diff --git a/api/types/accesslist/convert/v1/review.go b/api/types/accesslist/convert/v1/review.go
index 42bb7ebfc89..5854de458fb 100644
--- a/api/types/accesslist/convert/v1/review.go
+++ b/api/types/accesslist/convert/v1/review.go
@@ -76,9 +76,7 @@ func FromReviewProto(msg *accesslistv1.Review) (*accesslist.Review, error) {
 func ToReviewProto(review *accesslist.Review) *accesslistv1.Review {
 	var reviewChanges *accesslistv1.ReviewChanges
 	if review.Spec.Changes.MembershipRequirementsChanged != nil {
-		if reviewChanges == nil {
-			reviewChanges = &accesslistv1.ReviewChanges{}
-		}
+		reviewChanges = &accesslistv1.ReviewChanges{}
 
 		reviewChanges.MembershipRequirementsChanged = &accesslistv1.AccessListRequires{
 			Roles:  review.Spec.Changes.MembershipRequirementsChanged.Roles,
diff --git a/api/types/kubernetes_server_test.go b/api/types/kubernetes_server_test.go
index 03582813be4..c1ecedea7ae 100644
--- a/api/types/kubernetes_server_test.go
+++ b/api/types/kubernetes_server_test.go
@@ -26,7 +26,7 @@ import (
 func TestKubeServerSorter(t *testing.T) {
 	t.Parallel()
 
-	makeClusters := func(testVals []string, testField string) []KubeServer {
+	makeClusters := func(testVals []string) []KubeServer {
 		servers := make([]KubeServer, len(testVals))
 		for i := 0; i < len(testVals); i++ {
 			var err error
@@ -46,7 +46,7 @@ func TestKubeServerSorter(t *testing.T) {
 
 	// Test descending.
 	sortBy := SortBy{Field: ResourceMetadataName, IsDesc: true}
-	clusters := KubeServers(makeClusters(testValsUnordered, ResourceMetadataName))
+	clusters := KubeServers(makeClusters(testValsUnordered))
 	require.NoError(t, clusters.SortByCustom(sortBy))
 	targetVals, err := clusters.GetFieldVals(ResourceMetadataName)
 	require.NoError(t, err)
@@ -54,7 +54,7 @@ func TestKubeServerSorter(t *testing.T) {
 
 	// Test ascending.
 	sortBy = SortBy{Field: ResourceMetadataName}
-	clusters = KubeServers(makeClusters(testValsUnordered, ResourceMetadataName))
+	clusters = KubeServers(makeClusters(testValsUnordered))
 	require.NoError(t, clusters.SortByCustom(sortBy))
 	targetVals, err = clusters.GetFieldVals(ResourceMetadataName)
 	require.NoError(t, err)
@@ -62,6 +62,6 @@ func TestKubeServerSorter(t *testing.T) {
 
 	// Test error.
 	sortBy = SortBy{Field: "unsupported"}
-	clusters = KubeServers(makeClusters(testValsUnordered, ResourceMetadataName))
+	clusters = KubeServers(makeClusters(testValsUnordered))
 	require.True(t, trace.IsNotImplemented(clusters.SortByCustom(sortBy)))
 }
diff --git a/api/types/kubernetes_test.go b/api/types/kubernetes_test.go
index 2931ebf626a..5d3a81210be 100644
--- a/api/types/kubernetes_test.go
+++ b/api/types/kubernetes_test.go
@@ -26,7 +26,7 @@ import (
 func TestKubeClustersSorter(t *testing.T) {
 	t.Parallel()
 
-	makeClusters := func(testVals []string, testField string) []KubeCluster {
+	makeClusters := func(testVals []string) []KubeCluster {
 		servers := make([]KubeCluster, len(testVals))
 		for i := 0; i < len(testVals); i++ {
 			var err error
@@ -42,7 +42,7 @@ func TestKubeClustersSorter(t *testing.T) {
 
 	// Test descending.
 	sortBy := SortBy{Field: ResourceMetadataName, IsDesc: true}
-	clusters := KubeClusters(makeClusters(testValsUnordered, ResourceMetadataName))
+	clusters := KubeClusters(makeClusters(testValsUnordered))
 	require.NoError(t, clusters.SortByCustom(sortBy))
 	targetVals, err := clusters.GetFieldVals(ResourceMetadataName)
 	require.NoError(t, err)
@@ -50,7 +50,7 @@ func TestKubeClustersSorter(t *testing.T) {
 
