diff --git a/cmd/internal/io/io.go b/cmd/internal/io/io.go
index b5368d7b94..f8d6e51073 100644
--- a/cmd/internal/io/io.go
+++ b/cmd/internal/io/io.go
@@ -71,7 +71,7 @@ func Write(w io.Writer, format string, data any) (err error) {
 		}
 	}
 	n := rv.Len()
-	for i := 0; i < n; i++ {
+	for i := range n {
 		if err = writeItem(rv.Index(i).Interface()); err != nil {
 			return err
 		}
diff --git a/cmd/ttn-lw-cli/commands/end_device_templates.go b/cmd/ttn-lw-cli/commands/end_device_templates.go
index 6b0915d664..772b899dfc 100644
--- a/cmd/ttn-lw-cli/commands/end_device_templates.go
+++ b/cmd/ttn-lw-cli/commands/end_device_templates.go
@@ -260,7 +260,7 @@ This command takes end device templates from stdin.`,
 					return err
 				}
 
-				for i := 0; i < count; i++ {
+				for range count {
 					res := ttnpb.Clone(&template)
 
 					var devEUI types.EUI64
diff --git a/cmd/ttn-lw-cli/commands/flags.go b/cmd/ttn-lw-cli/commands/flags.go
index 318ce5f484..f25535bf44 100644
--- a/cmd/ttn-lw-cli/commands/flags.go
+++ b/cmd/ttn-lw-cli/commands/flags.go
@@ -17,6 +17,7 @@ package commands
 import (
 	"fmt"
 	"io"
+	"maps"
 	"os"
 	"strconv"
 	"strings"
@@ -70,9 +71,7 @@ func forceFlags() *pflag.FlagSet {
 
 func mergeKV(attributes map[string]string, kv []string) map[string]string {
 	out := make(map[string]string, len(attributes)+len(kv))
-	for k, v := range attributes {
-		out[k] = v
-	}
+	maps.Copy(out, attributes)
 	for _, kv := range kv {
 		kv := strings.SplitN(kv, "=", 2)
 		if len(kv) != 2 {
diff --git a/cmd/ttn-lw-cli/commands/lorawan.go b/cmd/ttn-lw-cli/commands/lorawan.go
index e672e87abe..2afaade9f6 100644
--- a/cmd/ttn-lw-cli/commands/lorawan.go
+++ b/cmd/ttn-lw-cli/commands/lorawan.go
@@ -88,7 +88,7 @@ func decodeUplink(msg *ttnpb.Message, config lorawanConfig) (*lorawanDecodedFram
 		} else {
 			logger.Debug("Decrypting MAC buffer")
 			encOpts := macspec.EncryptionOptions(config.MACVersion, macspec.UplinkFrame, pld.FPort, cmdsInFOpts)
-			for msb := uint32(0); msb < 0xff; msb++ {
+			for msb := range uint32(0xff) {
 				fCnt := msb<<8 | pld.FHdr.FCnt
 				macBuf, err := crypto.DecryptUplink(config.NwkSEncKey, devAddr, fCnt, macBuf, encOpts...)
 				if err == nil {
@@ -171,7 +171,7 @@ func decodeDownlink(msg *ttnpb.Message, config lorawanConfig) (*lorawanDecodedFr
 	if len(macBuf) > 0 && (!cmdsInFOpts || macspec.EncryptFOpts(config.MACVersion)) && !config.NwkSKey.IsZero() {
 		logger.Debug("Decrypting MAC buffer")
 		encOpts := macspec.EncryptionOptions(config.MACVersion, macspec.DownlinkFrame, pld.FPort, cmdsInFOpts)
-		for msb := uint32(0); msb < 0xffff; msb++ {
+		for msb := range uint32(0xffff) {
 			fCnt := msb<<16 | pld.FHdr.FCnt
 			macBuf, err := crypto.DecryptDownlink(config.NwkSKey, devAddr, fCnt, macBuf, encOpts...)
 			if err == nil {
diff --git a/cmd/ttn-lw-cli/commands/simulate.go b/cmd/ttn-lw-cli/commands/simulate.go
index 83959c3a29..32063ac22b 100644
--- a/cmd/ttn-lw-cli/commands/simulate.go
+++ b/cmd/ttn-lw-cli/commands/simulate.go
@@ -154,7 +154,7 @@ func startSimulation(
 	logger.Info("Sent uplink")
 
 	expect, _ := cmd.Flags().GetInt("downlinks")
-	for i := 0; i < expect; i++ {
+	for range expect {
 		down, err := link.Recv()
 		if err != nil {
 			return err
diff --git a/cmd/ttn-lw-stack/commands/start.go b/cmd/ttn-lw-stack/commands/start.go
index 52b06b9d23..55277921ac 100644
--- a/cmd/ttn-lw-stack/commands/start.go
+++ b/cmd/ttn-lw-stack/commands/start.go
@@ -352,10 +352,7 @@ var startCommand = &cobra.Command{
 
 			logger.Info("Setting up Network Server")
 
-			applicationUplinkQueueSize := config.NS.ApplicationUplinkQueue.BufferSize
-			if config.NS.ApplicationUplinkQueue.BufferSize > math.MaxInt64 {
-				applicationUplinkQueueSize = math.MaxInt64
-			}
+			applicationUplinkQueueSize := min(config.NS.ApplicationUplinkQueue.BufferSize, math.MaxInt64)
 			applicationUplinkQueue := nsredis.NewApplicationUplinkQueue(
 				NewNetworkServerApplicationUplinkQueueRedis(config),
 				int64(applicationUplinkQueueSize),
diff --git a/cmd/ttn-lw-stack/commands/utils.go b/cmd/ttn-lw-stack/commands/utils.go
index be358a5f79..a15c0c8d64 100644
--- a/cmd/ttn-lw-stack/commands/utils.go
+++ b/cmd/ttn-lw-stack/commands/utils.go
@@ -58,7 +58,7 @@ func NewClusterComponentConnection(ctx context.Context,
 		return nil, nil, err
 	}
 	var cc *grpc.ClientConn
-	for i := 0; i < maxRetries; i++ {
+	for range maxRetries {
 		time.Sleep(delay)
 		cc, err = c.GetPeerConn(ctx, role, nil)
 		if err == nil {
diff --git a/pkg/applicationserver/applicationserver_test.go b/pkg/applicationserver/applicationserver_test.go
index ce5999de30..dfb867580f 100644
--- a/pkg/applicationserver/applicationserver_test.go
+++ b/pkg/applicationserver/applicationserver_test.go
@@ -2158,7 +2158,7 @@ func TestApplicationServer(t *testing.T) {
 						default:
 							t.Fatal("Expected downlink error")
 						}
-						for i := 0; i < len(items); i++ {
+						for range items {
 							select {
 							case up := <-chs.up:
 								a.So(up.Up, should.HaveSameTypeAs, &ttnpb.ApplicationUp_DownlinkQueued{})
@@ -2245,7 +2245,7 @@ func TestApplicationServer(t *testing.T) {
 					default:
 						t.Fatal("Expected downlink error")
 					}
-					for i := 0; i < 2; i++ {
+					for range 2 {
 						select {
 						case up := <-chs.up:
 							a.So(up.Up, should.HaveSameTypeAs, &ttnpb.ApplicationUp_DownlinkQueued{})
@@ -2784,7 +2784,7 @@ func TestSkipPayloadCrypto(t *testing.T) {
 						default:
 							t.Fatal("Expected downlink error")
 						}
-						for i := 0; i < len(items); i++ {
+						for range items {
 							select {
 							case up := <-chs.up:
 								a.So(up.Up, should.HaveSameTypeAs, &ttnpb.ApplicationUp_DownlinkQueued{})
@@ -2973,7 +2973,7 @@ func TestLocationFromPayload(t *testing.T) {
 	// The uplink message and the location solved message may come out of order.
 	// Expect exactly two messages.
 	var loc *ttnpb.ApplicationLocation
-	for i := 0; i < 2; i++ {
+	for i := range 2 {
 		select {
 		case msg := <-sub.Up():
 			msgLoc := msg.ApplicationUp.GetLocationSolved()
@@ -3144,7 +3144,7 @@ func TestUplinkNormalized(t *testing.T) {
 	// The uplink message and the normalized payload message may come out of order.
 	// Expect exactly two messages.
 	var normalized *ttnpb.ApplicationUplinkNormalized
-	for i := 0; i < 2; i++ {
+	for i := range 2 {
 		select {
 		case msg := <-sub.Up():
 			if n := msg.GetUplinkNormalized(); n != nil {
diff --git a/pkg/applicationserver/io/grpc/grpc_util_test.go b/pkg/applicationserver/io/grpc/grpc_util_test.go
index a971965032..c587c04bc2 100644
--- a/pkg/applicationserver/io/grpc/grpc_util_test.go
+++ b/pkg/applicationserver/io/grpc/grpc_util_test.go
@@ -51,7 +51,7 @@ func (m *mockRegisterer) RegisterHandlers(s *runtime.ServeMux, conn *grpc.Client
 }
 
 func mustHavePeer(ctx context.Context, c *component.Component, role ttnpb.ClusterRole) {
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(20 * time.Millisecond)
 		if _, err := c.GetPeer(ctx, role, nil); err == nil {
 			return
diff --git a/pkg/applicationserver/io/mqtt/mqtt_util_test.go b/pkg/applicationserver/io/mqtt/mqtt_util_test.go
index 04912e7974..6317de2d92 100644
--- a/pkg/applicationserver/io/mqtt/mqtt_util_test.go
+++ b/pkg/applicationserver/io/mqtt/mqtt_util_test.go
@@ -28,7 +28,7 @@ var testRights = []ttnpb.Right{
 }
 
 func mustHavePeer(ctx context.Context, c *component.Component, role ttnpb.ClusterRole) {
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(20 * time.Millisecond)
 		if _, err := c.GetPeer(ctx, role, nil); err == nil {
 			return
diff --git a/pkg/applicationserver/io/packages/loradms/v1/api/objects/objects.go b/pkg/applicationserver/io/packages/loradms/v1/api/objects/objects.go
index 9cfd5f9fb9..86227ab3f8 100644
--- a/pkg/applicationserver/io/packages/loradms/v1/api/objects/objects.go
+++ b/pkg/applicationserver/io/packages/loradms/v1/api/objects/objects.go
@@ -312,7 +312,7 @@ type Hex []byte
 
 // MarshalJSON implements json.Marshaler.
 func (h Hex) MarshalJSON() ([]byte, error) {
-	return []byte(fmt.Sprintf("\"%s\"", hex.EncodeToString(h))), nil
+	return fmt.Appendf(nil, "\"%s\"", hex.EncodeToString(h)), nil
 }
 
 // String implements fmt.Stringer.
@@ -337,7 +337,7 @@ const (
 
 // MarshalJSON implements json.Marshaler.
 func (e EUI) MarshalJSON() ([]byte, error) {
-	return []byte(fmt.Sprintf(hyphenatedEUIPattern, e[0], e[1], e[2], e[3], e[4], e[5], e[6], e[7])), nil
+	return fmt.Appendf(nil, hyphenatedEUIPattern, e[0], e[1], e[2], e[3], e[4], e[5], e[6], e[7]), nil
 }
 
 // UnmarshalJSON implements json.Unmarshaler.
diff --git a/pkg/applicationserver/io/packages/loragls/v3/api/objects.go b/pkg/applicationserver/io/packages/loragls/v3/api/objects.go
index f074a3a6ad..d9e60f549d 100644
--- a/pkg/applicationserver/io/packages/loragls/v3/api/objects.go
+++ b/pkg/applicationserver/io/packages/loragls/v3/api/objects.go
@@ -292,7 +292,7 @@ type Hex []byte
 
 // MarshalJSON implements json.Marshaler.
 func (h Hex) MarshalJSON() ([]byte, error) {
-	return []byte(fmt.Sprintf("\"%s\"", hex.EncodeToString(h))), nil
+	return fmt.Appendf(nil, "\"%s\"", hex.EncodeToString(h)), nil
 }
 
 // String implements fmt.Stringer.
diff --git a/pkg/applicationserver/io/packages/util_test.go b/pkg/applicationserver/io/packages/util_test.go
index 815fd701b1..172fd97105 100644
--- a/pkg/applicationserver/io/packages/util_test.go
+++ b/pkg/applicationserver/io/packages/util_test.go
@@ -26,7 +26,7 @@ import (
 )
 
 func mustHavePeer(ctx context.Context, c *component.Component, role ttnpb.ClusterRole) {
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(20 * time.Millisecond)
 		if _, err := c.GetPeer(ctx, role, nil); err == nil {
 			return
diff --git a/pkg/applicationserver/io/pubsub/provider/connection.go b/pkg/applicationserver/io/pubsub/provider/connection.go
index a8240f9135..fafd9d3e5c 100644
--- a/pkg/applicationserver/io/pubsub/provider/connection.go
+++ b/pkg/applicationserver/io/pubsub/provider/connection.go
@@ -129,7 +129,7 @@ func isNil(c any) bool {
 	if c == nil {
 		return true
 	}
-	if val := reflect.ValueOf(c); val.Kind() == reflect.Ptr {
+	if val := reflect.ValueOf(c); val.Kind() == reflect.Pointer {
 		return val.IsNil()
 	}
 	return false
diff --git a/pkg/applicationserver/io/pubsub/providers.go b/pkg/applicationserver/io/pubsub/providers.go
index 75b4979713..ebadedcb52 100644
--- a/pkg/applicationserver/io/pubsub/providers.go
+++ b/pkg/applicationserver/io/pubsub/providers.go
@@ -56,9 +56,9 @@ func providerStatusFromString(s string) (ProviderStatus, error) {
 func providerTypeFromString(ctx context.Context, s string) (reflect.Type, error) {
 	switch s {
 	case "mqtt":
-		return reflect.TypeOf(&ttnpb.ApplicationPubSub_Mqtt{}), nil
+		return reflect.TypeFor[*ttnpb.ApplicationPubSub_Mqtt](), nil
 	case "nats":
-		return reflect.TypeOf(&ttnpb.ApplicationPubSub_Nats{}), nil
+		return reflect.TypeFor[*ttnpb.ApplicationPubSub_Nats](), nil
 	default:
 		log.FromContext(ctx).WithField("provider", s).Warn("Unknown PubSub provider specified")
 		return nil, nil
diff --git a/pkg/applicationserver/io/pubsub/util_test.go b/pkg/applicationserver/io/pubsub/util_test.go
index 0f62568a20..ebd7439d8a 100644
--- a/pkg/applicationserver/io/pubsub/util_test.go
+++ b/pkg/applicationserver/io/pubsub/util_test.go
@@ -67,7 +67,7 @@ func (m *mockRegisterer) RegisterHandlers(s *runtime.ServeMux, conn *grpc.Client
 }
 
 func mustHavePeer(ctx context.Context, c *component.Component, role ttnpb.ClusterRole) {
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(20 * time.Millisecond)
 		if _, err := c.GetPeer(ctx, role, nil); err == nil {
 			return
diff --git a/pkg/applicationserver/io/web/util_test.go b/pkg/applicationserver/io/web/util_test.go
index e51b13842d..6968089f10 100644
--- a/pkg/applicationserver/io/web/util_test.go
+++ b/pkg/applicationserver/io/web/util_test.go
@@ -70,7 +70,7 @@ func (m *mockRegisterer) RegisterHandlers(s *runtime.ServeMux, conn *grpc.Client
 }
 
 func mustHavePeer(ctx context.Context, c *component.Component, role ttnpb.ClusterRole) {
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(20 * time.Millisecond)
 		if _, err := c.GetPeer(ctx, role, nil); err == nil {
 			return
diff --git a/pkg/applicationserver/metadata/end_device_registry_test.go b/pkg/applicationserver/metadata/end_device_registry_test.go
index 9aac154a89..839ecd7acb 100644
--- a/pkg/applicationserver/metadata/end_device_registry_test.go
+++ b/pkg/applicationserver/metadata/end_device_registry_test.go
@@ -15,6 +15,7 @@
 package metadata_test
 
 import (
+	"maps"
 	"testing"
 	"time"
 
@@ -136,17 +137,13 @@ func TestClusterEndDeviceRegistry(t *testing.T) { // nolint:gocyclo
 				stored.Locations = make(map[string]*ttnpb.Location, len(locationsPatch))
 			}
 
-			for k, l := range locationsPatch {
-				stored.Locations[k] = l
-			}
+			maps.Copy(stored.Locations, locationsPatch)
 
 			if len(stored.Attributes) == 0 {
 				stored.Attributes = make(map[string]string, len(attributesPatch))
 			}
 
-			for k, v := range attributesPatch {
-				stored.Attributes[k] = v
-			}
+			maps.Copy(stored.Attributes, attributesPatch)
 
 			return stored, []string{"locations", "attributes"}, nil
 		},
diff --git a/pkg/applicationserver/metadata/metadata_util_test.go b/pkg/applicationserver/metadata/metadata_util_test.go
index 56407cc45b..634ca65ae7 100644
--- a/pkg/applicationserver/metadata/metadata_util_test.go
+++ b/pkg/applicationserver/metadata/metadata_util_test.go
@@ -23,7 +23,7 @@ import (
 )
 
 func mustHavePeer(ctx context.Context, c *component.Component, role ttnpb.ClusterRole) { // nolint: unparam
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(20 * time.Millisecond)
 		if _, err := c.GetPeer(ctx, role, nil); err == nil {
 			return
diff --git a/pkg/applicationserver/util_test.go b/pkg/applicationserver/util_test.go
index 92d1594f4d..73d30658ec 100644
--- a/pkg/applicationserver/util_test.go
+++ b/pkg/applicationserver/util_test.go
@@ -41,7 +41,7 @@ var testRights = []ttnpb.Right{
 }
 
 func mustHavePeer(ctx context.Context, c *component.Component, role ttnpb.ClusterRole) {
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(20 * time.Millisecond)
 		if _, err := c.GetPeer(ctx, role, nil); err == nil {
 			return
diff --git a/pkg/auth/mtls/proxy_headers.go b/pkg/auth/mtls/proxy_headers.go
index 9a50e13870..5e6757ab61 100644
--- a/pkg/auth/mtls/proxy_headers.go
+++ b/pkg/auth/mtls/proxy_headers.go
@@ -46,8 +46,8 @@ func FromProxyHeaders(h HeaderReader) (*x509.Certificate, bool, error) {
 			// See https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_conn_man/headers#x-forwarded-client-cert
 			key: "x-forwarded-client-cert",
 			parse: func(value string) (*x509.Certificate, bool, error) {
-				parts := strings.Split(value, ";")
-				for _, part := range parts {
+				parts := strings.SplitSeq(value, ";")
+				for part := range parts {
 					chainPEM, found := strings.CutPrefix(part, "Chain=")
 					if !found {
 						continue
diff --git a/pkg/auth/rights/cache.go b/pkg/auth/rights/cache.go
index eca6d3f051..01193bd3b5 100644
--- a/pkg/auth/rights/cache.go
+++ b/pkg/auth/rights/cache.go
@@ -136,10 +136,7 @@ type inMemoryCache struct {
 
