, Type: s.Type}),
 			); err != nil {
@@ -484,7 +487,7 @@ func ToProtoStruct(v any) (*structpb.Struct, error) {
 		return nil, err
 	}
 
-	var mapData map[string]interface{}
+	var mapData map[string]any
 	if err := json.Unmarshal(data, &mapData); err != nil {
 		return nil, err
 	}
diff --git a/go.mod b/go.mod
index aa77cde..e29bb1a 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/mizuchilabs/mantrae
 
-go 1.24.0
+go 1.24.4
 
 require (
 	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250613105001-9f2d3c737feb.1
@@ -91,17 +91,17 @@ require (
 	github.com/unrolled/render v1.7.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 // indirect
-	go.opentelemetry.io/otel v1.36.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.12.2 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.12.2 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.36.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.36.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.36.0 // indirect
-	go.opentelemetry.io/otel/log v0.12.2 // indirect
-	go.opentelemetry.io/otel/metric v1.36.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.36.0 // indirect
-	go.opentelemetry.io/otel/sdk/log v0.12.2 // indirect
-	go.opentelemetry.io/otel/trace v1.36.0 // indirect
+	go.opentelemetry.io/otel v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.13.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.13.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.37.0 // indirect
+	go.opentelemetry.io/otel/log v0.13.0 // indirect
+	go.opentelemetry.io/otel/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk/log v0.13.0 // indirect
+	go.opentelemetry.io/otel/trace v1.37.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.7.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
diff --git a/go.sum b/go.sum
index 1a08b53..4c6fa56 100644
--- a/go.sum
+++ b/go.sum
@@ -215,32 +215,32 @@ go.opentelemetry.io/collector/pdata v1.10.0 h1:oLyPLGvPTQrcRT64ZVruwvmH/u3SHTfNo
 go.opentelemetry.io/collector/pdata v1.10.0/go.mod h1:IHxHsp+Jq/xfjORQMDJjSH6jvedOSTOyu3nbxqhWSYE=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 h1:CV7UdSGJt/Ao6Gp4CXckLxVRRsRgDHoI8XjbL3PDl8s=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0/go.mod h1:FRmFuRJfag1IZ2dPkHnEoSFVgTVPUd2qf5Vi69hLb8I=
-go.opentelemetry.io/otel v1.36.0 h1:UumtzIklRBY6cI/lllNZlALOF5nNIzJVb16APdvgTXg=
-go.opentelemetry.io/otel v1.36.0/go.mod h1:/TcFMXYjyRNh8khOAO9ybYkqaDBb/70aVwkNML4pP8E=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.12.2 h1:06ZeJRe5BnYXceSM9Vya83XXVaNGe3H1QqsvqRANQq8=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.12.2/go.mod h1:DvPtKE63knkDVP88qpatBj81JxN+w1bqfVbsbCbj1WY=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.12.2 h1:tPLwQlXbJ8NSOfZc4OkgU5h2A38M4c9kfHSVc4PFQGs=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.12.2/go.mod h1:QTnxBwT/1rBIgAG1goq6xMydfYOBKU6KTiYF4fp5zL8=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.36.0 h1:dNzwXjZKpMpE2JhmO+9HsPl42NIXFIFSUSSs0fiqra0=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.36.0/go.mod h1:90PoxvaEB5n6AOdZvi+yWJQoE95U8Dhhw2bSyRqnTD0=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.36.0 h1:JgtbA0xkWHnTmYk7YusopJFX6uleBmAuZ8n05NEh8nQ=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.36.0/go.mod h1:179AK5aar5R3eS9FucPy6rggvU0g52cvKId8pv4+v0c=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.36.0 h1:nRVXXvf78e00EwY6Wp0YII8ww2JVWshZ20HfTlE11AM=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.36.0/go.mod h1:r49hO7CgrxY9Voaj3Xe8pANWtr0Oq916d0XAmOoCZAQ=
-go.opentelemetry.io/otel/log v0.12.2 h1:yob9JVHn2ZY24byZeaXpTVoPS6l+UrrxmxmPKohXTwc=
-go.opentelemetry.io/otel/log v0.12.2/go.mod h1:ShIItIxSYxufUMt+1H5a2wbckGli3/iCfuEbVZi/98E=