 	// Test ascending.
 	sortBy = SortBy{Field: ResourceMetadataName}
-	clusters = KubeClusters(makeClusters(testValsUnordered, ResourceMetadataName))
+	clusters = KubeClusters(makeClusters(testValsUnordered))
 	require.NoError(t, clusters.SortByCustom(sortBy))
 	targetVals, err = clusters.GetFieldVals(ResourceMetadataName)
 	require.NoError(t, err)
@@ -58,7 +58,7 @@ func TestKubeClustersSorter(t *testing.T) {
 
 	// Test error.
 	sortBy = SortBy{Field: "unsupported"}
-	clusters = KubeClusters(makeClusters(testValsUnordered, ResourceMetadataName))
+	clusters = KubeClusters(makeClusters(testValsUnordered))
 	require.True(t, trace.IsNotImplemented(clusters.SortByCustom(sortBy)))
 }
 
diff --git a/lib/auth/access_request_test.go b/lib/auth/access_request_test.go
index f18b7a8dd75..03399d8b66a 100644
--- a/lib/auth/access_request_test.go
+++ b/lib/auth/access_request_test.go
@@ -508,7 +508,7 @@ func testAccessRequestDenyRules(t *testing.T, testPack *accessRequestTestPack) {
 		{
 			desc: "all allowed",
 			roles: map[string]types.RoleSpecV6{
-				"allow": types.RoleSpecV6{
+				"allow": {
 					Allow: types.RoleConditions{
 						Request: &types.AccessRequestConditions{
 							Roles: []string{"admins"},
@@ -523,7 +523,7 @@ func testAccessRequestDenyRules(t *testing.T, testPack *accessRequestTestPack) {
 		{
 			desc: "all denied",
 			roles: map[string]types.RoleSpecV6{
-				"allow": types.RoleSpecV6{
+				"allow": {
 					Allow: types.RoleConditions{
 						Request: &types.AccessRequestConditions{
 							Roles: []string{"admins"},
@@ -533,7 +533,7 @@ func testAccessRequestDenyRules(t *testing.T, testPack *accessRequestTestPack) {
 						},
 					},
 				},
-				"deny": types.RoleSpecV6{
+				"deny": {
 					Deny: types.RoleConditions{
 						Rules: []types.Rule{
 							{
@@ -550,7 +550,7 @@ func testAccessRequestDenyRules(t *testing.T, testPack *accessRequestTestPack) {
 		{
 			desc: "create denied",
 			roles: map[string]types.RoleSpecV6{
-				"allow": types.RoleSpecV6{
+				"allow": {
 					Allow: types.RoleConditions{
 						Request: &types.AccessRequestConditions{
 							Roles: []string{"admins"},
@@ -560,7 +560,7 @@ func testAccessRequestDenyRules(t *testing.T, testPack *accessRequestTestPack) {
 						},
 					},
 				},
-				"deny": types.RoleSpecV6{
+				"deny": {
 					Deny: types.RoleConditions{
 						Rules: []types.Rule{
 							{
@@ -576,7 +576,7 @@ func testAccessRequestDenyRules(t *testing.T, testPack *accessRequestTestPack) {
 		{
 			desc: "get denied",
 			roles: map[string]types.RoleSpecV6{
-				"allow": types.RoleSpecV6{
+				"allow": {
 					Allow: types.RoleConditions{
 						Request: &types.AccessRequestConditions{
 							Roles: []string{"admins"},
@@ -586,7 +586,7 @@ func testAccessRequestDenyRules(t *testing.T, testPack *accessRequestTestPack) {
 						},
 					},
 				},
-				"deny": types.RoleSpecV6{
+				"deny": {
 					Deny: types.RoleConditions{
 						Rules: []types.Rule{
 							{
@@ -602,7 +602,7 @@ func testAccessRequestDenyRules(t *testing.T, testPack *accessRequestTestPack) {
 		{
 			desc: "list denied",
 			roles: map[string]types.RoleSpecV6{
-				"allow": types.RoleSpecV6{
+				"allow": {
 					Allow: types.RoleConditions{
 						Request: &types.AccessRequestConditions{
 							Roles: []string{"admins"},
@@ -612,7 +612,7 @@ func testAccessRequestDenyRules(t *testing.T, testPack *accessRequestTestPack) {
 						},
 					},
 				},
-				"deny": types.RoleSpecV6{
+				"deny": {
 					Deny: types.RoleConditions{
 						Rules: []types.Rule{
 							{
diff --git a/lib/auth/auth.go b/lib/auth/auth.go
index 2f61f460fb6..477f751cb56 100644
--- a/lib/auth/auth.go
+++ b/lib/auth/auth.go
@@ -3050,7 +3050,7 @@ func (a *Server) PreAuthenticatedSignIn(ctx context.Context, user string, identi
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if err := a.upsertWebSession(ctx, user, sess); err != nil {
+	if err := a.upsertWebSession(ctx, sess); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return sess.WithoutSecrets(), nil
@@ -3816,7 +3816,7 @@ func (a *Server) ExtendWebSession(ctx context.Context, req WebSessionReq, identi
 
 	sess.SetConsumedAccessRequestID(req.AccessRequestID)
 