 // maybeCleanup cleans up expired results if necessary.
 func (f *inMemoryCache) maybeCleanup() {
-	cleanupTTL := f.successTTL
-	if f.errorTTL > cleanupTTL {
-		cleanupTTL = f.errorTTL
-	}
+	cleanupTTL := max(f.errorTTL, f.successTTL)
 	if now().Sub(f.lastCleanup) <= cleanupTTL*10 {
 		return
 	}
diff --git a/pkg/band/au_915_928.go b/pkg/band/au_915_928.go
index 8a72f5a94a..91439a4922 100644
--- a/pkg/band/au_915_928.go
+++ b/pkg/band/au_915_928.go
@@ -43,13 +43,13 @@ var (
 
 	au915928UplinkChannels = func(commonDelta, wideChannelDelta ttnpb.DataRateIndex) []Channel {
 		uplinkChannels := make([]Channel, 0, 72)
-		for i := 0; i < 64; i++ {
+		for i := range 64 {
 			uplinkChannels = append(uplinkChannels, Channel{
 				Frequency:   uint64(915200000 + 200000*i),
 				MaxDataRate: ttnpb.DataRateIndex_DATA_RATE_5 + commonDelta,
 			})
 		}
-		for i := 0; i < 8; i++ {
+		for i := range 8 {
 			uplinkChannels = append(uplinkChannels, Channel{
 				Frequency:   uint64(915900000 + 1600000*i),
 				MinDataRate: ttnpb.DataRateIndex_DATA_RATE_6 + commonDelta,
@@ -61,7 +61,7 @@ var (
 
 	au915928DownlinkChannels = func() []Channel {
 		downlinkChannels := make([]Channel, 0, 8)
-		for i := 0; i < 8; i++ {
+		for i := range 8 {
 			downlinkChannels = append(downlinkChannels, Channel{
 				Frequency:   uint64(923300000 + 600000*i),
 				MinDataRate: ttnpb.DataRateIndex_DATA_RATE_8,
diff --git a/pkg/band/beacon.go b/pkg/band/beacon.go
index 5edb7ee4e5..f3fa42a602 100644
--- a/pkg/band/beacon.go
+++ b/pkg/band/beacon.go
@@ -42,7 +42,7 @@ type Beacon struct {
 
 var usAuBeaconFrequencies = func() []uint64 {
 	freqs := make([]uint64, 8)
-	for i := 0; i < 8; i++ {
+	for i := range 8 {
 		freqs[i] = 923300000 + uint64(i*600000)
 	}
 	return freqs
diff --git a/pkg/band/channel_mask.go b/pkg/band/channel_mask.go
index 00c48b0fb4..a7d57de990 100644
--- a/pkg/band/channel_mask.go
+++ b/pkg/band/channel_mask.go
@@ -207,7 +207,7 @@ func generateChMaskMatrix(pairs []ChMaskCntlPair, currentChs, desiredChs []bool)
 		return nil, errInvalidChannelCount.New()
 	}
 	for i := 0; i < n/16; i++ {
-		for j := 0; j < 16; j++ {
+		for j := range 16 {
 			if currentChs[16*i+j] != desiredChs[16*i+j] {
 				pairs = append(pairs, ChMaskCntlPair{
 					Cntl: uint8(i),
@@ -460,7 +460,7 @@ func makeGenerateChMask72(supportChMaskCntl5 bool, atomic bool) func([]bool, []b
 		}
 
 		var fsbs [8]bool
-		for i := 0; i < 8; i++ {
+		for i := range 8 {
 			if trueCount(desiredChs[8*i:8*i+8]...) == 8 {
 				fsbs[i] = true
 			}
diff --git a/pkg/band/cn_470_510.go b/pkg/band/cn_470_510.go
index 7a86f94b27..4266ccc287 100644
--- a/pkg/band/cn_470_510.go
+++ b/pkg/band/cn_470_510.go
@@ -33,7 +33,7 @@ var (
 
 	cn470510UplinkChannels = func() []Channel {
 		uplinkChannels := make([]Channel, 0, 96)
-		for i := 0; i < 96; i++ {
+		for i := range 96 {
 			uplinkChannels = append(uplinkChannels, Channel{
 				Frequency:   uint64(470300000 + 200000*i),
 				MaxDataRate: ttnpb.DataRateIndex_DATA_RATE_5,
@@ -44,7 +44,7 @@ var (
 
 	cn470510DownlinkChannels = func() []Channel {
 		downlinkChannels := make([]Channel, 0, 48)
-		for i := 0; i < 48; i++ {
+		for i := range 48 {
 			downlinkChannels = append(downlinkChannels, Channel{
 				Frequency:   uint64(500300000 + 200000*i),
 				MaxDataRate: ttnpb.DataRateIndex_DATA_RATE_5,
@@ -55,7 +55,7 @@ var (
 
 	cn470510BeaconFrequencies = func() []uint64 {
 		freqs := make([]uint64, 8)
-		for i := 0; i < 8; i++ {
+		for i := range 8 {
 			freqs[i] = 508300000 + uint64(i*200000)
 		}
 		return freqs
diff --git a/pkg/band/cn_470_510_20_a.go b/pkg/band/cn_470_510_20_a.go
index 3f382efb2d..e8ce6ff3d9 100644
--- a/pkg/band/cn_470_510_20_a.go
+++ b/pkg/band/cn_470_510_20_a.go
@@ -25,7 +25,7 @@ var (
 	cn47051020AUplinkChannels = func(minDataRateIndex ttnpb.DataRateIndex) []Channel {
 		uplinkChannels := make([]Channel, 0, 64)
 		// 20 MHz Type A Group 1
-		for i := 0; i < 32; i++ {
+		for i := range 32 {
 			uplinkChannels = append(uplinkChannels, Channel{
 				Frequency:   uint64(470300000 + 200000*i),
 				MinDataRate: minDataRateIndex,
@@ -33,7 +33,7 @@ var (
 			})
 		}
 		// 20 MHz Type A Group 2
-		for i := 0; i < 32; i++ {
+		for i := range 32 {
 			uplinkChannels = append(uplinkChannels, Channel{
 				Frequency:   uint64(503500000 + 200000*i),
 				MinDataRate: minDataRateIndex,
@@ -46,7 +46,7 @@ var (
 	cn47051020ADownlinkChannels = func(minDataRateIndex ttnpb.DataRateIndex) []Channel {
 		downlinkChannels := make([]Channel, 0, 64)
 		// 20 MHz Type A Group 1
-		for i := 0; i < 32; i++ {
+		for i := range 32 {
 			downlinkChannels = append(downlinkChannels, Channel{
 				Frequency:   uint64(483900000 + 200000*i),
 				MinDataRate: minDataRateIndex,
@@ -54,7 +54,7 @@ var (
 			})
 		}
 		// 20 MHz Type A Group 2
-		for i := 0; i < 32; i++ {
+		for i := range 32 {
 			downlinkChannels = append(downlinkChannels, Channel{
 				Frequency:   uint64(490300000 + 200000*i),
 				MinDataRate: minDataRateIndex,
diff --git a/pkg/band/cn_470_510_20_b.go b/pkg/band/cn_470_510_20_b.go
index fb7b4898bd..0305e51cb1 100644
--- a/pkg/band/cn_470_510_20_b.go
+++ b/pkg/band/cn_470_510_20_b.go
@@ -25,7 +25,7 @@ var (
 	cn47051020BUplinkChannels = func(minDataRateIndex ttnpb.DataRateIndex) []Channel {
 		uplinkChannels := make([]Channel, 0, 64)
 		// 20 MHz Type B Group 1
-		for i := 0; i < 32; i++ {
+		for i := range 32 {
 			uplinkChannels = append(uplinkChannels, Channel{
 				Frequency:   uint64(476900000 + 200000*i),
 				MinDataRate: minDataRateIndex,
@@ -33,7 +33,7 @@ var (
 			})
 		}
 		// 20 MHz Type B Group 2
-		for i := 0; i < 32; i++ {
+		for i := range 32 {
 			uplinkChannels = append(uplinkChannels, Channel{
 				Frequency:   uint64(496900000 + 200000*i),
 				MinDataRate: minDataRateIndex,
@@ -46,7 +46,7 @@ var (
 	cn47051020BDownlinkChannels = func(minDataRateIndex ttnpb.DataRateIndex) []Channel {
 		downlinkChannels := make([]Channel, 0, 64)
 		// 20 MHz Type B Group 1
-		for i := 0; i < 32; i++ {
+		for i := range 32 {
 			downlinkChannels = append(downlinkChannels, Channel{
 				Frequency:   uint64(476900000 + 200000*i),
 				MinDataRate: minDataRateIndex,
@@ -54,7 +54,7 @@ var (
 			})
 		}
 		// 20 MHz Type B Group 2
-		for i := 0; i < 32; i++ {
+		for i := range 32 {
 			downlinkChannels = append(downlinkChannels, Channel{
 				Frequency:   uint64(496900000 + 200000*i),
 				MinDataRate: minDataRateIndex,
diff --git a/pkg/band/cn_470_510_26_a.go b/pkg/band/cn_470_510_26_a.go
index 5cf3b5cea8..69858bcd85 100644
--- a/pkg/band/cn_470_510_26_a.go
+++ b/pkg/band/cn_470_510_26_a.go
@@ -27,7 +27,7 @@ var (
 	cn47051026AUplinkChannels = func(minDataRateIndex ttnpb.DataRateIndex) []Channel {
 		uplinkChannels := make([]Channel, 0, 48)
 		// 26 MHz Type A
-		for i := 0; i < 48; i++ {
+		for i := range 48 {
 			uplinkChannels = append(uplinkChannels, Channel{
 				Frequency:   uint64(470300000 + 200000*i),
 				MinDataRate: minDataRateIndex,
@@ -40,7 +40,7 @@ var (
 	cn47051026ADownlinkChannels = func(minDataRateIndex ttnpb.DataRateIndex) []Channel {
 		downlinkChannels := make([]Channel, 0, 24)
 		// 26 MHz Type A
-		for i := 0; i < 24; i++ {
+		for i := range 24 {
 			downlinkChannels = append(downlinkChannels, Channel{
 				Frequency:   uint64(490100000 + 200000*i),
 				MinDataRate: minDataRateIndex,
diff --git a/pkg/band/cn_470_510_26_b.go b/pkg/band/cn_470_510_26_b.go
index ddbf861f2b..6d7515d8d2 100644
--- a/pkg/band/cn_470_510_26_b.go
+++ b/pkg/band/cn_470_510_26_b.go
@@ -27,7 +27,7 @@ var (
 	cn47051026BUplinkChannels = func(minDataRateIndex ttnpb.DataRateIndex) []Channel {
 		uplinkChannels := make([]Channel, 0, 48)
 		// 26 MHz Type B
-		for i := 0; i < 48; i++ {
+		for i := range 48 {
 			uplinkChannels = append(uplinkChannels, Channel{
 				Frequency:   uint64(480300000 + 200000*i),
 				MinDataRate: minDataRateIndex,
@@ -40,7 +40,7 @@ var (
 	cn47051026BDownlinkChannels = func(minDataRateIndex ttnpb.DataRateIndex) []Channel {
 		downlinkChannels := make([]Channel, 0, 24)
 		// 26 MHz Type B
-		for i := 0; i < 24; i++ {
+		for i := range 24 {
 			downlinkChannels = append(downlinkChannels, Channel{
 				Frequency:   uint64(500100000 + 200000*i),
 				MinDataRate: minDataRateIndex,
diff --git a/pkg/band/us_902_928.go b/pkg/band/us_902_928.go
index d1314fbdd6..28f6a36060 100644
--- a/pkg/band/us_902_928.go
+++ b/pkg/band/us_902_928.go
@@ -24,13 +24,13 @@ const (
 var (
 	us902928UplinkChannels = func(wideChannelDelta ttnpb.DataRateIndex) []Channel {
 		uplinkChannels := make([]Channel, 0, 72)
-		for i := 0; i < 64; i++ {
+		for i := range 64 {
 			uplinkChannels = append(uplinkChannels, Channel{
 				Frequency:   uint64(902300000 + 200000*i),
 				MaxDataRate: ttnpb.DataRateIndex_DATA_RATE_3,
 			})
 		}
-		for i := 0; i < 8; i++ {
+		for i := range 8 {
 			uplinkChannels = append(uplinkChannels, Channel{
 				Frequency:   uint64(903000000 + 1600000*i),
 				MinDataRate: ttnpb.DataRateIndex_DATA_RATE_4,
@@ -42,7 +42,7 @@ var (
 
 	us902928DownlinkChannels = func() []Channel {
 		downlinkChannels := make([]Channel, 0, 8)
-		for i := 0; i < 8; i++ {
+		for i := range 8 {
 			downlinkChannels = append(downlinkChannels, Channel{
 				Frequency:   uint64(923300000 + 600000*i),
 				MinDataRate: ttnpb.DataRateIndex_DATA_RATE_8,
diff --git a/pkg/basicstation/cups/messages.go b/pkg/basicstation/cups/messages.go
index 34ddafc6bf..b270b07d33 100644
--- a/pkg/basicstation/cups/messages.go
+++ b/pkg/basicstation/cups/messages.go
@@ -96,7 +96,7 @@ func TokenCredentials(trust *x509.Certificate, authorization string) ([]byte, er
 	out = append(out, trust.Raw...)
 	// TODO: Refactor when client side TLS is supported https://github.com/TheThingsNetwork/lorawan-stack/issues/137
 	out = append(out, emptyClientCert...)
-	out = append(out, []byte(fmt.Sprintf("%s%s%s", "Authorization: ", strings.TrimRight(authorization, "\r\n"), "\r\n"))...)
+	out = append(out, fmt.Appendf(nil, "%s%s%s", "Authorization: ", strings.TrimRight(authorization, "\r\n"), "\r\n")...)
 	return out, nil
 }
 
diff --git a/pkg/cluster/cluster_test.go b/pkg/cluster/cluster_test.go
index 7219da8824..f5b7357991 100644
--- a/pkg/cluster/cluster_test.go
+++ b/pkg/cluster/cluster_test.go
@@ -79,7 +79,7 @@ func TestCluster(t *testing.T) {
 
 	// The Identity Server playing the ACCESS role should be there within reasonable time.
 	var ac Peer
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(20 * time.Millisecond) // Wait for peers to join cluster.
 		ac, err = c.GetPeer(ctx, ttnpb.ClusterRole_ACCESS, nil)
 		if err == nil {
diff --git a/pkg/cluster/peer.go b/pkg/cluster/peer.go
index 9c25456e68..728cd364e5 100644
--- a/pkg/cluster/peer.go
+++ b/pkg/cluster/peer.go
@@ -16,6 +16,7 @@ package cluster
 
 import (
 	"context"
+	"slices"
 
 	"go.thethings.network/lorawan-stack/v3/pkg/ttnpb"
 	"google.golang.org/grpc"
@@ -56,10 +57,5 @@ func (p *peer) Tags() map[string]string         { return p.tags }
 
 func (p *peer) HasRole(wanted ttnpb.ClusterRole) bool {
 	roles := p.Roles()
-	for _, role := range roles {
-		if role == wanted {
-			return true
-		}
-	}
-	return false
+	return slices.Contains(roles, wanted)
 }
diff --git a/pkg/component/cluster_test.go b/pkg/component/cluster_test.go
index 509097bb72..5cb7955a60 100644
--- a/pkg/component/cluster_test.go
+++ b/pkg/component/cluster_test.go
@@ -70,7 +70,7 @@ func TestPeers(t *testing.T) {
 	}
 
 	var peer cluster.Peer
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(20 * time.Millisecond) // Wait for peers to join cluster.
 		peer, err = c.GetPeer(context.Background(), ttnpb.ClusterRole_NETWORK_SERVER, nil)
 		if err == nil {
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 4366547bbc..17c1bd6288 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -21,6 +21,7 @@ import (
 	"io"
 	"os"
 	"reflect"
+	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -249,13 +250,7 @@ func (m *Manager) Unmarshal(result any) error {
 }
 
 func (m *Manager) isDefault(path string) bool {
-	for _, def := range m.defaultPaths {
-		if def == path {
-			return true
-		}
-	}
-
-	return false
+	return slices.Contains(m.defaultPaths, path)
 }
 
 func (m *Manager) inCLIFlags(path string) bool {
@@ -264,12 +259,7 @@ func (m *Manager) inCLIFlags(path string) bool {
 		return false
 	}
 
-	for _, flag := range flags {
-		if path == flag {
-			return true
-		}
-	}
-	return false
+	return slices.Contains(flags, path)
 }
 
 // ReadInConfig will read in all defined config files (according to the config file flag set by WithConfigFileFlag).
@@ -326,7 +316,7 @@ type Stringer interface {
 	ConfigString() string
 }
 
-var configurableI = reflect.TypeOf((*Configurable)(nil)).Elem()
+var configurableI = reflect.TypeFor[Configurable]()
 
 func isConfigurableType(t reflect.Type) bool {
 	return t.Implements(configurableI) || reflect.PtrTo(t).Implements(configurableI)
@@ -336,7 +326,7 @@ func (m *Manager) setDefaults(prefix string, flags *pflag.FlagSet, config any) {
 	configValue := reflect.ValueOf(config)
 	configKind := configValue.Type().Kind()
 
-	if configKind == reflect.Interface || configKind == reflect.Ptr {
+	if configKind == reflect.Interface || configKind == reflect.Pointer {
 		configValue = configValue.Elem()
 		configKind = configValue.Type().Kind()
 	}
@@ -403,7 +393,7 @@ func (m *Manager) setDefaults(prefix string, flags *pflag.FlagSet, config any) {
 				n := val.Len()
 				defs := make([]string, 0, n)
 