-go.opentelemetry.io/otel/metric v1.36.0 h1:MoWPKVhQvJ+eeXWHFBOPoBOi20jh6Iq2CcCREuTYufE=
-go.opentelemetry.io/otel/metric v1.36.0/go.mod h1:zC7Ks+yeyJt4xig9DEw9kuUFe5C3zLbVjV2PzT6qzbs=
-go.opentelemetry.io/otel/sdk v1.36.0 h1:b6SYIuLRs88ztox4EyrvRti80uXIFy+Sqzoh9kFULbs=
-go.opentelemetry.io/otel/sdk v1.36.0/go.mod h1:+lC+mTgD+MUWfjJubi2vvXWcVxyr9rmlshZni72pXeY=
-go.opentelemetry.io/otel/sdk/log v0.12.2 h1:yNoETvTByVKi7wHvYS6HMcZrN5hFLD7I++1xIZ/k6W0=
-go.opentelemetry.io/otel/sdk/log v0.12.2/go.mod h1:DcpdmUXHJgSqN/dh+XMWa7Vf89u9ap0/AAk/XGLnEzY=
-go.opentelemetry.io/otel/sdk/log/logtest v0.0.0-20250521073539-a85ae98dcedc h1:uqxdywfHqqCl6LmZzI3pUnXT1RGFYyUgxj0AkWPFxi0=
-go.opentelemetry.io/otel/sdk/log/logtest v0.0.0-20250521073539-a85ae98dcedc/go.mod h1:TY/N/FT7dmFrP/r5ym3g0yysP1DefqGpAZr4f82P0dE=
+go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
+go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.13.0 h1:z6lNIajgEBVtQZHjfw2hAccPEBDs+nx58VemmXWa2ec=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.13.0/go.mod h1:+kyc3bRx/Qkq05P6OCu3mTEIOxYRYzoIg+JsUp5X+PM=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.13.0 h1:zUfYw8cscHHLwaY8Xz3fiJu+R59xBnkgq2Zr1lwmK/0=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.13.0/go.mod h1:514JLMCcFLQFS8cnTepOk6I09cKWJ5nGHBxHrMJ8Yfg=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 h1:Ahq7pZmv87yiyn3jeFz/LekZmPLLdKejuO3NcK9MssM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0/go.mod h1:MJTqhM0im3mRLw1i8uGHnCvUEeS7VwRyxlLC78PA18M=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 h1:EtFWSnwW9hGObjkIdmlnWSydO+Qs8OwzfzXLUPg4xOc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0/go.mod h1:QjUEoiGCPkvFZ/MjK6ZZfNOS6mfVEVKYE99dFhuN2LI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.37.0 h1:bDMKF3RUSxshZ5OjOTi8rsHGaPKsAt76FaqgvIUySLc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.37.0/go.mod h1:dDT67G/IkA46Mr2l9Uj7HsQVwsjASyV9SjGofsiUZDA=
+go.opentelemetry.io/otel/log v0.13.0 h1:yoxRoIZcohB6Xf0lNv9QIyCzQvrtGZklVbdCoyb7dls=
+go.opentelemetry.io/otel/log v0.13.0/go.mod h1:INKfG4k1O9CL25BaM1qLe0zIedOpvlS5Z7XgSbmN83E=
+go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
+go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
+go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
+go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
+go.opentelemetry.io/otel/sdk/log v0.13.0 h1:I3CGUszjM926OphK8ZdzF+kLqFvfRY/IIoFq/TjwfaQ=
+go.opentelemetry.io/otel/sdk/log v0.13.0/go.mod h1:lOrQyCCXmpZdN7NchXb6DOZZa1N5G1R2tm5GMMTpDBw=
+go.opentelemetry.io/otel/sdk/log/logtest v0.13.0 h1:9yio6AFZ3QD9j9oqshV1Ibm9gPLlHNxurno5BreMtIA=
+go.opentelemetry.io/otel/sdk/log/logtest v0.13.0/go.mod h1:QOGiAJHl+fob8Nu85ifXfuQYmJTFAvcrxL6w5/tu168=
 go.opentelemetry.io/otel/sdk/metric v1.35.0 h1:1RriWBmCKgkeHEhM7a2uMjMUfP7MsOF5JpUCaEqEI9o=
 go.opentelemetry.io/otel/sdk/metric v1.35.0/go.mod h1:is6XYCUMpcKi+ZsOvfluY5YstFnhW0BidkR+gL+qN+w=
-go.opentelemetry.io/otel/trace v1.36.0 h1:ahxWNuqZjpdiFAyrIoQ4GIiAIhxAunQR6MUoKrsNd4w=
-go.opentelemetry.io/otel/trace v1.36.0/go.mod h1:gQ+OnDZzrybY4k4seLzPAWNwVBBVlF2szhehOBB/tGA=
+go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
+go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
 go.opentelemetry.io/proto/otlp v1.7.0 h1:jX1VolD6nHuFzOYso2E73H85i92Mv8JQYk0K9vz09os=
 go.opentelemetry.io/proto/otlp v1.7.0/go.mod h1:fSKjH6YJ7HDlwzltzyMj036AJ3ejJLCgCSHGj4efDDo=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
diff --git a/internal/api/handler/oidc.go b/internal/api/handler/oidc.go
index ffddd94..b52809b 100644
--- a/internal/api/handler/oidc.go
+++ b/internal/api/handler/oidc.go
@@ -259,8 +259,8 @@ func getOIDCConfig(
 	}
 