-	if err := a.upsertWebSession(ctx, req.User, sess); err != nil {
+	if err := a.upsertWebSession(ctx, sess); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -6253,7 +6253,7 @@ func (a *Server) ValidateMFAAuthResponse(ctx context.Context, resp *proto.MFAAut
 	}
 }
 
-func (a *Server) upsertWebSession(ctx context.Context, user string, session types.WebSession) error {
+func (a *Server) upsertWebSession(ctx context.Context, session types.WebSession) error {
 	if err := a.WebSessions().Upsert(ctx, session); err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/auth/auth_with_roles.go b/lib/auth/auth_with_roles.go
index 1190ff9ffd3..08c7afeeb03 100644
--- a/lib/auth/auth_with_roles.go
+++ b/lib/auth/auth_with_roles.go
@@ -2687,7 +2687,7 @@ func (a *ServerWithRoles) desiredAccessInfo(ctx context.Context, req *proto.User
 			log.WithError(err).Warn()
 			return nil, err
 		}
-		return a.desiredAccessInfoForImpersonation(req, user)
+		return a.desiredAccessInfoForImpersonation(user)
 	}
 	if isRoleImpersonation(*req) {
 		if len(req.AccessRequests) > 0 {
@@ -2702,7 +2702,7 @@ func (a *ServerWithRoles) desiredAccessInfo(ctx context.Context, req *proto.User
 
 // desiredAccessInfoForImpersonation returns the desired AccessInfo for an
 // impersonation request.
-func (a *ServerWithRoles) desiredAccessInfoForImpersonation(req *proto.UserCertsRequest, user types.User) (*services.AccessInfo, error) {
+func (a *ServerWithRoles) desiredAccessInfoForImpersonation(user types.User) (*services.AccessInfo, error) {
 	return &services.AccessInfo{
 		Roles:  user.GetRoles(),
 		Traits: user.GetTraits(),
diff --git a/lib/auth/auth_with_roles_test.go b/lib/auth/auth_with_roles_test.go
index b60878ecea9..c6be9877780 100644
--- a/lib/auth/auth_with_roles_test.go
+++ b/lib/auth/auth_with_roles_test.go
@@ -1467,7 +1467,7 @@ func BenchmarkListNodes(b *testing.B) {
 		b.Run(tc.desc, func(b *testing.B) {
 			benchmarkListNodes(
 				b, ctx,
-				nodeCount, roleCount, hiddenNodes,
+				nodeCount, hiddenNodes,
 				srv,
 				ids,
 				tc.editRole,
@@ -1478,7 +1478,7 @@ func BenchmarkListNodes(b *testing.B) {
 
 func benchmarkListNodes(
 	b *testing.B, ctx context.Context,
-	nodeCount, roleCount, hiddenNodes int,
+	nodeCount, hiddenNodes int,
 	srv *TestTLSServer,
 	ids []string,
 	editRole func(r types.Role, id string),
@@ -4847,7 +4847,7 @@ func BenchmarkListUnifiedResources(b *testing.B) {
 		b.Run(tc.desc, func(b *testing.B) {
 			benchmarkListUnifiedResources(
 				b, ctx,
-				nodeCount, roleCount, hiddenNodes,
+				nodeCount, hiddenNodes,
 				srv,
 				ids,
 				tc.editRole,
@@ -4858,7 +4858,7 @@ func BenchmarkListUnifiedResources(b *testing.B) {
 
 func benchmarkListUnifiedResources(
 	b *testing.B, ctx context.Context,
-	nodeCount, roleCount, hiddenNodes int,
+	nodeCount, hiddenNodes int,
 	srv *TestTLSServer,
 	ids []string,
 	editRole func(r types.Role, id string),
@@ -5449,7 +5449,7 @@ func TestCreateSAMLIdPServiceProvider(t *testing.T) {
 				require.NoError(t, client.Close())
 			})
 
-			modifyAndWaitForEvent(t, tc.ErrAssertion, client, srv, tc.EventCode, func() error {
+			modifyAndWaitForEvent(t, tc.ErrAssertion, srv, tc.EventCode, func() error {
 				return client.CreateSAMLIdPServiceProvider(ctx, tc.SP)
 			})
 		})
@@ -5543,7 +5543,7 @@ func TestUpdateSAMLIdPServiceProvider(t *testing.T) {
 				require.NoError(t, client.Close())
 			})
 