-				for j := 0; j < n; j++ {
+				for j := range n {
 					c := val.Index(j).Interface()
 					str := fmt.Sprintf("%v", c)
 
diff --git a/pkg/config/hooks.go b/pkg/config/hooks.go
index 6f7ef414db..8ab2ba55a9 100644
--- a/pkg/config/hooks.go
+++ b/pkg/config/hooks.go
@@ -36,7 +36,7 @@ func stringToTimeHookFunc(layout string) mapstructure.DecodeHookFuncType {
 		if f.Kind() != reflect.String {
 			return data, nil
 		}
-		if t != reflect.TypeOf(time.Time{}) {
+		if t != reflect.TypeFor[time.Time]() {
 			return data, nil
 		}
 		return time.Parse(layout, data.(string))
@@ -172,7 +172,7 @@ func configurableInterfaceHook(f reflect.Type, t reflect.Type, data any) (any, e
 
 	str := data.(string)
 
-	if t.Kind() == reflect.Ptr {
+	if t.Kind() == reflect.Pointer {
 		rv := reflect.New(t.Elem())
 		if err := rv.Interface().(Configurable).UnmarshalConfigString(str); err != nil {
 			return nil, err
@@ -198,7 +198,7 @@ func configurableInterfaceSliceHook(f reflect.Type, t reflect.Type, data any) (a
 	res := reflect.MakeSlice(t, len(strs), len(strs))
 
 	et := t.Elem()
-	if et.Kind() == reflect.Ptr {
+	if et.Kind() == reflect.Pointer {
 		for i, str := range strs {
 			rv := reflect.New(et.Elem())
 			if err := rv.Interface().(Configurable).UnmarshalConfigString(str); err != nil {
@@ -255,7 +255,7 @@ func stringToByteArrayHook(f reflect.Type, t reflect.Type, data any) (any, error
 
 func stringToTimeDurationPointerHook(f reflect.Type, t reflect.Type, data any) (any, error) {
 	d := time.Duration(0)
-	if f.Kind() != reflect.String || t != reflect.TypeOf(&d) {
+	if f.Kind() != reflect.String || t != reflect.TypeFor[*time.Duration]() {
 		return data, nil
 	}
 	s := data.(string)
@@ -271,7 +271,7 @@ func stringToTimeDurationPointerHook(f reflect.Type, t reflect.Type, data any) (
 
 func stringToRxDelayPointerHook(f reflect.Type, t reflect.Type, data any) (any, error) {
 	var enum ttnpb.RxDelay
-	if f.Kind() != reflect.String || t != reflect.TypeOf(&enum) {
+	if f.Kind() != reflect.String || t != reflect.TypeFor[*ttnpb.RxDelay]() {
 		return data, nil
 	}
 	s := data.(string)
@@ -290,7 +290,7 @@ func stringToRxDelayPointerHook(f reflect.Type, t reflect.Type, data any) (any,
 
 func stringToEUI64PointerHook(f reflect.Type, t reflect.Type, data any) (any, error) {
 	var eui types.EUI64
-	if f.Kind() != reflect.String || t != reflect.TypeOf(&eui) {
+	if f.Kind() != reflect.String || t != reflect.TypeFor[*types.EUI64]() {
 		return data, nil
 	}
 	s := data.(string)
@@ -305,7 +305,7 @@ func stringToEUI64PointerHook(f reflect.Type, t reflect.Type, data any) (any, er
 
 func stringToADRAckDelayExponentPointerHook(f reflect.Type, t reflect.Type, data any) (any, error) {
 	var enum ttnpb.ADRAckDelayExponent
-	if f.Kind() != reflect.String || t != reflect.TypeOf(&enum) {
+	if f.Kind() != reflect.String || t != reflect.TypeFor[*ttnpb.ADRAckDelayExponent]() {
 		return data, nil
 	}
 	s := data.(string)
@@ -324,7 +324,7 @@ func stringToADRAckDelayExponentPointerHook(f reflect.Type, t reflect.Type, data
 
 func stringToADRAckLimitExponentPointerHook(f reflect.Type, t reflect.Type, data any) (any, error) {
 	var enum ttnpb.ADRAckLimitExponent
-	if f.Kind() != reflect.String || t != reflect.TypeOf(&enum) {
+	if f.Kind() != reflect.String || t != reflect.TypeFor[*ttnpb.ADRAckLimitExponent]() {
 		return data, nil
 	}
 	s := data.(string)
@@ -343,7 +343,7 @@ func stringToADRAckLimitExponentPointerHook(f reflect.Type, t reflect.Type, data
 
 func stringToAggregatedDutyCyclePointerHook(f reflect.Type, t reflect.Type, data any) (any, error) {
 	var enum ttnpb.AggregatedDutyCycle
-	if f.Kind() != reflect.String || t != reflect.TypeOf(&enum) {
+	if f.Kind() != reflect.String || t != reflect.TypeFor[*ttnpb.AggregatedDutyCycle]() {
 		return data, nil
 	}
 	s := data.(string)
diff --git a/pkg/console/internal/events/middleware/auth.go b/pkg/console/internal/events/middleware/auth.go
index 6f7f18409e..b47daa9d4a 100644
--- a/pkg/console/internal/events/middleware/auth.go
+++ b/pkg/console/internal/events/middleware/auth.go
@@ -33,8 +33,8 @@ var (
 func headerTokens(h http.Header, key string) []string {
 	var tokens []string
 	for _, value := range h[key] {
-		value := strings.Split(strings.TrimSpace(value), ",")
-		for _, token := range value {
+		value := strings.SplitSeq(strings.TrimSpace(value), ",")
+		for token := range value {
 			token := strings.TrimSpace(token)
 			tokens = append(tokens, token)
 		}
diff --git a/pkg/console/internal/events/protocol/protocol_test.go b/pkg/console/internal/events/protocol/protocol_test.go
index bec85bc950..a65edc8d75 100644
--- a/pkg/console/internal/events/protocol/protocol_test.go
+++ b/pkg/console/internal/events/protocol/protocol_test.go
@@ -173,10 +173,10 @@ func TestMarshal(t *testing.T) {
 		Error: errStatus,
 	})
 	if a.So(err, should.BeNil) {
-		a.So(b, should.Resemble, []byte(fmt.Sprintf(`{"type":"error","id":66,"error":%v}`, string(errJSON)))) // nolint:lll
+		a.So(b, should.Resemble, fmt.Appendf(nil, `{"type":"error","id":66,"error":%v}`, string(errJSON))) // nolint:lll
 	}
 	var errResp protocol.ErrorResponse
-	err = json.Unmarshal([]byte(fmt.Sprintf(`{"type":"error","id":66,"error":%v}`, string(errJSON))), &errResp) // nolint:lll
+	err = json.Unmarshal(fmt.Appendf(nil, `{"type":"error","id":66,"error":%v}`, string(errJSON)), &errResp) // nolint:lll
 	if a.So(err, should.BeNil) {
 		a.So(errResp, should.Resemble, protocol.ErrorResponse{
 			ID:    0x42,
diff --git a/pkg/crypto/crypto.go b/pkg/crypto/crypto.go
index 2daf95de78..b2265f4878 100644
--- a/pkg/crypto/crypto.go
+++ b/pkg/crypto/crypto.go
@@ -18,7 +18,7 @@ package crypto
 func reverse(in []byte) []byte {
 	l := len(in)
 	out := make([]byte, l)
-	for i := 0; i < l; i++ {
+	for i := range l {
 		out[l-i-1] = in[i]
 	}
 	return out
diff --git a/pkg/crypto/data_messages.go b/pkg/crypto/data_messages.go
index 7231012fcd..19f917367e 100644
--- a/pkg/crypto/data_messages.go
+++ b/pkg/crypto/data_messages.go
@@ -75,7 +75,7 @@ func encryptMessage(key types.AES128Key, dir uint8, addr types.DevAddr, fCnt uin
 		copy(b[:], payload[i*aes.BlockSize:])
 		a[15] = i + 1
 		cipher.Encrypt(s[:], a[:])
-		for j := 0; j < aes.BlockSize; j++ {
+		for j := range aes.BlockSize {
 			b[j] = b[j] ^ s[j]
 		}
 		encrypted = append(encrypted, b[:]...)
diff --git a/pkg/crypto/keywrap.go b/pkg/crypto/keywrap.go
index b8d67baa3f..718cda66b2 100644
--- a/pkg/crypto/keywrap.go
+++ b/pkg/crypto/keywrap.go
@@ -63,7 +63,7 @@ func WrapKey(plaintext, kek []byte) ([]byte, error) {
 
 	// Fill R blocks
 	r := make([][8]byte, n)
-	for i := 0; i < n; i++ {
+	for i := range n {
 		copy(r[i][:], plaintext[i*8:(i+1)*8])
 	}
 
@@ -80,7 +80,7 @@ func WrapKey(plaintext, kek []byte) ([]byte, error) {
 	// Build the result
 	ciphertext := make([]byte, 0, 8*(n+1))
 	ciphertext = append(ciphertext, a[:]...)
-	for i := 0; i < n; i++ {
+	for i := range n {
 		ciphertext = append(ciphertext, r[i][:]...)
 	}
 
@@ -112,7 +112,7 @@ func UnwrapKey(ciphertext, kek []byte) ([]byte, error) {
 
 	// Fill R blocks
 	r := make([][8]byte, n)
-	for i := 0; i < n; i++ {
+	for i := range n {
 		copy(r[i][:], ciphertext[(i+1)*8:(i+2)*8])
 	}
 
@@ -133,7 +133,7 @@ func UnwrapKey(ciphertext, kek []byte) ([]byte, error) {
 
 	// Build the result
 	plaintext := make([]byte, 0, 8*n)
-	for i := 0; i < n; i++ {
+	for i := range n {
 		plaintext = append(plaintext, r[i][:]...)
 	}
 
diff --git a/pkg/deviceclaimingserver/enddevices/ttjsv2/ttjs.go b/pkg/deviceclaimingserver/enddevices/ttjsv2/ttjs.go
index ff0330e016..2fb569c488 100644
--- a/pkg/deviceclaimingserver/enddevices/ttjsv2/ttjs.go
+++ b/pkg/deviceclaimingserver/enddevices/ttjsv2/ttjs.go
@@ -22,6 +22,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"slices"
 
 	"go.thethings.network/lorawan-stack/v3/pkg/config/tlsconfig"
 	"go.thethings.network/lorawan-stack/v3/pkg/crypto"
@@ -82,12 +83,7 @@ func NewClient(c Component, fetcher fetch.Interface, conf Config) *TTJS {
 
 // SupportsJoinEUI implements EndDeviceClaimer.
 func (c *TTJS) SupportsJoinEUI(eui types.EUI64) bool {
-	for _, prefix := range c.config.JoinEUIPrefixes {
-		if eui.HasPrefix(prefix) {
-			return true
-		}
-	}
-	return false
+	return slices.ContainsFunc(c.config.JoinEUIPrefixes, eui.HasPrefix)
 }
 
 func (c *TTJS) httpClient(ctx context.Context) (*http.Client, error) {
diff --git a/pkg/deviceclaimingserver/grpc_end_devices_test.go b/pkg/deviceclaimingserver/grpc_end_devices_test.go
index 9a972e06af..0a5c9728aa 100644
--- a/pkg/deviceclaimingserver/grpc_end_devices_test.go
+++ b/pkg/deviceclaimingserver/grpc_end_devices_test.go
@@ -56,7 +56,7 @@ var (
 )
 
 func mustHavePeer(ctx context.Context, c *component.Component, role ttnpb.ClusterRole) {
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(20 * time.Millisecond)
 		if _, err := c.GetPeer(ctx, role, nil); err == nil {
 			return
diff --git a/pkg/devicerepository/devicerepository_test.go b/pkg/devicerepository/devicerepository_test.go
index 3b95d38532..09134aaab3 100644
--- a/pkg/devicerepository/devicerepository_test.go
+++ b/pkg/devicerepository/devicerepository_test.go
@@ -28,7 +28,7 @@ import (
 )
 
 func mustHavePeer(ctx context.Context, c *component.Component, role ttnpb.ClusterRole) {
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(20 * time.Millisecond)
 		if _, err := c.GetPeer(ctx, role, nil); err == nil {
 			return
diff --git a/pkg/devicerepository/store/remote/repository_test.go b/pkg/devicerepository/store/remote/repository_test.go
index 61ee3b918a..a9f30a1137 100644
--- a/pkg/devicerepository/store/remote/repository_test.go
+++ b/pkg/devicerepository/store/remote/repository_test.go
@@ -13,7 +13,6 @@
 // limitations under the License.
 
 //go:build slowtests
-// +build slowtests
 
 package remote_test
 
diff --git a/pkg/devicetemplateconverter/util_test.go b/pkg/devicetemplateconverter/util_test.go
index 85de854871..a73b57215b 100644
--- a/pkg/devicetemplateconverter/util_test.go
+++ b/pkg/devicetemplateconverter/util_test.go
@@ -24,7 +24,7 @@ import (
 )
 
 func mustHavePeer(ctx context.Context, c *component.Component, role ttnpb.ClusterRole) {
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(20 * time.Millisecond)
 		if _, err := c.GetPeer(ctx, role, nil); err == nil {
 			return
diff --git a/pkg/encoding/lorawan/mac.go b/pkg/encoding/lorawan/mac.go
index 6338a32470..2d4ef3dce6 100644
--- a/pkg/encoding/lorawan/mac.go
+++ b/pkg/encoding/lorawan/mac.go
@@ -196,7 +196,7 @@ var DefaultMACCommands = MACCommandSpec{
 		},
 		UnmarshalDownlink: newMACUnmarshaler(ttnpb.MACCommandIdentifier_CID_LINK_ADR, "LinkADRReq", 4, func(phy band.Band, b []byte, cmd *ttnpb.MACCommand) error {
 			var chMask [16]bool
-			for i := 0; i < 16; i++ {
+			for i := range 16 {
 				chMask[i] = (b[1+i/8]>>(i%8))&1 == 1
 			}
 			cmd.Payload = &ttnpb.MACCommand_LinkAdrReq{
diff --git a/pkg/errors/conversion_other.go b/pkg/errors/conversion_other.go
index 83fd0ca468..33457a57bb 100644
--- a/pkg/errors/conversion_other.go
+++ b/pkg/errors/conversion_other.go
@@ -13,7 +13,6 @@
 // limitations under the License.
 
 //go:build !linux && !darwin
-// +build !linux,!darwin
 
 package errors
 
diff --git a/pkg/errors/conversion_unix.go b/pkg/errors/conversion_unix.go
index f1d88ded88..db54c21b0e 100644
--- a/pkg/errors/conversion_unix.go
+++ b/pkg/errors/conversion_unix.go
@@ -13,7 +13,6 @@
 // limitations under the License.
 
 //go:build linux || darwin
-// +build linux darwin
 
 package errors
 
diff --git a/pkg/errors/errors.go b/pkg/errors/errors.go
index 94389c0cd1..34097abc3d 100644
--- a/pkg/errors/errors.go
+++ b/pkg/errors/errors.go
@@ -19,6 +19,7 @@ package errors
 import (
 	"encoding/hex"
 	"fmt"
+	"maps"
 	"sync/atomic"
 
 	"github.com/google/uuid"
@@ -73,9 +74,7 @@ func (e *Error) Fields() map[string]any {
 		res[pref] = cause.Error()
 		pref += "_cause"
 	}
-	for k, v := range Attributes(Stack(e)...) {
-		res[k] = v
-	}
+	maps.Copy(res, Attributes(Stack(e)...))
 	return res
 }
 
diff --git a/pkg/errors/stack_trace.go b/pkg/errors/stack_trace.go
index e73c5bc83f..bd52f5b9d8 100644
--- a/pkg/errors/stack_trace.go
+++ b/pkg/errors/stack_trace.go
@@ -37,7 +37,7 @@ func (s *stack) StackTrace() errors.StackTrace {
 		return nil
 	}
 	f := make([]errors.Frame, len(*s))
-	for i := 0; i < len(f); i++ {
+	for i := range f {
 		f[i] = errors.Frame((*s)[i])
 	}
 	return f
diff --git a/pkg/events/basic/subscription.go b/pkg/events/basic/subscription.go
index e7220d8d2b..12295bc688 100644
--- a/pkg/events/basic/subscription.go
+++ b/pkg/events/basic/subscription.go
@@ -16,6 +16,7 @@ package basic
 
 import (
 	"context"
+	"slices"
 
 	"go.thethings.network/lorawan-stack/v3/pkg/events"
 	"go.thethings.network/lorawan-stack/v3/pkg/ttnpb"
@@ -47,12 +48,7 @@ func (s *Subscription) matchName(evt events.Event) bool {
 	if len(s.names) == 0 {
 		return true
 	}
-	for _, subName := range s.names {
-		if subName == evt.Name() {
-			return true
-		}
-	}
-	return false
+	return slices.Contains(s.names, evt.Name())
 }
 
 func (s *Subscription) matchIdentifiers(evt events.Event) bool {
diff --git a/pkg/events/batch/batch_test.go b/pkg/events/batch/batch_test.go
index e4972dc742..344388e224 100644
--- a/pkg/events/batch/batch_test.go
+++ b/pkg/events/batch/batch_test.go
@@ -97,7 +97,7 @@ func TestBatchPublisher(t *testing.T) {
 
 	// Expect two flushes due to an overflow.
 	batcher.Publish(ev0, ev1, ev2, ev3, ev4)
-	for i := 0; i < 2; i++ {
+	for range 2 {
 		had1, had4 := false, false
 		select {
 		case <-ctx.Done():
diff --git a/pkg/events/grpc/grpc.go b/pkg/events/grpc/grpc.go
index be250151c4..243a5f71b5 100644
--- a/pkg/events/grpc/grpc.go
+++ b/pkg/events/grpc/grpc.go
@@ -81,10 +81,7 @@ func (srv *EventsServer) Stream(req *ttnpb.StreamEventsRequest, stream ttnpb.Eve
 		return err
 	}
 