 	// Handle client secret vs PKCE
-	if clientSecret, exists := sets[settings.KeyOIDCClientSecret]; exists && clientSecret != "" {
-		if pkceEnabled, _ := sets[settings.KeyOIDCPKCE]; !settings.AsBool(pkceEnabled) {
+	if clientSecret, ok := sets[settings.KeyOIDCClientSecret]; ok && clientSecret != "" {
+		if pkceEnabled, ok := sets[settings.KeyOIDCPKCE]; ok && !settings.AsBool(pkceEnabled) {
 			config.ClientSecret = clientSecret
 		}
 	}
diff --git a/internal/api/handler/upload.go b/internal/api/handler/upload.go
index d5e69b8..3cebf56 100644
--- a/internal/api/handler/upload.go
+++ b/internal/api/handler/upload.go
@@ -55,7 +55,10 @@ func UploadAvatar(a *config.App) http.HandlerFunc {
 			http.Error(w, "Failed to get storage backend", http.StatusInternalServerError)
 			return
 		}
-		storePath.Store(r.Context(), filename, file)
+		if err := storePath.Store(r.Context(), filename, file); err != nil {
+			http.Error(w, "Failed to store file", http.StatusInternalServerError)
+			return
+		}
 
 		response := map[string]string{"message": "Avatar updated successfully"}
 		w.Header().Set("Content-Type", "application/json")
diff --git a/internal/api/service/dns.go b/internal/api/service/dns.go
index 58c2fb3..9c439fe 100644
--- a/internal/api/service/dns.go
+++ b/internal/api/service/dns.go
@@ -43,13 +43,10 @@ func (s *DnsProviderService) CreateDnsProvider(
 	switch req.Msg.Type {
 	case mantraev1.DnsProviderType_DNS_PROVIDER_TYPE_CLOUDFLARE:
 		dnsType = "cloudflare"
-		break
 	case mantraev1.DnsProviderType_DNS_PROVIDER_TYPE_POWERDNS:
 		dnsType = "powerdns"
-		break
 	case mantraev1.DnsProviderType_DNS_PROVIDER_TYPE_TECHNITIUM:
 		dnsType = "technitium"
-		break
 	default:
 		return nil, connect.NewError(
 			connect.CodeInvalidArgument,
@@ -88,13 +85,10 @@ func (s *DnsProviderService) UpdateDnsProvider(
 	switch req.Msg.Type {
 	case mantraev1.DnsProviderType_DNS_PROVIDER_TYPE_CLOUDFLARE:
 		dnsType = "cloudflare"
-		break
 	case mantraev1.DnsProviderType_DNS_PROVIDER_TYPE_POWERDNS:
 		dnsType = "powerdns"
-		break
 	case mantraev1.DnsProviderType_DNS_PROVIDER_TYPE_TECHNITIUM:
 		dnsType = "technitium"
-		break
 	default:
 		return nil, connect.NewError(
 			connect.CodeInvalidArgument,
diff --git a/internal/api/service/service.go b/internal/api/service/service.go
index a254c2a..96438ba 100644
--- a/internal/api/service/service.go
+++ b/internal/api/service/service.go
@@ -213,7 +213,6 @@ func (s *Service) ListServices(
 	var totalCount int64
 
 	if req.Msg.Type == nil {
-		var err error
 		if req.Msg.AgentId == nil {
 			result, err := s.app.Conn.GetQuery().
 				ListServicesByProfile(ctx, db.ListServicesByProfileParams{
@@ -259,9 +258,6 @@ func (s *Service) ListServices(
 			}
 			services = convert.ServicesByAgentToProto(result)
 		}
-		if err != nil {
-			return nil, connect.NewError(connect.CodeInternal, err)
-		}
 	} else {
 		var err error
 		switch *req.Msg.Type {
diff --git a/internal/backup/backup.go b/internal/backup/backup.go
index 76cab72..2e80ddf 100644
--- a/internal/backup/backup.go
+++ b/internal/backup/backup.go
@@ -194,8 +194,12 @@ func (m *BackupManager) Restore(ctx context.Context, backupName string) error {
 	}
 