-			modifyAndWaitForEvent(t, tc.ErrAssertion, client, srv, tc.EventCode, func() error {
+			modifyAndWaitForEvent(t, tc.ErrAssertion, srv, tc.EventCode, func() error {
 				return client.UpdateSAMLIdPServiceProvider(ctx, tc.SP)
 			})
 		})
@@ -5572,7 +5572,7 @@ func TestDeleteSAMLIdPServiceProvider(t *testing.T) {
 	// No permissions delete
 	client, err := srv.NewClient(TestUser(noAccessUser))
 	require.NoError(t, err)
-	modifyAndWaitForEvent(t, require.Error, client, srv, events.SAMLIdPServiceProviderDeleteFailureCode, func() error {
+	modifyAndWaitForEvent(t, require.Error, srv, events.SAMLIdPServiceProviderDeleteFailureCode, func() error {
 		return client.DeleteSAMLIdPServiceProvider(ctx, sp.GetName())
 	})
 
@@ -5580,14 +5580,14 @@ func TestDeleteSAMLIdPServiceProvider(t *testing.T) {
 	client, err = srv.NewClient(TestUser(user))
 	require.NoError(t, err)
 
-	modifyAndWaitForEvent(t, require.NoError, client, srv, events.SAMLIdPServiceProviderDeleteCode, func() error {
+	modifyAndWaitForEvent(t, require.NoError, srv, events.SAMLIdPServiceProviderDeleteCode, func() error {
 		return client.DeleteSAMLIdPServiceProvider(ctx, sp.GetName())
 	})
 
 	require.NoError(t, client.CreateSAMLIdPServiceProvider(ctx, sp))
 
 	// Non-existent delete
-	modifyAndWaitForEvent(t, require.Error, client, srv, events.SAMLIdPServiceProviderDeleteFailureCode, func() error {
+	modifyAndWaitForEvent(t, require.Error, srv, events.SAMLIdPServiceProviderDeleteFailureCode, func() error {
 		return client.DeleteSAMLIdPServiceProvider(ctx, "nonexistent")
 	})
 }
@@ -5628,7 +5628,7 @@ func TestDeleteAllSAMLIdPServiceProviders(t *testing.T) {
 	client, err := srv.NewClient(TestUser(noAccessUser))
 	require.NoError(t, err)
 
-	modifyAndWaitForEvent(t, require.Error, client, srv, events.SAMLIdPServiceProviderDeleteAllFailureCode, func() error {
+	modifyAndWaitForEvent(t, require.Error, srv, events.SAMLIdPServiceProviderDeleteAllFailureCode, func() error {
 		return client.DeleteAllSAMLIdPServiceProviders(ctx)
 	})
 
@@ -5636,7 +5636,7 @@ func TestDeleteAllSAMLIdPServiceProviders(t *testing.T) {
 	client, err = srv.NewClient(TestUser(user))
 	require.NoError(t, err)
 
-	modifyAndWaitForEvent(t, require.NoError, client, srv, events.SAMLIdPServiceProviderDeleteAllCode, func() error {
+	modifyAndWaitForEvent(t, require.NoError, srv, events.SAMLIdPServiceProviderDeleteAllCode, func() error {
 		return client.DeleteAllSAMLIdPServiceProviders(ctx)
 	})
 }
@@ -5681,7 +5681,7 @@ func createSAMLIdPTestUsers(t *testing.T, server *Server) (string, string) {
 }
 
 // modifyAndWaitForEvent performs the function fn() and then waits for the given event.
-func modifyAndWaitForEvent(t *testing.T, errFn require.ErrorAssertionFunc, client *Client, srv *TestTLSServer, eventCode string, fn func() error) apievents.AuditEvent {
+func modifyAndWaitForEvent(t *testing.T, errFn require.ErrorAssertionFunc, srv *TestTLSServer, eventCode string, fn func() error) apievents.AuditEvent {
 	// Make sure we ignore events after consuming this one.
 	defer func() {
 		srv.AuthServer.AuthServer.emitter = events.NewDiscardEmitter()
diff --git a/lib/auth/clt.go b/lib/auth/clt.go
index 68a54744d21..5ba9e35a613 100644
--- a/lib/auth/clt.go
+++ b/lib/auth/clt.go
@@ -556,10 +556,6 @@ func (c *Client) UpsertUser(ctx context.Context, user types.User) (types.User, e
 		return nil, trace.Wrap(err)
 	}
 