-	chSize := int(req.Tail)
-	if chSize < 8 {
-		chSize = 8
-	}
+	chSize := max(int(req.Tail), 8)
 	if chSize > 1024 {
 		chSize = 1024
 	}
diff --git a/pkg/events/mux/matchers.go b/pkg/events/mux/matchers.go
index 6390a4df8e..7b94c8e83a 100644
--- a/pkg/events/mux/matchers.go
+++ b/pkg/events/mux/matchers.go
@@ -14,6 +14,8 @@
 
 package mux
 
+import "slices"
+
 import "go.thethings.network/lorawan-stack/v3/pkg/events"
 
 // Matcher matches event names.
@@ -43,12 +45,7 @@ var (
 // MatchNames is a matcher that matches specific event names.
 func MatchNames(names ...string) Matcher {
 	return MatcherFunc(func(name string) bool {
-		for _, n := range names {
-			if n == name {
-				return true
-			}
-		}
-		return false
+		return slices.Contains(names, name)
 	})
 }
 
diff --git a/pkg/events/mux/mux.go b/pkg/events/mux/mux.go
index 6cd838e4b8..eb6ea8ac82 100644
--- a/pkg/events/mux/mux.go
+++ b/pkg/events/mux/mux.go
@@ -97,7 +97,7 @@ nextStream:
 
 func (*multiplexer) subscriberType(sub events.Subscriber) string {
 	t := reflect.TypeOf(sub)
-	if t.Kind() == reflect.Ptr {
+	if t.Kind() == reflect.Pointer {
 		t = t.Elem()
 	}
 	return fmt.Sprintf("%s.%s", t.PkgPath(), t.Name())
diff --git a/pkg/events/redis/subscription.go b/pkg/events/redis/subscription.go
index ab99b0df2c..4492738dc6 100644
--- a/pkg/events/redis/subscription.go
+++ b/pkg/events/redis/subscription.go
@@ -15,6 +15,8 @@
 package redis
 
 import (
+	"slices"
+
 	"go.thethings.network/lorawan-stack/v3/pkg/events"
 	"go.thethings.network/lorawan-stack/v3/pkg/events/basic"
 )
@@ -26,10 +28,8 @@ type subscription struct {
 
 func (s *subscription) matchPattern(evt events.Event) bool {
 	if evt, ok := evt.(*patternEvent); ok {
-		for _, pattern := range s.patterns {
-			if pattern == evt.pattern {
-				return true
-			}
+		if slices.Contains(s.patterns, evt.pattern) {
+			return true
 		}
 	}
 	return false
diff --git a/pkg/experimental/registry.go b/pkg/experimental/registry.go
index f7a2156f58..65d2c92758 100644
--- a/pkg/experimental/registry.go
+++ b/pkg/experimental/registry.go
@@ -16,6 +16,7 @@ package experimental
 
 import (
 	"context"
+	"maps"
 	"sync"
 )
 
@@ -65,9 +66,7 @@ func (r *Registry) allFeatures() map[string]bool {
 	r.mu.RLock()
 	defer r.mu.RUnlock()
 	features := make(map[string]bool, len(r.features))
-	for k, v := range r.features {
-		features[k] = v
-	}
+	maps.Copy(features, r.features)
 	return features
 }
 
diff --git a/pkg/gatewayconfigurationserver/server_test.go b/pkg/gatewayconfigurationserver/server_test.go
index 38d21a60c9..33c50c8c1e 100644
--- a/pkg/gatewayconfigurationserver/server_test.go
+++ b/pkg/gatewayconfigurationserver/server_test.go
@@ -465,7 +465,7 @@ func newContextWithRightsFetcher(ctx context.Context) context.Context {
 }
 
 func mustHavePeer(ctx context.Context, c *component.Component, role ttnpb.ClusterRole) {
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(20 * time.Millisecond)
 		if _, err := c.GetPeer(ctx, role, nil); err == nil {
 			return
diff --git a/pkg/gatewayserver/gatewayserver.go b/pkg/gatewayserver/gatewayserver.go
index 55287d9a6b..69b7512025 100644
--- a/pkg/gatewayserver/gatewayserver.go
+++ b/pkg/gatewayserver/gatewayserver.go
@@ -25,6 +25,7 @@ import (
 	"math"
 	"net"
 	"net/http"
+	"slices"
 	"strings"
 	"sync"
 	"time"
@@ -926,11 +927,8 @@ func (host *upstreamHost) handlePacket(ctx context.Context, item any) {
 		var pass bool
 		switch {
 		case ids.DevAddr != nil:
-			for _, prefix := range host.handler.DevAddrPrefixes() {
-				if types.MustDevAddr(ids.DevAddr).HasPrefix(prefix) {
-					pass = true
-					break
-				}
+			if slices.ContainsFunc(host.handler.DevAddrPrefixes(), types.MustDevAddr(ids.DevAddr).HasPrefix) {
+				pass = true
 			}
 		default:
 			pass = true
diff --git a/pkg/gatewayserver/gatewayserver_test.go b/pkg/gatewayserver/gatewayserver_test.go
index e78d978a3c..d3adc49ee2 100644
--- a/pkg/gatewayserver/gatewayserver_test.go
+++ b/pkg/gatewayserver/gatewayserver_test.go
@@ -43,7 +43,7 @@ import (
 
 func mustHavePeer(ctx context.Context, t *testing.T, c *component.Component, role ttnpb.ClusterRole) {
 	t.Helper()
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(20 * time.Millisecond)
 		if _, err := c.GetPeer(ctx, role, nil); err == nil {
 			return
diff --git a/pkg/gatewayserver/io/downlink_token_test.go b/pkg/gatewayserver/io/downlink_token_test.go
index 080e2159c7..261658012b 100644
--- a/pkg/gatewayserver/io/downlink_token_test.go
+++ b/pkg/gatewayserver/io/downlink_token_test.go
@@ -30,7 +30,7 @@ func TestDownlinkTokens(t *testing.T) {
 
 	msgs := make([]*ttnpb.DownlinkMessage, 0, downlinkTokenItems*2)
 	all := []uint16{}
-	for i := 0; i < downlinkTokenItems*2; i++ {
+	for i := range downlinkTokenItems * 2 {
 
 		msgs = append(msgs, &ttnpb.DownlinkMessage{
 			RawPayload:     []byte{byte(i)},
diff --git a/pkg/gatewayserver/io/grpc/grpc_util_test.go b/pkg/gatewayserver/io/grpc/grpc_util_test.go
index eb61fa1169..41bef29329 100644
--- a/pkg/gatewayserver/io/grpc/grpc_util_test.go
+++ b/pkg/gatewayserver/io/grpc/grpc_util_test.go
@@ -43,7 +43,7 @@ func (m *mockRegisterer) RegisterHandlers(s *runtime.ServeMux, conn *grpc.Client
 }
 
 func mustHavePeer(ctx context.Context, c *component.Component, role ttnpb.ClusterRole) {
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(20 * time.Millisecond)
 		if _, err := c.GetPeer(ctx, role, nil); err == nil {
 			return
diff --git a/pkg/gatewayserver/io/iotest/util.go b/pkg/gatewayserver/io/iotest/util.go
index ca1118d021..dc6496fb2a 100644
--- a/pkg/gatewayserver/io/iotest/util.go
+++ b/pkg/gatewayserver/io/iotest/util.go
@@ -31,7 +31,7 @@ import (
 
 func mustHavePeer(ctx context.Context, t *testing.T, c *component.Component, role ttnpb.ClusterRole) {
 	t.Helper()
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(20 * time.Millisecond)
 		if _, err := c.GetPeer(ctx, role, nil); err == nil {
 			return
diff --git a/pkg/gatewayserver/io/mqtt/mqtt_util_test.go b/pkg/gatewayserver/io/mqtt/mqtt_util_test.go
index d574f0cd4d..bb4756a64e 100644
--- a/pkg/gatewayserver/io/mqtt/mqtt_util_test.go
+++ b/pkg/gatewayserver/io/mqtt/mqtt_util_test.go
@@ -25,7 +25,7 @@ import (
 var testRights = []ttnpb.Right{ttnpb.Right_RIGHT_GATEWAY_INFO, ttnpb.Right_RIGHT_GATEWAY_LINK}
 
 func mustHavePeer(ctx context.Context, c *component.Component, role ttnpb.ClusterRole) {
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(20 * time.Millisecond)
 		if _, err := c.GetPeer(ctx, role, nil); err == nil {
 			return
diff --git a/pkg/gatewayserver/io/semtechws/id6/id6.go b/pkg/gatewayserver/io/semtechws/id6/id6.go
index 8ff20ccbe8..b750aded34 100644
--- a/pkg/gatewayserver/io/semtechws/id6/id6.go
+++ b/pkg/gatewayserver/io/semtechws/id6/id6.go
@@ -33,24 +33,24 @@ type EUI struct {
 
 // MarshalJSON implements json.Marshaler.
 func (eui EUI) MarshalJSON() ([]byte, error) {
-	var res string
+	var res strings.Builder
 	if eui.Prefix != "" {
-		res += strings.ToLower(eui.Prefix) + "-"
+		res.WriteString(strings.ToLower(eui.Prefix) + "-")
 	}
 	if eui.EUI64[0] != 0 || eui.EUI64[1] != 0 {
-		res += fmt.Sprintf("%x:", uint16(eui.EUI64[0])<<8|uint16(eui.EUI64[1]))
+		res.WriteString(fmt.Sprintf("%x:", uint16(eui.EUI64[0])<<8|uint16(eui.EUI64[1])))
 	}
 	for _, g := range []uint16{
 		uint16(eui.EUI64[2])<<8 | uint16(eui.EUI64[3]),
 		uint16(eui.EUI64[4])<<8 | uint16(eui.EUI64[5]),
 	} {
 		if g != 0 {
-			res += fmt.Sprintf("%x", g)
+			res.WriteString(fmt.Sprintf("%x", g))
 		}
-		res += ":"
+		res.WriteString(":")
 	}
-	res += fmt.Sprintf("%x", uint16(eui.EUI64[6])<<8|uint16(eui.EUI64[7]))
-	return []byte(`"` + res + `"`), nil
+	res.WriteString(fmt.Sprintf("%x", uint16(eui.EUI64[6])<<8|uint16(eui.EUI64[7])))
+	return []byte(`"` + res.String() + `"`), nil
 }
 
 var (
diff --git a/pkg/gatewayserver/io/semtechws/lbslns/messages.go b/pkg/gatewayserver/io/semtechws/lbslns/messages.go
index 91750a912b..2edd8a0f3d 100644
--- a/pkg/gatewayserver/io/semtechws/lbslns/messages.go
+++ b/pkg/gatewayserver/io/semtechws/lbslns/messages.go
@@ -52,7 +52,7 @@ type DiscoverQuery struct {
 // This message is sent by the Gateway Server.
 type DiscoverResponse struct {
 	EUI   id6.EUI `json:"router"`
-	Muxs  id6.EUI `json:"muxs,omitempty"`
+	Muxs  id6.EUI `json:"muxs"`
 	URI   string  `json:"uri,omitempty"`
 	Error string  `json:"error,omitempty"`
 }
diff --git a/pkg/gatewayserver/io/semtechws/ws_test.go b/pkg/gatewayserver/io/semtechws/ws_test.go
index f416163080..0e55e907e8 100644
--- a/pkg/gatewayserver/io/semtechws/ws_test.go
+++ b/pkg/gatewayserver/io/semtechws/ws_test.go
@@ -1801,7 +1801,7 @@ func TestRateLimit(t *testing.T) {
 		}
 		withServer(t, defaultConfig, conf, func(t *testing.T, _ *mockis.MockDefinition, serverAddress string) {
 			a := assertions.New(t)
-			for i := uint(0); i < maxRate; i++ {
+			for range maxRate {
 				conn, _, err := websocket.DefaultDialer.Dial(serverAddress+testTrafficEndPoint, nil)
 				if !a.So(err, should.BeNil) {
 					t.Fatalf("Connection failed: %v", err)
@@ -1809,7 +1809,7 @@ func TestRateLimit(t *testing.T) {
 				conn.Close()
 			}
 
-			for i := 0; i < 3; i++ {
+			for range 3 {
 				_, resp, err := websocket.DefaultDialer.Dial(serverAddress+testTrafficEndPoint, nil)
 				a.So(err, should.NotBeNil)
 				if !a.So(errors.IsResourceExhausted(errors.FromHTTPStatusCode(resp.StatusCode)), should.BeTrue) {
diff --git a/pkg/gatewayserver/io/semtechws/ws_util_test.go b/pkg/gatewayserver/io/semtechws/ws_util_test.go
index fed857eae0..bb2560cd9e 100644
--- a/pkg/gatewayserver/io/semtechws/ws_util_test.go
+++ b/pkg/gatewayserver/io/semtechws/ws_util_test.go
@@ -74,7 +74,7 @@ func (c *mockClock) GetXTimeForTimestamp(ts uint32) int64 {
 var testRights = []ttnpb.Right{ttnpb.Right_RIGHT_GATEWAY_INFO, ttnpb.Right_RIGHT_GATEWAY_LINK}
 
 func mustHavePeer(ctx context.Context, c *component.Component, role ttnpb.ClusterRole) {
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(20 * time.Millisecond)
 		if _, err := c.GetPeer(ctx, role, nil); err == nil {
 			return
diff --git a/pkg/gatewayserver/io/udp/firewall_ratelimit_test.go b/pkg/gatewayserver/io/udp/firewall_ratelimit_test.go
index 23984d1df9..637acc2c09 100644
--- a/pkg/gatewayserver/io/udp/firewall_ratelimit_test.go
+++ b/pkg/gatewayserver/io/udp/firewall_ratelimit_test.go
@@ -56,7 +56,7 @@ func TestRateLimitingFirewall(t *testing.T) {
 					f = NewRateLimitingFirewall(f, 3, time.Hour)
 				}
 
-				for i := 0; i < 4; i++ {
+				for i := range 4 {
 					err := f.Filter(encoding.Packet{
 						GatewayEUI: eui1,
 						GatewayAddr: &net.UDPAddr{
diff --git a/pkg/gatewayserver/io/udp/timestamps_test.go b/pkg/gatewayserver/io/udp/timestamps_test.go
index a0f17fb602..54083519f4 100644
--- a/pkg/gatewayserver/io/udp/timestamps_test.go
+++ b/pkg/gatewayserver/io/udp/timestamps_test.go
@@ -29,7 +29,7 @@ func TestTimestamps(t *testing.T) {
 
 	ret := timestamps.Append(time.Now())
 	a.So(ret, should.BeZeroValue)
-	for i := 0; i < 3; i++ {
+	for range 3 {
 		ret := timestamps.Append(time.Now().Add(time.Hour))
 		a.So(ret, should.BeZeroValue)
 	}
diff --git a/pkg/gatewayserver/is.go b/pkg/gatewayserver/is.go
index 0b5c1ba8fa..d50460a9fd 100644
--- a/pkg/gatewayserver/is.go
+++ b/pkg/gatewayserver/is.go
@@ -16,6 +16,7 @@ package gatewayserver
 
 import (
 	"context"
+	"maps"
 
 	"go.thethings.network/lorawan-stack/v3/pkg/auth/rights"
 	"go.thethings.network/lorawan-stack/v3/pkg/cluster"
@@ -155,12 +156,8 @@ func (is IS) UpdateAttributes(ctx context.Context, ids *ttnpb.GatewayIdentifiers
 
 	// Take the union of keys with new values overwriting existing entries.
 	merged := make(map[string]string)
-	for k, v := range current {
-		merged[k] = v
-	}
-	for k, v := range new {
-		merged[k] = v
-	}
+	maps.Copy(merged, current)
+	maps.Copy(merged, new)
 
 	req := &ttnpb.UpdateGatewayRequest{
 		Gateway: &ttnpb.Gateway{
diff --git a/pkg/gatewayserver/scheduling/clock_test.go b/pkg/gatewayserver/scheduling/clock_test.go
index 96422237eb..2e1c77a65a 100644
--- a/pkg/gatewayserver/scheduling/clock_test.go
+++ b/pkg/gatewayserver/scheduling/clock_test.go
@@ -61,7 +61,7 @@ func TestRolloverClock(t *testing.T) {
 		t.Run(strconv.Itoa(i), func(t *testing.T) {
 			serverTime := time.Unix(0, 0).Add(time.Duration(stc.Absolute))
 			// Run twice; once synchronizing with rollover detection, and once synchronizing with the known concentrator time.
-			for i := 0; i < 2; i++ {
+			for i := range 2 {
 				t.Run([]string{"DetectRollover", "ResetAbsolute"}[i], func(t *testing.T) {
 					if i == 0 {
 						clock.Sync(stc.Relative, serverTime)
diff --git a/pkg/gatewayserver/scheduling/emission.go b/pkg/gatewayserver/scheduling/emission.go
index 7e5c0f0a54..c7c3f634bc 100644
--- a/pkg/gatewayserver/scheduling/emission.go
+++ b/pkg/gatewayserver/scheduling/emission.go
@@ -45,10 +45,7 @@ func (em Emission) Duration() time.Duration { return em.d }
 
 // OffAir returns the time-off-air of the emission.
 func (em Emission) OffAir(toa frequencyplans.TimeOffAir) time.Duration {
-	d := time.Duration(float32(em.d) * toa.Fraction)
-	if d < toa.Duration {
-		d = toa.Duration
-	}
+	d := max(time.Duration(float32(em.d)*toa.Fraction), toa.Duration)
 	return d
 }
 
diff --git a/pkg/gatewayserver/scheduling/sub_band_test.go b/pkg/gatewayserver/scheduling/sub_band_test.go
index 6a7860cab4..d4861b14f2 100644
--- a/pkg/gatewayserver/scheduling/sub_band_test.go
+++ b/pkg/gatewayserver/scheduling/sub_band_test.go
@@ -256,7 +256,7 @@ func TestBlockingScheduling(t *testing.T) {
 
 	// The previous emission keeps the [0, 5s) interval blocked.
 	{
-		for i := 0; i < 5; i++ {
+		for i := range 5 {
 			em := scheduling.NewEmission(scheduling.ConcentratorTime(i*int(time.Second)), 500*time.Millisecond)
 			err := sb.Schedule(em, ttnpb.TxSchedulePriority_HIGHEST)
 			a.So(err, should.NotBeNil)
@@ -274,7 +274,7 @@ func TestBlockingScheduling(t *testing.T) {
 
