diff --git a/cmd/tailscale/cli/cli_test.go b/cmd/tailscale/cli/cli_test.go
index b2fecc127..c5546187c 100644
--- a/cmd/tailscale/cli/cli_test.go
+++ b/cmd/tailscale/cli/cli_test.go
@@ -664,11 +664,11 @@ func TestPrefsFromUpArgs(t *testing.T) {
 			goos: "linux",
 			args: upArgsT{
 				advertiseRoutes: "fd7a:115c:a1e0:b1a::bb:10.0.0.0/112",
-				netfilterMode: "off",
+				netfilterMode:   "off",
 			},
 			want: &ipn.Prefs{
-				WantRunning:   true,
-				NoSNAT:        true,
+				WantRunning: true,
+				NoSNAT:      true,
 				AdvertiseRoutes: []netaddr.IPPrefix{
 					netaddr.MustParseIPPrefix("fd7a:115c:a1e0:b1a::bb:10.0.0.0/112"),
 				},
@@ -679,7 +679,7 @@ func TestPrefsFromUpArgs(t *testing.T) {
 			goos: "linux",
 			args: upArgsT{
 				advertiseRoutes: "fd7a:115c:a1e0:b1a::/64",
-				netfilterMode: "off",
+				netfilterMode:   "off",
 			},
 			wantErr: "fd7a:115c:a1e0:b1a::/64 4-in-6 prefix must be at least a /96",
 		},
@@ -688,7 +688,7 @@ func TestPrefsFromUpArgs(t *testing.T) {
 			goos: "linux",
 			args: upArgsT{
 				advertiseRoutes: "fd7a:115c:a1e0:b1a:1234:5678::/112",
-				netfilterMode: "off",
+				netfilterMode:   "off",
 			},
 			wantErr: "route fd7a:115c:a1e0:b1a:1234:5678::/112 contains invalid site ID 12345678; must be 0xff or less",
 		},
diff --git a/cmd/tailscale/cli/file.go b/cmd/tailscale/cli/file.go
index 6bf6ef092..a841e5de3 100644
--- a/cmd/tailscale/cli/file.go
+++ b/cmd/tailscale/cli/file.go
@@ -428,7 +428,7 @@ func runFileGetOneBatch(ctx context.Context, dir string) []error {
 		if len(errs) > 100 {
 			// Likely, everything is broken.
 			// Don't try to receive any more files in this batch.
-			errs = append(errs, fmt.Errorf("too many errors in runFileGetOneBatch(). %d files unexamined", len(wfs) - i))
+			errs = append(errs, fmt.Errorf("too many errors in runFileGetOneBatch(). %d files unexamined", len(wfs)-i))
 			break
 		}
 		writtenFile, size, err := receiveFile(ctx, wf, dir)
diff --git a/cmd/tailscaled/ssh.go b/cmd/tailscaled/ssh.go
index e389535a4..d566ec8ec 100644
--- a/cmd/tailscaled/ssh.go
+++ b/cmd/tailscaled/ssh.go
@@ -9,4 +9,3 @@ package main
 
 // Force registration of tailssh with LocalBackend.
 import _ "tailscale.com/ssh/tailssh"
-
diff --git a/net/netcheck/netcheck.go b/net/netcheck/netcheck.go
index dd2afe55b..f8388eabe 100644
--- a/net/netcheck/netcheck.go
+++ b/net/netcheck/netcheck.go
@@ -1044,7 +1044,7 @@ func (c *Client) measureHTTPSLatency(ctx context.Context, reg *tailcfg.DERPRegio
 	}
 	hc := &http.Client{Transport: tr}
 
-	req, err := http.NewRequestWithContext(ctx, "GET", "https://" + node.HostName + "/derp/latency-check", nil)
+	req, err := http.NewRequestWithContext(ctx, "GET", "https://"+node.HostName+"/derp/latency-check", nil)
 	if err != nil {
 		return 0, ip, err
 	}
diff --git a/wgengine/winnet/winnet_windows.go b/wgengine/winnet/winnet_windows.go
index 8744aec53..7717a40fe 100644
--- a/wgengine/winnet/winnet_windows.go
+++ b/wgengine/winnet/winnet_windows.go
@@ -6,9 +6,10 @@ package winnet
 
 import (
 	"fmt"
-	"github.com/go-ole/go-ole"
 	"syscall"
 	"unsafe"
+
+	"github.com/go-ole/go-ole"
 )
 
 func (v *INetworkConnection) GetAdapterId() (string, error) {