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
 	upserted, err = c.GetUser(ctx, user.GetName(), false)
 	return upserted, trace.Wrap(err)
 }
diff --git a/lib/auth/grpcserver.go b/lib/auth/grpcserver.go
index 15081c17d82..00eea0a0311 100644
--- a/lib/auth/grpcserver.go
+++ b/lib/auth/grpcserver.go
@@ -332,9 +332,6 @@ func (g *GRPCServer) CreateAuditStream(stream authpb.AuthService_CreateAuditStre
 				}
 			}
 			g.Debugf("Completed stream for session %v", sessionID)
-			if err != nil {
-				return trace.Wrap(err)
-			}
 			return nil
 		} else if flushAndClose := request.GetFlushAndCloseStream(); flushAndClose != nil {
 			if eventStream == nil {
@@ -690,8 +687,7 @@ func (g *GRPCServer) generateUserSingleUseCerts(ctx context.Context, actx *grpcC
 	singleUseCert, err := userSingleUseCertsGenerate(
 		ctx,
 		actx,
-		*req,
-		nil /* mfaDev handled by generateUserCerts */)
+		*req)
 	if err != nil {
 		g.Entry.Warningf("Failed to generate single-use cert: %v", err)
 		return nil, trace.Wrap(err)
@@ -2541,7 +2537,7 @@ var ErrNoMFADevices = &trace.AccessDeniedError{
 	Message: "MFA is required to access this resource but user has no MFA devices; use 'tsh mfa add' to register MFA devices",
 }
 
-func userSingleUseCertsGenerate(ctx context.Context, actx *grpcContext, req authpb.UserCertsRequest, mfaDev *types.MFADevice) (*authpb.Certs, error) {
+func userSingleUseCertsGenerate(ctx context.Context, actx *grpcContext, req authpb.UserCertsRequest) (*authpb.Certs, error) {
 	// Get the client IP.
 	clientPeer, ok := peer.FromContext(ctx)
 	if !ok {
@@ -5229,9 +5225,6 @@ func NewGRPCServer(cfg GRPCServerConfig) (*GRPCServer, error) {
 		),
 		grpc.MaxConcurrentStreams(defaults.GRPCMaxConcurrentStreams),
 	)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
 
 	usersService, err := usersv1.NewService(usersv1.ServiceConfig{
 		Authorizer: cfg.Authorizer,
diff --git a/lib/auth/sessions.go b/lib/auth/sessions.go
index 9cab24d47a3..415a7c268de 100644
--- a/lib/auth/sessions.go
+++ b/lib/auth/sessions.go
@@ -258,7 +258,7 @@ func (a *Server) CreateWebSessionFromReq(ctx context.Context, req types.NewWebSe
 		return nil, trace.Wrap(err)
 	}
 
-	err = a.upsertWebSession(ctx, req.User, session)
+	err = a.upsertWebSession(ctx, session)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/web/apiserver.go b/lib/web/apiserver.go
index 1ddaa037b54..24cd29989db 100644
--- a/lib/web/apiserver.go
+++ b/lib/web/apiserver.go
@@ -3547,12 +3547,10 @@ func (h *Handler) siteSessionStreamGet(w http.ResponseWriter, r *http.Request, p
 	}
 
 	// look at 'offset' parameter
+	// (skip error check and treat an invalid offset as offset 0)
 	query := r.URL.Query()
 	offset, _ := strconv.Atoi(query.Get("offset"))
-	if err != nil {
-		onError(trace.Wrap(err))
-		return
-	}
+
 	max, err := strconv.Atoi(query.Get("bytes"))
 	if err != nil || max <= 0 {
 		max = maxStreamBytes
diff --git a/lib/web/apiserver_test.go b/lib/web/apiserver_test.go
index 67fc9d0d956..91f8a694016 100644
--- a/lib/web/apiserver_test.go
+++ b/lib/web/apiserver_test.go
@@ -2247,7 +2247,7 @@ func TestDesktopAccessMFARequiresMfa(t *testing.T) {
 
 			dev := tc.registerDevice(t, ctx, clt)
 
-			ws := proxy.makeDesktopSession(t, pack, session.NewID(), env.server.TLS.Listener.Addr())
+			ws := proxy.makeDesktopSession(t, pack)
 			tc.mfaHandler(t, ws, dev)
 
 			tdpClient := tdp.NewConn(&WebsocketIO{Conn: ws})
@@ -8060,7 +8060,7 @@ func makeAuthReqOverWS(ws *websocket.Conn, token string) error {
 	return nil
 }
 
-func (r *testProxy) makeDesktopSession(t *testing.T, pack *authPack, sessionID session.ID, addr net.Addr) *websocket.Conn {
+func (r *testProxy) makeDesktopSession(t *testing.T, pack *authPack) *websocket.Conn {
 	u := url.URL{
 		Host:   r.webURL.Host,
 		Scheme: client.WSS,
@@ -9119,7 +9119,7 @@ func TestWebSocketAuthenticateRequest(t *testing.T) {
 					return
 				}
 				t.Cleanup(func() { ws.Close() })
-				if err == nil && tc.serverExpectError != "" {
+				if tc.serverExpectError != "" {
 					t.Errorf("expected error, got nil")
 					return
 				}
diff --git a/lib/web/terminal.go b/lib/web/terminal.go
index baf5362e7af..0f6aed1a4e6 100644
--- a/lib/web/terminal.go
+++ b/lib/web/terminal.go
@@ -931,14 +931,12 @@ func (t *TerminalHandler) streamEvents(ctx context.Context, tc *client.TeleportC
 			logger.Debug("Sending audit event to web client.")
 