 	// The previous emission keeps the [5s, 7s) interval blocked.
 	{
-		for i := 0; i < 2; i++ {
+		for i := range 2 {
 			t := 5*time.Second + time.Duration(i)*time.Second
 			em := scheduling.NewEmission(scheduling.ConcentratorTime(t), 200*time.Millisecond)
 			err := sb.Schedule(em, ttnpb.TxSchedulePriority_HIGHEST)
diff --git a/pkg/gatewayserver/upstream/ns/ns_util_test.go b/pkg/gatewayserver/upstream/ns/ns_util_test.go
index 3624c24f1d..47b6f411bb 100644
--- a/pkg/gatewayserver/upstream/ns/ns_util_test.go
+++ b/pkg/gatewayserver/upstream/ns/ns_util_test.go
@@ -23,7 +23,7 @@ import (
 )
 
 func mustHavePeer(ctx context.Context, c *component.Component, role ttnpb.ClusterRole) {
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(20 * time.Millisecond)
 		if _, err := c.GetPeer(ctx, role, nil); err == nil {
 			return
diff --git a/pkg/goproto/fields.go b/pkg/goproto/fields.go
index 449eb8d41b..00ca3235ea 100644
--- a/pkg/goproto/fields.go
+++ b/pkg/goproto/fields.go
@@ -57,7 +57,7 @@ func goFieldsFromProtoMasks(v reflect.Value) map[string]string {
 	}
 
 	fields := make(map[string]string)
-	for v.Kind() == reflect.Ptr {
+	for v.Kind() == reflect.Pointer {
 		v = v.Elem()
 	}
 	if v.Kind() != reflect.Struct {
diff --git a/pkg/goproto/struct.go b/pkg/goproto/struct.go
index 8decdfdce3..e5fb8e2d66 100644
--- a/pkg/goproto/struct.go
+++ b/pkg/goproto/struct.go
@@ -159,7 +159,7 @@ func List(s []any, opts ...Option) (*structpb.ListValue, error) {
 
 func valueFromReflect(rv reflect.Value, opts ...Option) (*structpb.Value, error) {
 	switch k := rv.Kind(); k {
-	case reflect.Ptr:
+	case reflect.Pointer:
 		if rv.IsNil() {
 			return &structpb.Value{Kind: &structpb.Value_NullValue{}}, nil
 		}
@@ -209,7 +209,7 @@ func valueFromReflect(rv reflect.Value, opts ...Option) (*structpb.Value, error)
 		}
 		n := rv.NumField()
 		fields := make(map[string]*structpb.Value, n)
-		for i := 0; i < n; i++ {
+		for i := range n {
 			f := rv.Field(i)
 			ft := f.Type()
 			if f.Type().PkgPath() != "" {
diff --git a/pkg/healthcheck/healthgo_test.go b/pkg/healthcheck/healthgo_test.go
index d7bc2c161c..1f7c0031e0 100644
--- a/pkg/healthcheck/healthgo_test.go
+++ b/pkg/healthcheck/healthgo_test.go
@@ -54,9 +54,9 @@ func GetDSN(defaultDB string) *url.URL {
 	}
 	if dbAuth := os.Getenv("SQL_DB_AUTH"); dbAuth != "" {
 		var username, password string
-		idx := strings.Index(dbAuth, ":")
-		if idx != -1 {
-			username, password = dbAuth[:idx], dbAuth[idx+1:]
+		before, after, ok := strings.Cut(dbAuth, ":")
+		if ok {
+			username, password = before, after
 		} else {
 			username = dbAuth
 		}
diff --git a/pkg/i18n/i18n.go b/pkg/i18n/i18n.go
index 34460cc6f3..9dd20e0320 100644
--- a/pkg/i18n/i18n.go
+++ b/pkg/i18n/i18n.go
@@ -40,7 +40,7 @@ type MessageDescriptor struct {
 	Description        struct {
 		Package string `json:"package,omitempty"`
 		File    string `json:"file,omitempty"`
-	} `json:"description,omitempty"`
+	} `json:"description"`
 	id      string
 	touched bool
 	updated bool
diff --git a/pkg/identityserver/application_registry_test.go b/pkg/identityserver/application_registry_test.go
index bf32a907fa..d0bf70a1e3 100644
--- a/pkg/identityserver/application_registry_test.go
+++ b/pkg/identityserver/application_registry_test.go
@@ -146,12 +146,12 @@ func TestApplicationsCRUD(t *testing.T) {
 	adminCreds := rpcCreds(adminKey)
 
 	usr1 := p.NewUser()
-	for i := 0; i < 5; i++ {
+	for range 5 {
 		p.NewApplication(usr1.GetOrganizationOrUserIdentifiers())
 	}
 
 	usr2 := p.NewUser()
-	for i := 0; i < 5; i++ {
+	for range 5 {
 		p.NewApplication(usr2.GetOrganizationOrUserIdentifiers())
 	}
 
@@ -349,7 +349,7 @@ func TestApplicationsPagination(t *testing.T) {
 	p := &storetest.Population{}
 
 	usr1 := p.NewUser()
-	for i := 0; i < 3; i++ {
+	for range 3 {
 		p.NewApplication(usr1.GetOrganizationOrUserIdentifiers())
 	}
 
diff --git a/pkg/identityserver/bunstore/store.go b/pkg/identityserver/bunstore/store.go
index 32c59202be..1be74863d6 100644
--- a/pkg/identityserver/bunstore/store.go
+++ b/pkg/identityserver/bunstore/store.go
@@ -181,7 +181,7 @@ const (
 // Transact implements the store.TransactionalStore interface.
 func (s *Store) Transact(ctx context.Context, fc func(context.Context, store.Store) error) (err error) {
 	delayOnUnavailable := initialDelayOnUnavailable
-	for i := 0; i < maxAttempts; i++ {
+	for i := range maxAttempts {
 		err = s.baseStore.transact(ctx, func(ctx context.Context, idb bun.IDB) error {
 			baseStore := s.baseDB.baseStore()
 			baseStore.DB = idb
diff --git a/pkg/identityserver/client_registry_test.go b/pkg/identityserver/client_registry_test.go
index 95121286ae..c6531bc1bf 100644
--- a/pkg/identityserver/client_registry_test.go
+++ b/pkg/identityserver/client_registry_test.go
@@ -131,12 +131,12 @@ func TestClientsCRUD(t *testing.T) {
 	adminCreds := rpcCreds(adminKey)
 
 	usr1 := p.NewUser()
-	for i := 0; i < 5; i++ {
+	for range 5 {
 		p.NewClient(usr1.GetOrganizationOrUserIdentifiers())
 	}
 
 	usr2 := p.NewUser()
-	for i := 0; i < 5; i++ {
+	for range 5 {
 		p.NewClient(usr2.GetOrganizationOrUserIdentifiers())
 	}
 
@@ -356,7 +356,7 @@ func TestClientsPagination(t *testing.T) {
 	p := &storetest.Population{}
 
 	usr1 := p.NewUser()
-	for i := 0; i < 3; i++ {
+	for range 3 {
 		p.NewClient(usr1.GetOrganizationOrUserIdentifiers())
 	}
 
diff --git a/pkg/identityserver/end_device_registry_test.go b/pkg/identityserver/end_device_registry_test.go
index 77de955958..ec7d6f424a 100644
--- a/pkg/identityserver/end_device_registry_test.go
+++ b/pkg/identityserver/end_device_registry_test.go
@@ -142,7 +142,7 @@ func TestEndDevicesCRUD(t *testing.T) {
 
 	usr1 := p.NewUser()
 	app1 := p.NewApplication(usr1.GetOrganizationOrUserIdentifiers())
-	for i := 0; i < 5; i++ {
+	for range 5 {
 		p.NewEndDevice(app1.GetIds())
 	}
 
@@ -220,7 +220,7 @@ func TestEndDevicesPagination(t *testing.T) {
 
 	usr1 := p.NewUser()
 	app1 := p.NewApplication(usr1.GetOrganizationOrUserIdentifiers())
-	for i := 0; i < 3; i++ {
+	for range 3 {
 		p.NewEndDevice(app1.GetIds())
 	}
 
@@ -275,7 +275,7 @@ func TestEndDevicesBatchOperationsPermissions(t *testing.T) {
 	usr1 := p.NewUser()
 	app1 := p.NewApplication(usr1.GetOrganizationOrUserIdentifiers())
 	devIDs := make([]string, 0, noOfDevices)
-	for i := 0; i < noOfDevices; i++ {
+	for range noOfDevices {
 		dev := p.NewEndDevice(app1.GetIds())
 		dev.Attributes = map[string]string{
 			"foo": "bar",
@@ -349,7 +349,7 @@ func TestEndDevicesBatchOperations(t *testing.T) {
 	usr1 := p.NewUser()
 	app1 := p.NewApplication(usr1.GetOrganizationOrUserIdentifiers())
 	devIDs := make([]string, 0, noOfDevices)
-	for i := 0; i < noOfDevices; i++ {
+	for range noOfDevices {
 		dev := p.NewEndDevice(app1.GetIds())
 		dev.Attributes = map[string]string{
 			"foo": "bar",
@@ -453,7 +453,7 @@ func TestEndDevicesFilter(t *testing.T) {
 
 	usr1 := p.NewUser()
 	app1 := p.NewApplication(usr1.GetOrganizationOrUserIdentifiers())
-	for i := 0; i < 5; i++ {
+	for range 5 {
 		p.NewEndDevice(app1.GetIds())
 	}
 
diff --git a/pkg/identityserver/entity_access.go b/pkg/identityserver/entity_access.go
index 98f203926e..27f6d969ed 100644
--- a/pkg/identityserver/entity_access.go
+++ b/pkg/identityserver/entity_access.go
@@ -18,6 +18,7 @@ import (
 	"context"
 	"fmt"
 	"runtime/trace"
+	"slices"
 	"strings"
 	"time"
 
@@ -441,12 +442,7 @@ func (is *IdentityServer) RequireAdminForFieldUpdate(ctx context.Context, fields
 		return nil
 	}
 	isAdminField := func(field string) bool {
-		for _, adminField := range adminFields {
-			if field == adminField {
-				return true
-			}
-		}
-		return false
+		return slices.Contains(adminFields, field)
 	}
 	for _, field := range fields {
 		if isAdminField(field) {
diff --git a/pkg/identityserver/gateway_registry_test.go b/pkg/identityserver/gateway_registry_test.go
index 6b1b158951..f4905cba59 100644
--- a/pkg/identityserver/gateway_registry_test.go
+++ b/pkg/identityserver/gateway_registry_test.go
@@ -155,12 +155,12 @@ func TestGatewaysCRUD(t *testing.T) {
 	adminCreds := rpcCreds(adminKey)
 
 	usr1 := p.NewUser()
-	for i := 0; i < 5; i++ {
+	for range 5 {
 		p.NewGateway(usr1.GetOrganizationOrUserIdentifiers())
 	}
 
 	usr2 := p.NewUser()
-	for i := 0; i < 5; i++ {
+	for range 5 {
 		p.NewGateway(usr2.GetOrganizationOrUserIdentifiers())
 	}
 
@@ -376,7 +376,7 @@ func TestGatewaysPagination(t *testing.T) {
 	p := &storetest.Population{}
 
 	usr1 := p.NewUser()
-	for i := 0; i < 3; i++ {
+	for range 3 {
 		p.NewGateway(usr1.GetOrganizationOrUserIdentifiers())
 	}
 
@@ -431,7 +431,7 @@ func TestGatewayBatchOperations(t *testing.T) {
 	usr1 := p.NewUser()
 	usr2 := p.NewUser()
 	gtwIDs := make([]*ttnpb.GatewayIdentifiers, 0, noOfGateways)
-	for i := 0; i < noOfGateways; i++ {
+	for range noOfGateways {
 		gtw := p.NewGateway(usr1.GetOrganizationOrUserIdentifiers())
 		gtw.Attributes = map[string]string{
 			"foo": "bar",
@@ -529,7 +529,7 @@ func TestGatewaysFilter(t *testing.T) {
 	p := &storetest.Population{}
 
 	usr1 := p.NewUser()
-	for i := 0; i < 5; i++ {
+	for range 5 {
 		p.NewGateway(usr1.GetOrganizationOrUserIdentifiers())
 	}
 
diff --git a/pkg/identityserver/notification_registry.go b/pkg/identityserver/notification_registry.go
index 93227118c0..ee2939a131 100644
--- a/pkg/identityserver/notification_registry.go
+++ b/pkg/identityserver/notification_registry.go
@@ -17,6 +17,7 @@ package identityserver
 import (
 	"context"
 	"fmt"
+	"slices"
 
 	clusterauth "go.thethings.network/lorawan-stack/v3/pkg/auth/cluster"
 	"go.thethings.network/lorawan-stack/v3/pkg/auth/rights"
@@ -47,12 +48,7 @@ var (
 )
 
 func receiversContains(receivers []ttnpb.NotificationReceiver, search ttnpb.NotificationReceiver) bool {
-	for _, receiver := range receivers {
-		if receiver == search {
-			return true
-		}
-	}
-	return false
+	return slices.Contains(receivers, search)
 }
 
 func filterAllowedEmailReceivers(
diff --git a/pkg/identityserver/organization_registry_test.go b/pkg/identityserver/organization_registry_test.go
index 39f0ab3132..8ab55de612 100644
--- a/pkg/identityserver/organization_registry_test.go
+++ b/pkg/identityserver/organization_registry_test.go
@@ -189,12 +189,12 @@ func TestOrganizationsCRUD(t *testing.T) {
 	adminCreds := rpcCreds(adminKey)
 
 	usr1 := p.NewUser()
-	for i := 0; i < 5; i++ {
+	for range 5 {
 		p.NewOrganization(usr1.GetOrganizationOrUserIdentifiers())
 	}
 
 	usr2 := p.NewUser()
-	for i := 0; i < 5; i++ {
+	for range 5 {
 		p.NewOrganization(usr2.GetOrganizationOrUserIdentifiers())
 	}
 
@@ -382,7 +382,7 @@ func TestOrganizationsPagination(t *testing.T) {
 	p := &storetest.Population{}
 
 	usr1 := p.NewUser()
-	for i := 0; i < 3; i++ {
+	for range 3 {
 		p.NewOrganization(usr1.GetOrganizationOrUserIdentifiers())
 	}
 
diff --git a/pkg/identityserver/registry_search_test.go b/pkg/identityserver/registry_search_test.go
index e8457cdc73..45afcedf70 100644
--- a/pkg/identityserver/registry_search_test.go
+++ b/pkg/identityserver/registry_search_test.go
@@ -40,31 +40,31 @@ func TestRegistrySearch(t *testing.T) {
 	adminUsrKey, _ := p.NewAPIKey(adminUsr.GetEntityIdentifiers(), ttnpb.Right_RIGHT_ALL)
 	adminUsrCreds := rpcCreds(adminUsrKey)
 
-	for i := 0; i < 10; i++ {
+	for i := range 10 {
 		app := p.NewApplication(nil)
 		if i < 5 {
 			app.Description = desc
 		}
 	}
-	for i := 0; i < 10; i++ {
+	for i := range 10 {
 		cli := p.NewClient(nil)
 		if i < 5 {
 			cli.Description = desc
 		}
 	}
-	for i := 0; i < 10; i++ {
+	for i := range 10 {
 		gtw := p.NewGateway(nil)
 		if i < 5 {
 			gtw.Description = desc
 		}
 	}
-	for i := 0; i < 10; i++ {
+	for i := range 10 {
 		org := p.NewOrganization(nil)
 		if i < 5 {
 			org.Description = desc
 		}
 	}
-	for i := 0; i < 10; i++ {
+	for i := range 10 {
 		usr := p.NewUser()
 		if i < 5 {
 			usr.Description = desc
@@ -156,7 +156,7 @@ func TestRegistrySearchDeletedEntities(t *testing.T) { // nolint:gocyclo
 	usrs := make([]*ttnpb.User, 10)
 
 	// Making an uneven number of deleted entities just to avoid having a flaky tests.
-	for i := 0; i < 10; i++ {
+	for i := range 10 {
 		apps[i] = p.NewApplication(usr.GetOrganizationOrUserIdentifiers())
 		clis[i] = p.NewClient(usr.GetOrganizationOrUserIdentifiers())
 		gtws[i] = p.NewGateway(usr.GetOrganizationOrUserIdentifiers())
@@ -179,7 +179,7 @@ func TestRegistrySearchDeletedEntities(t *testing.T) { // nolint:gocyclo
 		a, ctx := test.New(t)
 
 		// Delete some entities associated with the non admin user.
-		for i := 0; i < deletedAmount; i++ {
+		for i := range deletedAmount {
 			_, err := appReg.Delete(ctx, apps[i].Ids, usrCreds)
 			a.So(err, should.BeNil)
 			_, err = cliReg.Delete(ctx, clis[i].Ids, usrCreds)
@@ -287,7 +287,7 @@ func TestRegistrySearchDeletedEntities(t *testing.T) { // nolint:gocyclo
 		// Admin only operations
 		usrReg := ttnpb.NewUserRegistryClient(cc)
 		// Delete some users.
-		for i := 0; i < deletedAmount; i++ {
+		for i := range deletedAmount {
 			_, err := usrReg.Delete(ctx, usrs[i].Ids, adminUsrCreds)
 			a.So(err, should.BeNil)
 		}
diff --git a/pkg/identityserver/store/field_mask.go b/pkg/identityserver/store/field_mask.go
index 4ed22097ef..0468a6935f 100644
--- a/pkg/identityserver/store/field_mask.go
+++ b/pkg/identityserver/store/field_mask.go
@@ -14,6 +14,8 @@
 
 package store
 
+import "slices"
+
 import "strings"
 
 // FieldMask is used to specify applicable fields in SELECT or UPDATE queries.
@@ -21,12 +23,7 @@ type FieldMask []string
 
 // Contains returns true if the given field is present in the field mask.
 func (fm FieldMask) Contains(search string) bool {
-	for _, f := range fm {
-		if f == search {
-			return true
-		}
-	}
-	return false
+	return slices.Contains(fm, search)
 }
 