 	// Remove WAL and SHM files if they exist
-	os.Remove(walPath)
-	os.Remove(shmPath)
+	if err = os.Remove(walPath); err != nil {
+		return fmt.Errorf("failed to remove wal file: %w", err)
+	}
+	if err = os.Remove(shmPath); err != nil {
+		return fmt.Errorf("failed to remove shm file: %w", err)
+	}
 
 	// Copy the temp file to the database location instead of rename (invalid cross-device link)
 	srcFile, err := os.Open(tmpFile.Name())
diff --git a/internal/config/setup.go b/internal/config/setup.go
index 1235aa5..e28051b 100644
--- a/internal/config/setup.go
+++ b/internal/config/setup.go
@@ -104,7 +104,7 @@ func (a *App) setupDefaultData(ctx context.Context) error {
 
 	if len(profiles) == 0 {
 		description := "Default profile"
-		if _, err := q.CreateProfile(ctx, db.CreateProfileParams{
+		if _, err = q.CreateProfile(ctx, db.CreateProfileParams{
 			Name:        "default",
 			Description: &description,
 		}); err != nil {
@@ -115,14 +115,18 @@ func (a *App) setupDefaultData(ctx context.Context) error {
 	// Check default server url
 	serverURL, ok := a.SM.Get("server_url")
 	if !ok || serverURL == "" {
-		a.SM.Set(ctx, "server_url", util.GetLocalIP())
+		if err = a.SM.Set(ctx, "server_url", util.GetLocalIP()); err != nil {
+			return fmt.Errorf("failed to set server url: %w", err)
+		}
 	}
 	u, err := url.Parse(serverURL)
 	if err != nil {
 		return fmt.Errorf("failed to parse server url: %w", err)
 	}
 	if u.Hostname() == "127.0.0.1" || u.Hostname() == "localhost" {
-		a.SM.Set(ctx, "server_url", util.GetLocalIP())
+		if err := a.SM.Set(ctx, "server_url", util.GetLocalIP()); err != nil {
+			return fmt.Errorf("failed to set server url: %w", err)
+		}
 	}
 
 	return nil
diff --git a/internal/config/tasks.go b/internal/config/tasks.go
index 1a653c3..d531eef 100644
--- a/internal/config/tasks.go
+++ b/internal/config/tasks.go
@@ -149,7 +149,7 @@ func (a *App) cleanupAgents(ctx context.Context) {
 					continue
 				}
 
-				if time.Now().Sub(*agent.UpdatedAt) > settings.AsDuration(timeout) {
+				if time.Since(*agent.UpdatedAt) > settings.AsDuration(timeout) {
 					if err := a.Conn.GetQuery().DeleteAgent(ctx, agent.ID); err != nil {
 						slog.Error(
 							"failed to delete disconnected agent",
diff --git a/internal/convert/dns.go b/internal/convert/dns.go
index 4e3750a..b9172c3 100644
--- a/internal/convert/dns.go
+++ b/internal/convert/dns.go
@@ -10,13 +10,10 @@ func DNSProviderToProto(p *db.DnsProvider) *mantraev1.DnsProvider {
 	switch p.Type {
 	case "cloudflare":
 		dnsType = mantraev1.DnsProviderType_DNS_PROVIDER_TYPE_CLOUDFLARE
-		break
 	case "powerdns":
 		dnsType = mantraev1.DnsProviderType_DNS_PROVIDER_TYPE_POWERDNS
-		break
 	case "technitium":
 		dnsType = mantraev1.DnsProviderType_DNS_PROVIDER_TYPE_TECHNITIUM
-		break
 	default:
 		return nil
 	}
diff --git a/pkg/build/build.go b/pkg/build/build.go
index eb7349d..ed3bbfe 100644
--- a/pkg/build/build.go
+++ b/pkg/build/build.go
@@ -4,4 +4,5 @@ var (
 	Version = "unknown"
 	Commit  string
 	Date    string
+	Dirty   string
 )