 			if err := t.stream.writeAuditEvent(data); err != nil {
-				if err != nil {
-					if errors.Is(err, websocket.ErrCloseSent) {
-						logger.WithError(err).Debug("Websocket was closed, no longer streaming events")
-						return
-					}
-					logger.WithError(err).Error("Unable to send audit event to web client")
-					continue
+				if errors.Is(err, websocket.ErrCloseSent) {
+					logger.WithError(err).Debug("Websocket was closed, no longer streaming events")
+					return
 				}
+				logger.WithError(err).Error("Unable to send audit event to web client")
+				continue
 			}
 
 		// Once the terminal stream is over (and the close envelope has been sent),
diff --git a/lib/web/users.go b/lib/web/users.go
index 0b013ac808e..cada9a3996c 100644
--- a/lib/web/users.go
+++ b/lib/web/users.go
@@ -40,7 +40,7 @@ func (h *Handler) updateUserHandle(w http.ResponseWriter, r *http.Request, param
 		return nil, trace.Wrap(err)
 	}
 
-	return updateUser(r, clt, ctx.GetUser())
+	return updateUser(r, clt)
 }
 
 func (h *Handler) createUserHandle(w http.ResponseWriter, r *http.Request, params httprouter.Params, ctx *SessionContext) (interface{}, error) {
@@ -146,7 +146,7 @@ func updateUserTraits(req *saveUserRequest, user types.User) {
 	}
 }
 
-func updateUser(r *http.Request, m userAPIGetter, createdBy string) (*ui.User, error) {
+func updateUser(r *http.Request, m userAPIGetter) (*ui.User, error) {
 	var req *saveUserRequest
 	if err := httplib.ReadJSON(r, &req); err != nil {
 		return nil, trace.Wrap(err)
diff --git a/lib/web/users_test.go b/lib/web/users_test.go
index 874d89939c8..5cd9beb80f9 100644
--- a/lib/web/users_test.go
+++ b/lib/web/users_test.go
@@ -101,7 +101,7 @@ func TestCRUDs(t *testing.T) {
 
 	// test update
 	u.Roles = []string{"newrole"}
-	user, err = updateUser(newRequest(t, u), m, "")
+	user, err = updateUser(newRequest(t, u), m)
 	require.NoError(t, err)
 	require.Contains(t, user.Roles, "newrole")
 
@@ -244,7 +244,7 @@ func TestUpdateUser_setTraits(t *testing.T) {
 				return user, nil
 			}
 
-			_, err = updateUser(newRequest(t, tt.updateReq), m, "")
+			_, err = updateUser(newRequest(t, tt.updateReq), m)
 			require.NoError(t, err)
 
 			// The traits match
@@ -297,7 +297,7 @@ func TestCRUDErrors(t *testing.T) {
 	}
 
 	// update errors
-	user, err := updateUser(newRequest(t, u), m, "")
+	user, err := updateUser(newRequest(t, u), m)
 	require.True(t, trace.IsNotFound(err))
 	require.Nil(t, user)
 
diff --git a/tool/tsh/common/app_aws_test.go b/tool/tsh/common/app_aws_test.go
index 00743072f9e..8efcd302535 100644
--- a/tool/tsh/common/app_aws_test.go
+++ b/tool/tsh/common/app_aws_test.go
@@ -46,7 +46,7 @@ func TestAWS(t *testing.T) {
 	user, awsRole := makeUserWithAWSRole(t)
 
 	authProcess, proxyProcess := makeTestServers(t, withBootstrap(connector, user, awsRole))
-	makeTestApplicationServer(t, authProcess, proxyProcess, servicecfg.App{
+	makeTestApplicationServer(t, proxyProcess, servicecfg.App{
 		Name: "aws-app",
 		URI:  constants.AWSConsoleURL,
 	})
@@ -199,7 +199,7 @@ func makeUserWithAWSRole(t *testing.T) (types.User, types.Role) {
 	return alice, awsRole
 }
 