 // TopLevel returns the top-level fields from the field mask.
@@ -48,8 +45,8 @@ func (fm FieldMask) TrimPrefix(prefix string) FieldMask {
 	}
 	out := make([]string, 0, len(fm))
 	for _, f := range fm {
-		if strings.HasPrefix(f, prefix) {
-			out = append(out, strings.TrimPrefix(f, prefix))
+		if after, ok := strings.CutPrefix(f, prefix); ok {
+			out = append(out, after)
 		}
 	}
 	return out
diff --git a/pkg/identityserver/store/pagination.go b/pkg/identityserver/store/pagination.go
index aa7ff066d1..e0ba89f909 100644
--- a/pkg/identityserver/store/pagination.go
+++ b/pkg/identityserver/store/pagination.go
@@ -82,8 +82,8 @@ func WithOrder(ctx context.Context, spec string) context.Context {
 	}
 	field := spec
 	direction := "ASC"
-	if strings.HasPrefix(spec, "-") {
-		field = strings.TrimPrefix(spec, "-")
+	if after, ok := strings.CutPrefix(spec, "-"); ok {
+		field = after
 		direction = "DESC"
 	}
 	return context.WithValue(ctx, orderOptionsKey, OrderOptions{
diff --git a/pkg/identityserver/storetest/api_key_store.go b/pkg/identityserver/storetest/api_key_store.go
index 0ea50c8a24..e4efee9828 100644
--- a/pkg/identityserver/storetest/api_key_store.go
+++ b/pkg/identityserver/storetest/api_key_store.go
@@ -225,7 +225,7 @@ func (st *StoreTest) TestAPIKeyStorePagination(t *T) {
 	app1 := st.population.NewApplication(nil)
 
 	var all []*ttnpb.APIKey
-	for i := 0; i < 7; i++ {
+	for i := range 7 {
 		_, key := st.population.NewAPIKey(app1.GetEntityIdentifiers(), ttnpb.Right_RIGHT_APPLICATION_ALL)
 		key.Name = fmt.Sprintf("Key %d", i)
 		all = append(all, key)
@@ -277,7 +277,7 @@ func (st *StoreTest) TestAPIKeyStorePaginationDefaults(t *T) {
 	app1 := st.population.NewApplication(nil)
 
 	var all []*ttnpb.APIKey
-	for i := 0; i < 15; i++ {
+	for i := range 15 {
 		_, key := st.population.NewAPIKey(app1.GetEntityIdentifiers(), ttnpb.Right_RIGHT_APPLICATION_ALL)
 		key.Name = fmt.Sprintf("Key %d", i)
 		all = append(all, key)
diff --git a/pkg/identityserver/storetest/application_store.go b/pkg/identityserver/storetest/application_store.go
index 573f51b86a..dde4c2924f 100644
--- a/pkg/identityserver/storetest/application_store.go
+++ b/pkg/identityserver/storetest/application_store.go
@@ -321,7 +321,7 @@ func (st *StoreTest) TestApplicationStorePagination(t *T) {
 	usr1 := st.population.NewUser()
 
 	var all []*ttnpb.Application
-	for i := 0; i < 7; i++ {
+	for range 7 {
 		all = append(all, st.population.NewApplication(usr1.GetOrganizationOrUserIdentifiers()))
 	}
 
@@ -369,7 +369,7 @@ func (st *StoreTest) TestApplicationStorePaginationDefaults(t *T) {
 
 	usr1 := st.population.NewUser()
 
-	for i := 0; i < 15; i++ {
+	for range 15 {
 		st.population.NewApplication(usr1.GetOrganizationOrUserIdentifiers())
 	}
 
diff --git a/pkg/identityserver/storetest/client_store.go b/pkg/identityserver/storetest/client_store.go
index d8cdb28552..ec25f93798 100644
--- a/pkg/identityserver/storetest/client_store.go
+++ b/pkg/identityserver/storetest/client_store.go
@@ -309,7 +309,7 @@ func (st *StoreTest) TestClientStorePagination(t *T) {
 	usr1 := st.population.NewUser()
 
 	var all []*ttnpb.Client
-	for i := 0; i < 7; i++ {
+	for range 7 {
 		all = append(all, st.population.NewClient(usr1.GetOrganizationOrUserIdentifiers()))
 	}
 
@@ -357,7 +357,7 @@ func (st *StoreTest) TestClientStorePaginationDefaults(t *T) {
 
 	usr1 := st.population.NewUser()
 
-	for i := 0; i < 15; i++ {
+	for range 15 {
 		st.population.NewClient(usr1.GetOrganizationOrUserIdentifiers())
 	}
 
diff --git a/pkg/identityserver/storetest/end_device_store.go b/pkg/identityserver/storetest/end_device_store.go
index 2ffee5b73b..0d9d429107 100644
--- a/pkg/identityserver/storetest/end_device_store.go
+++ b/pkg/identityserver/storetest/end_device_store.go
@@ -476,7 +476,7 @@ func (st *StoreTest) TestEndDeviceStorePagination(t *T) {
 	app1 := st.population.NewApplication(usr1.GetOrganizationOrUserIdentifiers())
 
 	var all []*ttnpb.EndDevice
-	for i := 0; i < 7; i++ {
+	for range 7 {
 		all = append(all, st.population.NewEndDevice(app1.GetIds()))
 	}
 
@@ -519,7 +519,7 @@ func (st *StoreTest) TestEndDeviceBatchUpdate(t *T) {
 	app1 := st.population.NewApplication(usr1.GetOrganizationOrUserIdentifiers())
 
 	var all []*ttnpb.EndDevice
-	for i := 0; i < 3; i++ {
+	for range 3 {
 		all = append(all, st.population.NewEndDevice(app1.GetIds()))
 	}
 
diff --git a/pkg/identityserver/storetest/entity_search.go b/pkg/identityserver/storetest/entity_search.go
index 2e2394e888..aeeaf2dc29 100644
--- a/pkg/identityserver/storetest/entity_search.go
+++ b/pkg/identityserver/storetest/entity_search.go
@@ -635,29 +635,29 @@ func (st *StoreTest) TestEntitySearchPagination(t *T) {
 	})
 
 	var users []*ttnpb.User
-	for i := 0; i < 9; i++ {
+	for range 9 {
 		users = append(users, st.population.NewUser())
 	}
 
 	var applications []*ttnpb.Application
-	for i := 0; i < 9; i++ {
+	for range 9 {
 		applications = append(applications, st.population.NewApplication(users[0].GetOrganizationOrUserIdentifiers()))
 	}
 	var clients []*ttnpb.Client
-	for i := 0; i < 9; i++ {
+	for range 9 {
 		clients = append(clients, st.population.NewClient(users[0].GetOrganizationOrUserIdentifiers()))
 	}
 	var gateways []*ttnpb.Gateway
-	for i := 0; i < 9; i++ {
+	for range 9 {
 		gateways = append(gateways, st.population.NewGateway(users[0].GetOrganizationOrUserIdentifiers()))
 	}
 	var organizations []*ttnpb.Organization
-	for i := 0; i < 9; i++ {
+	for range 9 {
 		organizations = append(organizations, st.population.NewOrganization(users[0].GetOrganizationOrUserIdentifiers()))
 	}
 
 	var endDevices []*ttnpb.EndDevice
-	for i := 0; i < 9; i++ {
+	for range 9 {
 		endDevices = append(endDevices, st.population.NewEndDevice(applications[0].GetIds()))
 	}
 
diff --git a/pkg/identityserver/storetest/gateway_store.go b/pkg/identityserver/storetest/gateway_store.go
index 5710057c36..b5cb603de3 100644
--- a/pkg/identityserver/storetest/gateway_store.go
+++ b/pkg/identityserver/storetest/gateway_store.go
@@ -505,7 +505,7 @@ func (st *StoreTest) TestGatewayStorePagination(t *T) {
 	usr1 := st.population.NewUser()
 
 	var all []*ttnpb.Gateway
-	for i := 0; i < 7; i++ {
+	for range 7 {
 		all = append(all, st.population.NewGateway(usr1.GetOrganizationOrUserIdentifiers()))
 	}
 
diff --git a/pkg/identityserver/storetest/invitation_store.go b/pkg/identityserver/storetest/invitation_store.go
index 70fc0c6ccf..9743b6f988 100644
--- a/pkg/identityserver/storetest/invitation_store.go
+++ b/pkg/identityserver/storetest/invitation_store.go
@@ -216,7 +216,7 @@ func (st *StoreTest) TestInvitationStorePagination(t *T) {
 	defer s.Close()
 
 	var all []*ttnpb.Invitation
-	for i := 0; i < 7; i++ {
+	for i := range 7 {
 		created, err := s.CreateInvitation(ctx, &ttnpb.Invitation{
 			Email:     fmt.Sprintf("user%d@example.com", i+1),
 			Token:     fmt.Sprintf("TOKEN%d", i+1),
@@ -271,7 +271,7 @@ func (st *StoreTest) TestInvitationStorePaginationDefaults(t *T) {
 	}
 	defer s.Close()
 
-	for i := 0; i < 15; i++ {
+	for i := range 15 {
 		_, err := s.CreateInvitation(ctx, &ttnpb.Invitation{
 			Email:     fmt.Sprintf("user%d@example.com", i+1),
 			Token:     fmt.Sprintf("TOKEN%d", i+1),
diff --git a/pkg/identityserver/storetest/membership_store.go b/pkg/identityserver/storetest/membership_store.go
index 1fff7b14da..dcf15fe04d 100644
--- a/pkg/identityserver/storetest/membership_store.go
+++ b/pkg/identityserver/storetest/membership_store.go
@@ -262,12 +262,12 @@ func (st *StoreTest) TestMembershipStoreCRUD(t *T) {
 
 func (st *StoreTest) TestMembershipStorePagination(t *T) {
 	var apps []*ttnpb.Application
-	for i := 0; i < 7; i++ {
+	for range 7 {
 		apps = append(apps, st.population.NewApplication(nil))
 	}
 
 	var memberIDs []*ttnpb.OrganizationOrUserIdentifiers
-	for i := 0; i < 7; i++ {
+	for range 7 {
 		ids := st.population.NewUser().GetOrganizationOrUserIdentifiers()
 		memberIDs = append(memberIDs, ids)
 		st.population.NewMembership(ids, apps[0].GetEntityIdentifiers(), ttnpb.Right_RIGHT_APPLICATION_ALL)
@@ -397,12 +397,12 @@ func (st *StoreTest) TestMembershipStorePaginationDefaults(t *T) {
 	})
 
 	var apps []*ttnpb.Application
-	for i := 0; i < 15; i++ {
+	for range 15 {
 		apps = append(apps, st.population.NewApplication(nil))
 	}
 
 	var memberIDs []*ttnpb.OrganizationOrUserIdentifiers
-	for i := 0; i < 15; i++ {
+	for range 15 {
 		ids := st.population.NewUser().GetOrganizationOrUserIdentifiers()
 		memberIDs = append(memberIDs, ids)
 		st.population.NewMembership(ids, apps[0].GetEntityIdentifiers(), ttnpb.Right_RIGHT_APPLICATION_ALL)
diff --git a/pkg/identityserver/storetest/oauth_store.go b/pkg/identityserver/storetest/oauth_store.go
index df9bdeacd6..7720387358 100644
--- a/pkg/identityserver/storetest/oauth_store.go
+++ b/pkg/identityserver/storetest/oauth_store.go
@@ -423,7 +423,7 @@ func (st *StoreTest) TestOAuthStorePagination(t *T) {
 	usr1 := st.population.NewUser()
 
 	var clients []*ttnpb.Client
-	for i := 0; i < 7; i++ {
+	for range 7 {
 		clients = append(clients, st.population.NewClient(usr1.GetOrganizationOrUserIdentifiers()))
 	}
 
@@ -438,7 +438,7 @@ func (st *StoreTest) TestOAuthStorePagination(t *T) {
 	defer s.Close()
 
 	var authorizations []*ttnpb.OAuthClientAuthorization
-	for i := 0; i < 7; i++ {
+	for i := range 7 {
 		created, err := s.Authorize(ctx, &ttnpb.OAuthClientAuthorization{
 			UserIds:   usr1.GetIds(),
 			ClientIds: clients[i].GetIds(),
@@ -452,7 +452,7 @@ func (st *StoreTest) TestOAuthStorePagination(t *T) {
 	}
 
 	var accessTokens []*ttnpb.OAuthAccessToken
-	for i := 0; i < 7; i++ {
+	for i := range 7 {
 		created, err := s.CreateAccessToken(ctx, &ttnpb.OAuthAccessToken{
 			UserIds:   usr1.GetIds(),
 			ClientIds: clients[0].GetIds(),
@@ -524,7 +524,7 @@ func (st *StoreTest) TestOAuthStorePaginationDefaults(t *T) {
 	usr1 := st.population.NewUser()
 
 	var clients []*ttnpb.Client
-	for i := 0; i < 15; i++ {
+	for range 15 {
 		clients = append(clients, st.population.NewClient(usr1.GetOrganizationOrUserIdentifiers()))
 	}
 
@@ -538,7 +538,7 @@ func (st *StoreTest) TestOAuthStorePaginationDefaults(t *T) {
 	}
 	defer s.Close()
 
-	for i := 0; i < 15; i++ {
+	for i := range 15 {
 		_, err := s.Authorize(ctx, &ttnpb.OAuthClientAuthorization{
 			UserIds:   usr1.GetIds(),
 			ClientIds: clients[i].GetIds(),
@@ -550,7 +550,7 @@ func (st *StoreTest) TestOAuthStorePaginationDefaults(t *T) {
 		time.Sleep(test.Delay)
 	}
 
-	for i := 0; i < 15; i++ {
+	for i := range 15 {
 		_, err := s.CreateAccessToken(ctx, &ttnpb.OAuthAccessToken{
 			UserIds:   usr1.GetIds(),
 			ClientIds: clients[0].GetIds(),
diff --git a/pkg/identityserver/storetest/organization_store.go b/pkg/identityserver/storetest/organization_store.go
index 21e4de7197..970a1be0ea 100644
--- a/pkg/identityserver/storetest/organization_store.go
+++ b/pkg/identityserver/storetest/organization_store.go
@@ -311,7 +311,7 @@ func (st *StoreTest) TestOrganizationStorePagination(t *T) {
 	usr1 := st.population.NewUser()
 
 	var all []*ttnpb.Organization
-	for i := 0; i < 7; i++ {
+	for range 7 {
 		all = append(all, st.population.NewOrganization(usr1.GetOrganizationOrUserIdentifiers()))
 	}
 
@@ -359,7 +359,7 @@ func (st *StoreTest) TestOrganizationStorePaginationDefaults(t *T) {
 
 	usr1 := st.population.NewUser()
 
-	for i := 0; i < 15; i++ {
+	for range 15 {
 		st.population.NewOrganization(usr1.GetOrganizationOrUserIdentifiers())
 	}
 
diff --git a/pkg/identityserver/storetest/storetest.go b/pkg/identityserver/storetest/storetest.go
index 8168c242c5..5a99dae388 100644
--- a/pkg/identityserver/storetest/storetest.go
+++ b/pkg/identityserver/storetest/storetest.go
@@ -46,9 +46,9 @@ func GetDSN(defaultDB string) *url.URL {
 	}
 	if dbAuth := os.Getenv("SQL_DB_AUTH"); dbAuth != "" {
 		var username, password string
-		idx := strings.Index(dbAuth, ":")
-		if idx != -1 {
-			username, password = dbAuth[:idx], dbAuth[idx+1:]
+		before, after, ok := strings.Cut(dbAuth, ":")
+		if ok {
+			username, password = before, after
 		} else {
 			username = dbAuth
 		}
diff --git a/pkg/identityserver/storetest/user_session_store.go b/pkg/identityserver/storetest/user_session_store.go
index 2f01b86e28..703e049c40 100644
--- a/pkg/identityserver/storetest/user_session_store.go
+++ b/pkg/identityserver/storetest/user_session_store.go
@@ -193,7 +193,7 @@ func (st *StoreTest) TestUserSessionStorePagination(t *T) {
 	defer s.Close()
 
 	var sessions []*ttnpb.UserSession
-	for i := 0; i < 7; i++ {
+	for i := range 7 {
 		created, err := s.CreateSession(ctx, &ttnpb.UserSession{
 			UserIds:   usr1.GetIds(),
 			SessionId: fmt.Sprintf("SESS%d", i+1),
@@ -250,7 +250,7 @@ func (st *StoreTest) TestUserSessionStorePaginationDefaults(t *T) {
 	}
 	defer s.Close()
 
-	for i := 0; i < 15; i++ {
+	for i := range 15 {
 		_, err := s.CreateSession(ctx, &ttnpb.UserSession{
 			UserIds:   usr1.GetIds(),
 			SessionId: fmt.Sprintf("SESS%d", i+1),
diff --git a/pkg/identityserver/storetest/user_store.go b/pkg/identityserver/storetest/user_store.go
index ecf3d3c639..5bb571ff87 100644
--- a/pkg/identityserver/storetest/user_store.go
+++ b/pkg/identityserver/storetest/user_store.go
@@ -463,7 +463,7 @@ func (st *StoreTest) TestUserStoreCRUD(t *T) {
 
 func (st *StoreTest) TestUserStorePagination(t *T) {
 	var all []*ttnpb.User
-	for i := 0; i < 7; i++ {
+	for range 7 {
 		all = append(all, st.population.NewUser())
 	}
 
@@ -509,7 +509,7 @@ func (st *StoreTest) TestUserStorePaginationDefaults(t *T) {
 		DefaultLimit: 7,
 	})
 
-	for i := 0; i < 15; i++ {
+	for range 15 {
 		st.population.NewUser()
 	}
 
diff --git a/pkg/identityserver/user_registry.go b/pkg/identityserver/user_registry.go
index 12838a0aff..0f00a638e9 100644
--- a/pkg/identityserver/user_registry.go
+++ b/pkg/identityserver/user_registry.go
@@ -17,6 +17,7 @@ package identityserver
 import (
 	"context"
 	"runtime/trace"
+	"slices"
 	"strings"
 	"time"
 	"unicode"
@@ -166,10 +167,8 @@ func (is *IdentityServer) validatePasswordStrength(ctx context.Context, username
 		return errPasswordContainsUserID.New()
 	}
 	if requirements.RejectCommon {
-		for _, reject := range commonPasswords {
-			if strings.ToLower(password) == reject {
-				return errCommonPassword.New()
-			}
+		if slices.Contains(commonPasswords, strings.ToLower(password)) {
+			return errCommonPassword.New()
 		}
 	}
 	return nil
diff --git a/pkg/interop/client.go b/pkg/interop/client.go
index e832524f6d..e3f7079d5d 100644
--- a/pkg/interop/client.go
+++ b/pkg/interop/client.go
@@ -23,6 +23,7 @@ import (
 	"io"
 	"net/http"
 	"path/filepath"
+	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -402,11 +403,8 @@ func NewClient(
 		// Skip Join Servers with unmatching component selector.
 		if len(jsEntry.Components) > 0 {
 			var found bool
-			for _, c := range jsEntry.Components {
-				if c == selector {
-					found = true
-					break
-				}
+			if slices.Contains(jsEntry.Components, selector) {
+				found = true
 			}
 			if !found {
 				continue
diff --git a/pkg/interop/server_authn_mtls.go b/pkg/interop/server_authn_mtls.go
index a3cb1f2a56..bb8860358d 100644
--- a/pkg/interop/server_authn_mtls.go
+++ b/pkg/interop/server_authn_mtls.go
@@ -17,6 +17,7 @@ package interop
 import (
 	"context"
 	"crypto/tls"
+	"slices"
 )
 
 func (s *Server) verifySenderCertificate(
@@ -30,17 +31,15 @@ func (s *Server) verifySenderCertificate(
 	}
 	for _, chain := range state.VerifiedChains {
 		peerCert, clientCA := chain[0], chain[len(chain)-1]
-		for _, senderClientCA := range senderClientCAs {
-			if clientCA.Equal(senderClientCA) {
-				// If the TLS client certificate contains DNS addresses, use those.
-				// Otherwise, fallback to using CommonName as address.
-				if len(peerCert.DNSNames) > 0 {
-					addrs = append([]string(nil), peerCert.DNSNames...)
-				} else {
-					addrs = []string{peerCert.Subject.CommonName}
-				}
-				return
+		if slices.ContainsFunc(senderClientCAs, clientCA.Equal) {
+			// If the TLS client certificate contains DNS addresses, use those.
+			// Otherwise, fallback to using CommonName as address.
+			if len(peerCert.DNSNames) > 0 {
+				addrs = append([]string(nil), peerCert.DNSNames...)
+			} else {
+				addrs = []string{peerCert.Subject.CommonName}
 			}
+			return
 		}
 	}
 	// TODO: Verify state.PeerCertificates[0] with senderClientCAs as Roots
diff --git a/pkg/joinserver/registry_test.go b/pkg/joinserver/registry_test.go
index 7787ba0d2e..2acb975e8a 100644
--- a/pkg/joinserver/registry_test.go
+++ b/pkg/joinserver/registry_test.go
@@ -469,7 +469,7 @@ func handleKeyRegistryTest(t *testing.T, reg KeyRegistry) {
 	a.So(ret, should.BeNil)
 
 	// Check number of retained session keys. Only the last 10 should be kept.
-	for i := byte(0); i < 20; i++ {
+	for i := range byte(20) {
 		sid := bytes.Repeat([]byte{i}, 4)
 		_, err := reg.SetByID(ctx, joinEUI, devEUI, sid, []string{
 			"app_s_key",
@@ -499,7 +499,7 @@ func handleKeyRegistryTest(t *testing.T, reg KeyRegistry) {
 			t.Fatalf("Error received: %v", err)
 		}
 	}
-	for i := byte(0); i < 20; i++ {
+	for i := range byte(20) {
 		_, err := reg.GetByID(ctx, joinEUI, devEUI, bytes.Repeat([]byte{i}, 4), ttnpb.SessionKeysFieldPathsTopLevel)
 		if i < 10 {
 			if !a.So(err, should.NotBeNil) || !a.So(errors.IsNotFound(err), should.BeTrue) {
@@ -517,7 +517,7 @@ func handleKeyRegistryTest(t *testing.T, reg KeyRegistry) {
 	if !a.So(err, should.BeNil) {
 		t.Fatalf("Error received: %v", err)
 	}
-	for i := byte(0); i < 20; i++ {
+	for i := range byte(20) {
 		_, err := reg.GetByID(ctx, joinEUI, devEUI, bytes.Repeat([]byte{i}, 4), ttnpb.SessionKeysFieldPathsTopLevel)
 		if !a.So(err, should.NotBeNil) || !a.So(errors.IsNotFound(err), should.BeTrue) {
 			t.Fatalf("Error received: %v", err)
@@ -532,7 +532,7 @@ func handleKeyRegistryTest(t *testing.T, reg KeyRegistry) {
 
 	// Create keys for each device
 	for _, devEUI := range []types.EUI64{devEUI1, devEUI2, devEUI3} {
-		for i := byte(0); i < noOfKeysPerDevice; i++ {
+		for i := range noOfKeysPerDevice {
 			sid := bytes.Repeat([]byte{i}, 4)
 			_, err := reg.SetByID(ctx, joinEUI, devEUI, sid, []string{
 				"app_s_key",
@@ -590,7 +590,7 @@ func handleKeyRegistryTest(t *testing.T, reg KeyRegistry) {
 
 	// Check if all keys are deleted
 	for _, devEUI := range []types.EUI64{devEUI1, devEUI2, devEUI3} {
-		for i := byte(0); i < noOfKeysPerDevice; i++ {
+		for i := range noOfKeysPerDevice {
 			sid := bytes.Repeat([]byte{i}, 4)
 			_, err := reg.GetByID(ctx, joinEUI, devEUI, sid, ttnpb.SessionKeysFieldPathsTopLevel)
 			if !a.So(err, should.NotBeNil) || !a.So(errors.IsNotFound(err), should.BeTrue) {
diff --git a/pkg/log/fields.go b/pkg/log/fields.go
index a5bd43d821..974c625191 100644
--- a/pkg/log/fields.go
+++ b/pkg/log/fields.go
@@ -16,6 +16,7 @@ package log
 
 import (
 	"fmt"
+	"maps"
 )
 
 // Fielder interface check.
@@ -81,9 +82,7 @@ func (f *F) Fields() map[string]any {
 		r = make(map[string]any)
 	}
 
-	for k, v := range f.nodes {
-		r[k] = v
-	}
+	maps.Copy(r, f.nodes)
 
 	return r
 }
diff --git a/pkg/log/middleware/sentry/sentry.go b/pkg/log/middleware/sentry/sentry.go
index 92427beff4..1dac06828a 100644
--- a/pkg/log/middleware/sentry/sentry.go
+++ b/pkg/log/middleware/sentry/sentry.go
@@ -79,8 +79,8 @@ func (s *Sentry) forward(e log.Entry) *sentry.EventID {
 			evt.Tags[k] = fmt.Sprint(v)
 		default:
 			if strings.HasSuffix(k, "_id") || strings.HasSuffix(k, "_uid") || strings.HasSuffix(k, "_eui") {
-				if strings.HasPrefix(k, "grpc.request.") {
-					k = strings.TrimPrefix(k, "grpc.request.")
+				if after, ok := strings.CutPrefix(k, "grpc.request."); ok {
+					k = after
 				}
 				evt.Tags[k] = fmt.Sprint(v)
 			}
diff --git a/pkg/messageprocessors/devicerepository/devicerepository_test.go b/pkg/messageprocessors/devicerepository/devicerepository_test.go
index feca0e48d1..40571b050a 100644
--- a/pkg/messageprocessors/devicerepository/devicerepository_test.go
+++ b/pkg/messageprocessors/devicerepository/devicerepository_test.go
@@ -157,7 +157,7 @@ func (dr *mockDR) start(ctx context.Context) string {
 }
 
 func mustHavePeer(ctx context.Context, c *component.Component, role ttnpb.ClusterRole) {
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(20 * time.Millisecond)
 		if _, err := c.GetPeer(ctx, role, nil); err == nil {
 			return
diff --git a/pkg/messageprocessors/normalizedpayload/uplink.go b/pkg/messageprocessors/normalizedpayload/uplink.go
index 0dc132b7cf..725960176d 100644
--- a/pkg/messageprocessors/normalizedpayload/uplink.go
+++ b/pkg/messageprocessors/normalizedpayload/uplink.go
@@ -16,11 +16,12 @@
 package normalizedpayload
 
 import (
+	"cmp"
 	"fmt"
+	"slices"
 	"time"
 
 	"go.thethings.network/lorawan-stack/v3/pkg/errors"
-	"golang.org/x/exp/constraints"
 	"google.golang.org/protobuf/types/known/structpb"
 )
 
@@ -200,11 +201,9 @@ func parseString(selector func(dst *Measurement) **string, allowed []string) fie
 			return []error{errFieldType.WithAttributes("path", path)}
 		}
 		p := val.StringValue
-		for _, e := range allowed {
-			if p == e {
-				*selector(dst) = &p
-				return nil
-			}
+		if slices.Contains(allowed, p) {
+			*selector(dst) = &p
+			return nil
 		}
 		return []error{
 			errFieldNotAllowed.WithAttributes(
@@ -246,7 +245,7 @@ func parseBoolean(selector func(dst *Measurement) **bool) fieldParser {
 }
 
 // minimum returns a field validator that checks the inclusive minimum.
-func minimum[T constraints.Ordered](min T) fieldValidator[T] {
+func minimum[T cmp.Ordered](min T) fieldValidator[T] {
 	return func(v T, path string) error {
 		if v < min {
 			return errFieldMinimum.WithAttributes(
@@ -261,7 +260,7 @@ func minimum[T constraints.Ordered](min T) fieldValidator[T] {
 // exclusiveMinimum returns a field validator that checks the exclusive minimum.
 //
 //nolint:unused,deadcode
-func exclusiveMinimum[T constraints.Ordered](min T) fieldValidator[T] {
+func exclusiveMinimum[T cmp.Ordered](min T) fieldValidator[T] {
 	return func(v T, path string) error {
 		if v <= min {
 			return errFieldExclusiveMinimum.WithAttributes(
@@ -274,7 +273,7 @@ func exclusiveMinimum[T constraints.Ordered](min T) fieldValidator[T] {
 }
 
 // maximum returns a field validator that checks the inclusive maximum.
-func maximum[T constraints.Ordered](max T) fieldValidator[T] {
+func maximum[T cmp.Ordered](max T) fieldValidator[T] {
 	return func(v T, path string) error {
 		if v > max {
 			return errFieldMaximum.WithAttributes(
@@ -287,7 +286,7 @@ func maximum[T constraints.Ordered](max T) fieldValidator[T] {
 }
 
 // exclusiveMaximum returns a field validator that checks the exclusive maximum.
-func exclusiveMaximum[T constraints.Ordered](max T) fieldValidator[T] {
+func exclusiveMaximum[T cmp.Ordered](max T) fieldValidator[T] {
 	return func(v T, path string) error {
 		if v >= max {
 			return errFieldExclusiveMaximum.WithAttributes(
diff --git a/pkg/networkserver/downlink_test.go b/pkg/networkserver/downlink_test.go
index 1002a67200..b8958de7c6 100644
--- a/pkg/networkserver/downlink_test.go
+++ b/pkg/networkserver/downlink_test.go
@@ -199,7 +199,7 @@ func TestProcessDownlinkTask(t *testing.T) {
 			_, a := test.MustNewTFromContext(ctx)
 			ctx = events.ContextWithCorrelationID(ctx, down.CorrelationIds...)
 			evIDOpt := events.WithIdentifiers(ids)
-			for i := uint(0); i < n; i++ {
+			for range n {
 				if !test.AllTrue(
 					a.So(env.Events, should.ReceiveEventFunc, attemptEventEqual,
 						attempt.With(events.WithData(down)).New(ctx, evIDOpt),
diff --git a/pkg/networkserver/grpc_test.go b/pkg/networkserver/grpc_test.go
index 4158d0df23..1da2c5f454 100644
--- a/pkg/networkserver/grpc_test.go
+++ b/pkg/networkserver/grpc_test.go
@@ -202,7 +202,7 @@ func TestGenerateDevAddr(t *testing.T) {
 				}
 
 				seen, total := map[types.DevAddrPrefix]float64{}, float64(0)
-				for i := 0; i < 1000; i++ {
+				for range 1000 {
 					devAddr, err := ttnpb.NewNsClient(ns.LoopbackConn()).GenerateDevAddr(ctx, ttnpb.Empty)
 					if a.So(err, should.BeNil) {
 						devAddr := types.MustDevAddr(devAddr.DevAddr)
diff --git a/pkg/networkserver/internal/test/shared/device_registry.go b/pkg/networkserver/internal/test/shared/device_registry.go
index fb70285e67..af11d4c3cb 100644
--- a/pkg/networkserver/internal/test/shared/device_registry.go
+++ b/pkg/networkserver/internal/test/shared/device_registry.go
@@ -36,7 +36,7 @@ func isNil(c any) bool {
 	if c == nil {
 		return true
 	}
-	if val := reflect.ValueOf(c); val.Kind() == reflect.Ptr {
+	if val := reflect.ValueOf(c); val.Kind() == reflect.Pointer {
 		return val.IsNil()
 	}
 	return false
diff --git a/pkg/networkserver/internal/test/shared/downlink_task_queue.go b/pkg/networkserver/internal/test/shared/downlink_task_queue.go
index 0f0b643caa..6a5fb092fd 100644
--- a/pkg/networkserver/internal/test/shared/downlink_task_queue.go
+++ b/pkg/networkserver/internal/test/shared/downlink_task_queue.go
@@ -191,7 +191,7 @@ func handleDownlinkTaskQueueTest(ctx context.Context, q DownlinkTaskQueue, consu
 
 	// Expect 3 slots
 	receivedSlots := make(map[*ttnpb.EndDeviceIdentifiers][]time.Time, 3)
-	for i := 0; i < 3; i++ {
+	for range 3 {
 		t.Helper()
 		a := assertions.New(t)
 		select {
diff --git a/pkg/networkserver/internal/test/test.go b/pkg/networkserver/internal/test/test.go
index a3f50db1ee..ffce78f471 100644
--- a/pkg/networkserver/internal/test/test.go
+++ b/pkg/networkserver/internal/test/test.go
@@ -314,7 +314,7 @@ func MakeDefaultEU868MACState(class ttnpb.Class, macVersion ttnpb.MACVersion, ph
 
 var DefaultUS915Channels = func() []*ttnpb.MACParameters_Channel {
 	var chs []*ttnpb.MACParameters_Channel
-	for i := 0; i < 64; i++ {
+	for i := range 64 {
 		chs = append(chs, &ttnpb.MACParameters_Channel{
 			UplinkFrequency:  uint64(902300000 + 200000*i),
 			MinDataRateIndex: ttnpb.DataRateIndex_DATA_RATE_0,
@@ -322,7 +322,7 @@ var DefaultUS915Channels = func() []*ttnpb.MACParameters_Channel {
 			EnableUplink:     true,
 		})
 	}
-	for i := 0; i < 8; i++ {
+	for i := range 8 {
 		chs = append(chs, &ttnpb.MACParameters_Channel{
 			UplinkFrequency:  uint64(903000000 + 1600000*i),
 			MinDataRateIndex: ttnpb.DataRateIndex_DATA_RATE_4,
@@ -330,7 +330,7 @@ var DefaultUS915Channels = func() []*ttnpb.MACParameters_Channel {
 			EnableUplink:     true,
 		})
 	}
-	for i := 0; i < 72; i++ {
+	for i := range 72 {
 		chs[i].DownlinkFrequency = uint64(923300000 + 600000*(i%8))
 	}
 	return chs
diff --git a/pkg/networkserver/mac/adr_test.go b/pkg/networkserver/mac/adr_test.go
index 7b30a2e9d9..056815b09d 100644
--- a/pkg/networkserver/mac/adr_test.go
+++ b/pkg/networkserver/mac/adr_test.go
@@ -600,7 +600,7 @@ func TestADRInstability(t *testing.T) {
 	}
 
 	penalty := float32(0)
-	for i := 0; i < 50; i++ {
+	for i := range 50 {
 		macState.RecentUplinks = append(macState.RecentUplinks, makeUplink(i, penalty))
 		err := AdaptDataRate(ctx, dev, phy, nil)
 		if !a.So(err, should.BeNil) {
diff --git a/pkg/networkserver/mac/relay_ctrl_uplink_list.go b/pkg/networkserver/mac/relay_ctrl_uplink_list.go
index 448aea44c4..406f4b79fc 100644
--- a/pkg/networkserver/mac/relay_ctrl_uplink_list.go
+++ b/pkg/networkserver/mac/relay_ctrl_uplink_list.go
@@ -100,7 +100,7 @@ func EnqueueRelayCtrlUplinkListReq(
 			currentRules := dev.MacState.GetCurrentParameters().GetRelay().GetServing().GetUplinkForwardingRules()
 			desiredRules := dev.MacState.DesiredParameters.Relay.GetServing().UplinkForwardingRules
 			var reqs []*ttnpb.MACCommand_RelayCtrlUplinkListReq
-			for i := 0; i < len(currentRules); i++ {
+			for i := range currentRules {
 				switch {
 				case !DeviceNeedsRelayCtrlUplinkListReqAtIndex(dev, i):
 				case i >= len(desiredRules), proto.Equal(desiredRules[i], emptyRelayUplinkForwardingRule):
diff --git a/pkg/networkserver/networkserver_internal_test.go b/pkg/networkserver/networkserver_internal_test.go
index 18e09e82c8..2121af23be 100644
--- a/pkg/networkserver/networkserver_internal_test.go
+++ b/pkg/networkserver/networkserver_internal_test.go
@@ -104,7 +104,7 @@ func TestNewDevAddr(t *testing.T) {
 			defer stop()
 
 			seen, total := map[types.DevAddrPrefix]float64{}, float64(0)
-			for i := 0; i < 1000; i++ {
+			for range 1000 {
 				devAddr := ns.newDevAddr(ctx)
 				for _, p := range ps {
 					if devAddr.HasPrefix(p) {
@@ -229,7 +229,7 @@ func TestMakeNewDevAddrFunc(t *testing.T) {
 			a, ctx := test.New(t)
 			newF := makeNewDevAddrFunc(tc.Prefixes...)
 			weights, total := make([]int, len(tc.Prefixes)), 0
-			for i := 0; i < 100000; i++ {
+			for range 100000 {
 				devAddr := newF(ctx)
 				found := false
 				for j, prefix := range tc.Prefixes {
diff --git a/pkg/networkserver/networkserver_util_internal_test.go b/pkg/networkserver/networkserver_util_internal_test.go
index 0af7d96eb1..e511810c76 100644
--- a/pkg/networkserver/networkserver_util_internal_test.go
+++ b/pkg/networkserver/networkserver_util_internal_test.go
@@ -1417,11 +1417,11 @@ func (env TestEnvironment) AssertHandleDeviceUplink(ctx context.Context, assert
 								UserAgent:      true,
 							}), expectedEvs) {
 								printEvents := func(evs []events.Event) string {
-									var s string
+									var s strings.Builder
 									for i, ev := range evs {
-										s += fmt.Sprintf("\nevent %d: %s", i, ev)
+										s.WriteString(fmt.Sprintf("\nevent %d: %s", i, ev))
 									}
-									return s
+									return s.String()
 								}
 								t.Errorf("Uplink event assertion failed.\nGot events: %s\nExpected events: %s", printEvents(evs), printEvents(expectedEvs))
 								return false
diff --git a/pkg/networkserver/redis/application_uplink_queue_test.go b/pkg/networkserver/redis/application_uplink_queue_test.go
index f66834ebca..cf5bf3f288 100644
--- a/pkg/networkserver/redis/application_uplink_queue_test.go
+++ b/pkg/networkserver/redis/application_uplink_queue_test.go
@@ -142,9 +142,9 @@ func generateRandomUplinks(t *testing.T, applicationCount, deviceCount int) []*t
 	t.Helper()
 
 	ups := make([]*ttnpb.ApplicationUp, 0, applicationCount*deviceCount)
-	for i := 0; i < applicationCount; i++ {
+	for i := range applicationCount {
 		applicationID := fmt.Sprintf("test-application-%d", i)
-		for j := 0; j < deviceCount; j++ {
+		for j := range deviceCount {
 			deviceID := fmt.Sprintf("test-device-%d", j)
 			ups = append(ups, &ttnpb.ApplicationUp{
 				EndDeviceIds: &ttnpb.EndDeviceIdentifiers{
@@ -261,7 +261,7 @@ func TestApplicationUplinkQueuePopAll(t *testing.T) {
 	uplinkCh := make(chan []*ttnpb.ApplicationUp, consumerCount*appCount)
 	wg := sync.WaitGroup{}
 