-func makeTestApplicationServer(t *testing.T, auth *service.TeleportProcess, proxy *service.TeleportProcess, apps ...servicecfg.App) *service.TeleportProcess {
+func makeTestApplicationServer(t *testing.T, proxy *service.TeleportProcess, apps ...servicecfg.App) *service.TeleportProcess {
 	// Proxy uses self-signed certificates in tests.
 	lib.SetInsecureDevMode(true)
 
diff --git a/tool/tsh/common/app_azure_test.go b/tool/tsh/common/app_azure_test.go
index ec4472886bc..2cea912b550 100644
--- a/tool/tsh/common/app_azure_test.go
+++ b/tool/tsh/common/app_azure_test.go
@@ -47,7 +47,7 @@ func TestAzure(t *testing.T) {
 	user, azureRole := makeUserWithAzureRole(t)
 
 	authProcess, proxyProcess := makeTestServers(t, withBootstrap(connector, user, azureRole))
-	makeTestApplicationServer(t, authProcess, proxyProcess, servicecfg.App{
+	makeTestApplicationServer(t, proxyProcess, servicecfg.App{
 		Name:  "azure-api",
 		Cloud: types.CloudAzure,
 	})
diff --git a/tool/tsh/common/app_test.go b/tool/tsh/common/app_test.go
index 868e5aaac8f..0a71b27aac7 100644
--- a/tool/tsh/common/app_test.go
+++ b/tool/tsh/common/app_test.go
@@ -92,7 +92,7 @@ func TestAppLoginLeaf(t *testing.T) {
 	require.True(t, ok)
 
 	rootAppURL := startDummyHTTPServer(t, "rootapp")
-	rootAppServer := makeTestApplicationServer(t, rootAuth, rootProxy, servicecfg.App{Name: "rootapp", URI: rootAppURL})
+	rootAppServer := makeTestApplicationServer(t, rootProxy, servicecfg.App{Name: "rootapp", URI: rootAppURL})
 	_, err = rootAppServer.WaitForEventTimeout(time.Second*10, service.TeleportReadyEvent)
 	require.NoError(t, err)
 
@@ -119,7 +119,7 @@ func TestAppLoginLeaf(t *testing.T) {
 	leafAuth, leafProxy := makeTestServers(t, withClusterName(t, "leaf"), withConfig(configStorage))
 
 	leafAppURL := startDummyHTTPServer(t, "leafapp")
-	leafAppServer := makeTestApplicationServer(t, leafAuth, leafProxy, servicecfg.App{Name: "leafapp", URI: leafAppURL})
+	leafAppServer := makeTestApplicationServer(t, leafProxy, servicecfg.App{Name: "leafapp", URI: leafAppURL})
 	_, err = leafAppServer.WaitForEventTimeout(time.Second*10, service.TeleportReadyEvent)
 	require.NoError(t, err)
 
diff --git a/tool/tsh/common/db_print_test.go b/tool/tsh/common/db_print_test.go
index 4ce92d0fdbc..a8374363360 100644
--- a/tool/tsh/common/db_print_test.go
+++ b/tool/tsh/common/db_print_test.go
@@ -33,7 +33,7 @@ func Test_printDatabaseTable(t *testing.T) {
 	t.Parallel()
 
 	rows := []databaseTableRow{
-		databaseTableRow{
+		{
 			Proxy:        "proxy",
 			Cluster:      "cluster1",
 			DisplayName:  "db1",
@@ -45,7 +45,7 @@ func Test_printDatabaseTable(t *testing.T) {
 			Labels:       "Env=dev",
 			Connect:      "tsh db connect db1",
 		},
-		databaseTableRow{
+		{
 			Proxy:         "proxy",
 			Cluster:       "cluster1",
 			DisplayName:   "db2",
diff --git a/tool/tsh/common/fido2.go b/tool/tsh/common/fido2.go
index f7dd90dfdf7..8a2cbe9cf4d 100644
--- a/tool/tsh/common/fido2.go
+++ b/tool/tsh/common/fido2.go
@@ -65,7 +65,7 @@ type fido2DiagCommand struct {
 	*kingpin.CmdClause
 }
 
-func (_ *fido2DiagCommand) run(cf *CLIConf) error {
+func (*fido2DiagCommand) run(cf *CLIConf) error {
 	diag, err := wancli.FIDO2Diag(cf.Context, os.Stdout)
 	// Abort if we got a nil diagnostic, otherwise print as much as we can.
 	if diag == nil {
diff --git a/tool/tsh/common/kube_proxy_test.go b/tool/tsh/common/kube_proxy_test.go
index a350eaf84e9..fe337c24c8a 100644
--- a/tool/tsh/common/kube_proxy_test.go
+++ b/tool/tsh/common/kube_proxy_test.go
@@ -60,7 +60,7 @@ func (p *kubeTestPack) testProxyKube(t *testing.T) {
 
 		validateCmd := func(cmd *exec.Cmd) error {
 			config := kubeConfigFromCmdEnv(t, cmd)
-			checkKubeLocalProxyConfig(t, p.suite, config, p.rootClusterName, p.rootKubeCluster1)
+			checkKubeLocalProxyConfig(t, config, p.rootClusterName, p.rootKubeCluster1)
 			return nil
 		}
 		err := Run(
@@ -82,8 +82,8 @@ func (p *kubeTestPack) testProxyKube(t *testing.T) {
 
 		validateCmd := func(cmd *exec.Cmd) error {
 			config := kubeConfigFromCmdEnv(t, cmd)
-			checkKubeLocalProxyConfig(t, p.suite, config, p.rootClusterName, p.rootKubeCluster2)
-			checkKubeLocalProxyConfig(t, p.suite, config, p.leafClusterName, p.leafKubeCluster)
+			checkKubeLocalProxyConfig(t, config, p.rootClusterName, p.rootKubeCluster2)
+			checkKubeLocalProxyConfig(t, config, p.leafClusterName, p.leafKubeCluster)
 			return nil
 		}
 		err := Run(
@@ -116,7 +116,7 @@ func kubeConfigFromCmdEnv(t *testing.T, cmd *exec.Cmd) *clientcmdapi.Config {
 	return nil
 }
 
-func checkKubeLocalProxyConfig(t *testing.T, s *suite, config *clientcmdapi.Config, teleportCluster, kubeCluster string) {
+func checkKubeLocalProxyConfig(t *testing.T, config *clientcmdapi.Config, teleportCluster, kubeCluster string) {
 	t.Helper()
 
 	sendRequestToKubeLocalProxy(t, config, teleportCluster, kubeCluster)
diff --git a/tool/tsh/common/kube_test.go b/tool/tsh/common/kube_test.go
index 9f1e784e8e6..ac19165591d 100644
--- a/tool/tsh/common/kube_test.go
+++ b/tool/tsh/common/kube_test.go
@@ -556,7 +556,7 @@ func TestKubeSelection(t *testing.T) {
 					cmdRunner = func(cmd *exec.Cmd) error {
 						config := kubeConfigFromCmdEnv(t, cmd)
 						for _, kube := range test.wantProxied {
-							checkKubeLocalProxyConfig(t, s, config, rootClusterName, kube)
+							checkKubeLocalProxyConfig(t, config, rootClusterName, kube)
 						}
 						return nil
 					}
diff --git a/tool/tsh/common/proxy_test.go b/tool/tsh/common/proxy_test.go
index 0febb429571..2492f02f329 100644
--- a/tool/tsh/common/proxy_test.go
+++ b/tool/tsh/common/proxy_test.go
@@ -990,7 +990,7 @@ func mustLoginSetEnv(t *testing.T, s *suite, args ...string) (tshHome, kubeConfi
 	return
 }
 
-func mustLoginIdentity(t *testing.T, s *suite, opts ...CliOption) string {
+func mustLoginIdentity(t *testing.T, s *suite) string {
 	identityFile := path.Join(t.TempDir(), "identity.pem")
 	mustLogin(t, s, "--out", identityFile)
 	return identityFile
diff --git a/tool/tsh/common/tsh.go b/tool/tsh/common/tsh.go
index 024149d15a5..e4606212638 100644
--- a/tool/tsh/common/tsh.go
+++ b/tool/tsh/common/tsh.go
@@ -3513,7 +3513,7 @@ func onSCP(cf *CLIConf) error {
 		return tc.SFTP(cf.Context, cf.CopySpec, int(cf.NodePort), opts, cf.Quiet)
 	})
 	// don't print context canceled errors to the user
-	if err == nil || (err != nil && errors.Is(err, context.Canceled)) {
+	if err == nil || errors.Is(err, context.Canceled) {
 		return nil
 	}
 
@@ -4176,7 +4176,7 @@ func printStatus(debug bool, p *profileInfo, env map[string]string, isActive boo
 
 	proxyURL := p.getProxyURLLine(isActive, env)
 	cluster := p.getClusterLine(isActive, env)
-	kubeCluster := p.getKubeClusterLine(isActive, env, cluster)
+	kubeCluster := p.getKubeClusterLine(isActive, env)
 	if isActive {
 		prefix = "> "
 	} else {
@@ -4467,7 +4467,7 @@ func (p *profileInfo) getClusterLine(isActive bool, env map[string]string) strin
 	return p.Cluster
 }
 
-func (p *profileInfo) getKubeClusterLine(isActive bool, env map[string]string, cluster string) string {
+func (p *profileInfo) getKubeClusterLine(isActive bool, env map[string]string) string {
 	// indicate if active profile kube cluster is shadowed by env vars.
 	if isActive {
 		// check if kube cluster env var is set and no cluster was selected by kube config