-	for i := 0; i < consumerCount; i++ {
+	for i := range consumerCount {
 		consumerID := fmt.Sprintf("test-consumer-%d", i)
 		wg.Add(1)
 		go func() {
@@ -328,7 +328,7 @@ func TestApplicationUplinkQueuePopErr(t *testing.T) {
 	uplinkCh := make(chan []*ttnpb.ApplicationUp, consumerCount*appCount)
 	wg := sync.WaitGroup{}
 
-	for i := 0; i < consumerCount; i++ {
+	for i := range consumerCount {
 		consumerID := fmt.Sprintf("test-consumer-%d", i)
 		wg.Add(1)
 		go func() {
diff --git a/pkg/networkserver/redis/downlink_task_queue_test.go b/pkg/networkserver/redis/downlink_task_queue_test.go
index 3e4d65d840..39dc4c6058 100644
--- a/pkg/networkserver/redis/downlink_task_queue_test.go
+++ b/pkg/networkserver/redis/downlink_task_queue_test.go
@@ -31,7 +31,7 @@ func TestDownlinkTaskQueue(t *testing.T) {
 		t.Run(fmt.Sprintf("Consumers=%d", consumers), func(t *testing.T) {
 			_, ctx := test.New(t)
 			consumerIDs := make([]string, 0, consumers)
-			for i := 0; i < consumers; i++ {
+			for i := range consumers {
 				consumerIDs = append(consumerIDs, fmt.Sprintf("consumer-%d-%d", consumers, i))
 			}
 			q, closeFn := NewRedisDownlinkTaskQueue(ctx)
diff --git a/pkg/networkserver/redis/registry.go b/pkg/networkserver/redis/registry.go
index e09575bf78..f6b0c3aa04 100644
--- a/pkg/networkserver/redis/registry.go
+++ b/pkg/networkserver/redis/registry.go
@@ -322,7 +322,7 @@ func (v *UplinkMatchSession) DecodeMsgpack(dec *msgpack.Decoder) error {
 	if n > 5 {
 		return errInvalidFieldCount.WithAttributes("count", n)
 	}
-	for i := 0; i < n; i++ {
+	for range n {
 		s, err := dec.DecodeString()
 		if err != nil {
 			return err
@@ -387,7 +387,7 @@ func (v *UplinkMatchPendingSession) DecodeMsgpack(dec *msgpack.Decoder) error {
 	if n > 2 {
 		return errInvalidFieldCount.WithAttributes("count", n)
 	}
-	for i := 0; i < n; i++ {
+	for range n {
 		s, err := dec.DecodeString()
 		if err != nil {
 			return err
diff --git a/pkg/networkserver/registry.go b/pkg/networkserver/registry.go
index 893c488524..c0bf6e4a77 100644
--- a/pkg/networkserver/registry.go
+++ b/pkg/networkserver/registry.go
@@ -271,7 +271,7 @@ var replacedEndDeviceFields = []registry.ReplacedEndDeviceField{
 				if n != len(newValue) {
 					return errInvalidFieldValue.WithAttributes("field", "queued_application_downlinks")
 				}
-				for i := 0; i < n; i++ {
+				for i := range n {
 					if !proto.Equal(oldValue[i], newValue[i]) {
 						return errInvalidFieldValue.WithAttributes("field", "queued_application_downlinks")
 					}
diff --git a/pkg/oauth/callback.go b/pkg/oauth/callback.go
index 1fc1a0230e..b986a6553a 100644
--- a/pkg/oauth/callback.go
+++ b/pkg/oauth/callback.go
@@ -16,6 +16,7 @@ package oauth
 
 import (
 	"fmt"
+	"maps"
 	"net/http"
 	"net/url"
 	"strconv"
@@ -28,9 +29,7 @@ func (s *server) redirectToLocal(w http.ResponseWriter, r *http.Request) {
 	}
 
 	params := make(url.Values)
-	for k, v := range r.URL.Query() {
-		params[k] = v
-	}
+	maps.Copy(params, r.URL.Query())
 	delete(params, "port")
 
 	url := url.URL{
diff --git a/pkg/oauth/oauth.go b/pkg/oauth/oauth.go
index aa4b65018a..c643055019 100644
--- a/pkg/oauth/oauth.go
+++ b/pkg/oauth/oauth.go
@@ -19,6 +19,7 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/url"
+	"slices"
 	"strconv"
 	"strings"
 
@@ -300,10 +301,5 @@ func (s *server) Token(w http.ResponseWriter, r *http.Request) {
 }
 
 func clientHasGrant(cli *ttnpb.Client, wanted ttnpb.GrantType) bool {
-	for _, grant := range cli.Grants {
-		if grant == wanted {
-			return true
-		}
-	}
-	return false
+	return slices.Contains(cli.Grants, wanted)
 }
diff --git a/pkg/packetbroker/token.go b/pkg/packetbroker/token.go
index 278c319602..63e5ca1c88 100644
--- a/pkg/packetbroker/token.go
+++ b/pkg/packetbroker/token.go
@@ -131,7 +131,7 @@ type IAMTokenClaims struct {
 // TokenClaims defines the Packet Broker JSON Web Token (JWT) claims.
 type TokenClaims struct {
 	jwt.Claims
-	PacketBroker IAMTokenClaims `json:"https://iam.packetbroker.net/claims,omitempty"`
+	PacketBroker IAMTokenClaims `json:"https://iam.packetbroker.net/claims"`
 }
 
 var (
diff --git a/pkg/packetbroker/token_test.go b/pkg/packetbroker/token_test.go
index 241c276169..e97bea0856 100644
--- a/pkg/packetbroker/token_test.go
+++ b/pkg/packetbroker/token_test.go
@@ -278,7 +278,7 @@ func TestToken(t *testing.T) {
 				)
 
 				// Repeat a couple of times to test token and public key cache.
-				for i := 0; i < 10; i++ {
+				for range 10 {
 					token, err := tokenSource.Token()
 					if err != nil {
 						if tc.tokenRequestErrorAssertion == nil {
diff --git a/pkg/packetbrokeragent/agent.go b/pkg/packetbrokeragent/agent.go
index 35ec39b604..7b57e8e4bc 100644
--- a/pkg/packetbrokeragent/agent.go
+++ b/pkg/packetbrokeragent/agent.go
@@ -528,7 +528,7 @@ func (a *Agent) subscribeDownlink(ctx context.Context) error {
 
 	var wg sync.WaitGroup
 	defer wg.Wait()
-	for i := 0; i < subscribeStreamCount; i++ {
+	for range subscribeStreamCount {
 		wg.Add(1)
 		a.StartTask(&task.Config{
 			Context: ctx,
@@ -847,7 +847,7 @@ func (a *Agent) subscribeUplink(ctx context.Context) error {
 
 	var wg sync.WaitGroup
 	defer wg.Wait()
-	for i := 0; i < subscribeStreamCount; i++ {
+	for range subscribeStreamCount {
 		wg.Add(1)
 		a.StartTask(&task.Config{
 			Context: ctx,
diff --git a/pkg/packetbrokeragent/crypto.go b/pkg/packetbrokeragent/crypto.go
index 7effaeca2b..ade29bde15 100644
--- a/pkg/packetbrokeragent/crypto.go
+++ b/pkg/packetbrokeragent/crypto.go
@@ -17,5 +17,5 @@ package packetbrokeragent
 import "fmt"
 
 func forwarderAdditionalData(netID uint32, tenantID string, clusterID string) []byte {
-	return []byte(fmt.Sprintf("%06x:%s:%s", netID, tenantID, clusterID))
+	return fmt.Appendf(nil, "%06x:%s:%s", netID, tenantID, clusterID)
 }
diff --git a/pkg/packetbrokeragent/grpc_pba_test.go b/pkg/packetbrokeragent/grpc_pba_test.go
index 552b7e8554..7a3b91e8a7 100644
--- a/pkg/packetbrokeragent/grpc_pba_test.go
+++ b/pkg/packetbrokeragent/grpc_pba_test.go
@@ -407,7 +407,7 @@ func TestPba(t *testing.T) {
 			name: "RoutingPolicy/HomeNetwork/List",
 			withControlPlaneHandlers: func(p *mock.PBControlPlane) {
 				policies := make([]*packetbroker.RoutingPolicy, 42)
-				for i := 0; i < len(policies); i++ {
+				for i := range policies {
 					policies[i] = &packetbroker.RoutingPolicy{
 						ForwarderNetId:    0x13,
 						ForwarderTenantId: "foo-tenant",
@@ -746,7 +746,7 @@ func TestPba(t *testing.T) {
 
 func generateNetworks(n int) []*packetbroker.NetworkOrTenant {
 	networks := make([]*packetbroker.NetworkOrTenant, n)
-	for i := 0; i < len(networks); i++ {
+	for i := range networks {
 		networks[i] = &packetbroker.NetworkOrTenant{}
 		if i%2 == 0 {
 			networks[i].Value = &packetbroker.NetworkOrTenant_Network{
diff --git a/pkg/packetbrokeragent/util_test.go b/pkg/packetbrokeragent/util_test.go
index bdd707b634..8047b7c289 100644
--- a/pkg/packetbrokeragent/util_test.go
+++ b/pkg/packetbrokeragent/util_test.go
@@ -27,7 +27,7 @@ import (
 )
 
 func mustHavePeer(ctx context.Context, c *component.Component, role ttnpb.ClusterRole) {
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(20 * time.Millisecond)
 		if _, err := c.GetPeer(ctx, role, nil); err == nil {
 			return
diff --git a/pkg/pfconfig/shared/shared.go b/pkg/pfconfig/shared/shared.go
index 0117a5c35c..2dd80bee12 100644
--- a/pkg/pfconfig/shared/shared.go
+++ b/pkg/pfconfig/shared/shared.go
@@ -324,10 +324,7 @@ func BuildSX1301Config(frequencyPlan *frequencyplans.FrequencyPlan) (*SX1301Conf
 		conf.Radios[i] = rfConfig
 	}
 
-	numChannels := len(frequencyPlan.UplinkChannels)
-	if numChannels < 8 {
-		numChannels = 8
-	}
+	numChannels := max(len(frequencyPlan.UplinkChannels), 8)
 	conf.Channels = make([]IFConfig, numChannels)
 	for i, channel := range frequencyPlan.UplinkChannels {
 		ifConfig := IFConfig{
diff --git a/pkg/qrcodegenerator/qrcode/enddevices/lora_alliance_tr005.go b/pkg/qrcodegenerator/qrcode/enddevices/lora_alliance_tr005.go
index c532691559..9cbd07d333 100644
--- a/pkg/qrcodegenerator/qrcode/enddevices/lora_alliance_tr005.go
+++ b/pkg/qrcodegenerator/qrcode/enddevices/lora_alliance_tr005.go
@@ -98,7 +98,7 @@ func (m LoRaAllianceTR005) MarshalText() ([]byte, error) {
 	if m.Proprietary != "" {
 		ext += fmt.Sprintf(":P%s", m.Proprietary)
 	}
-	return []byte(fmt.Sprintf("LW:D0:%X:%X:%X%X%s", m.JoinEUI[:], m.DevEUI[:], m.VendorID[:], m.ModelID[:], ext)), nil
+	return fmt.Appendf(nil, "LW:D0:%X:%X:%X%X%s", m.JoinEUI[:], m.DevEUI[:], m.VendorID[:], m.ModelID[:], ext), nil
 }
 
 // UnmarshalText implements the TextUnmarshaler interface.
diff --git a/pkg/qrcodegenerator/qrcode/enddevices/lora_alliance_tr005d2.go b/pkg/qrcodegenerator/qrcode/enddevices/lora_alliance_tr005d2.go
index 600667e0e0..c75fbc39e9 100644
--- a/pkg/qrcodegenerator/qrcode/enddevices/lora_alliance_tr005d2.go
+++ b/pkg/qrcodegenerator/qrcode/enddevices/lora_alliance_tr005d2.go
@@ -98,7 +98,7 @@ func (m LoRaAllianceTR005Draft2) MarshalText() ([]byte, error) {
 	if ext != "" {
 		ext = ":" + ext
 	}
-	return []byte(fmt.Sprintf("URN:LW:DP:%X:%X:%X%X%s", m.JoinEUI[:], m.DevEUI[:], m.VendorID[:], m.ModelID[:], ext)), nil
+	return fmt.Appendf(nil, "URN:LW:DP:%X:%X:%X%X%s", m.JoinEUI[:], m.DevEUI[:], m.VendorID[:], m.ModelID[:], ext), nil
 }
 
 // UnmarshalText implements the TextUnmarshaler interface.
@@ -128,7 +128,7 @@ func (m *LoRaAllianceTR005Draft2) UnmarshalText(text []byte) error {
 	}
 	if len(parts) == 7 {
 		exts := strings.ReplaceAll(string(parts[6]), "%25", "%")
-		for _, ext := range strings.Split(exts, "%") {
+		for ext := range strings.SplitSeq(exts, "%") {
 			if len(ext) < 1 {
 				continue
 			}
diff --git a/pkg/qrcodegenerator/qrcode/enddevices/lora_alliance_tr005d3.go b/pkg/qrcodegenerator/qrcode/enddevices/lora_alliance_tr005d3.go
index 538430356b..211f493dfd 100644
--- a/pkg/qrcodegenerator/qrcode/enddevices/lora_alliance_tr005d3.go
+++ b/pkg/qrcodegenerator/qrcode/enddevices/lora_alliance_tr005d3.go
@@ -95,7 +95,7 @@ func (m LoRaAllianceTR005Draft3) MarshalText() ([]byte, error) {
 	if m.Proprietary != "" {
 		ext += fmt.Sprintf("_P%s", m.Proprietary)
 	}
-	return []byte(fmt.Sprintf("URN:DEV:LW:%X_%X_%X%X%s", m.JoinEUI[:], m.DevEUI[:], m.VendorID[:], m.ModelID[:], ext)), nil
+	return fmt.Appendf(nil, "URN:DEV:LW:%X_%X_%X%X%s", m.JoinEUI[:], m.DevEUI[:], m.VendorID[:], m.ModelID[:], ext), nil
 }
 
 // UnmarshalText implements the TextUnmarshaler interface.
@@ -128,7 +128,7 @@ func (m *LoRaAllianceTR005Draft3) UnmarshalText(text []byte) error {
 		return err
 	}
 	if len(parts) == 4 {
-		for _, ext := range strings.Split(string(parts[3]), "_") {
+		for ext := range strings.SplitSeq(string(parts[3]), "_") {
 			if len(ext) < 1 {
 				continue
 			}
diff --git a/pkg/qrcodegenerator/util_test.go b/pkg/qrcodegenerator/util_test.go
index c6b99c3bf6..9c30386db2 100644
--- a/pkg/qrcodegenerator/util_test.go
+++ b/pkg/qrcodegenerator/util_test.go
@@ -27,7 +27,7 @@ import (
 )
 
 func mustHavePeer(ctx context.Context, c *component.Component, role ttnpb.ClusterRole) {
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		time.Sleep(20 * time.Millisecond)
 		if _, err := c.GetPeer(ctx, role, nil); err == nil {
 			return
@@ -56,11 +56,10 @@ func (*mock) FormatID() string {
 }
 
 func (m mock) MarshalText() ([]byte, error) {
-	return []byte(fmt.Sprintf(
+	return fmt.Appendf(nil,
 		"%s:%s",
 		strings.ToUpper(hex.EncodeToString(m.ids.JoinEui)),
-		strings.ToUpper(hex.EncodeToString(m.ids.DevEui))),
-	), nil
+		strings.ToUpper(hex.EncodeToString(m.ids.DevEui))), nil
 }
 
 func (*mock) UnmarshalText([]byte) error { return nil }
diff --git a/pkg/random/random_test.go b/pkg/random/random_test.go
index 8b2f69318b..b5ee91a5d5 100644
--- a/pkg/random/random_test.go
+++ b/pkg/random/random_test.go
@@ -59,7 +59,7 @@ func TestJitter(t *testing.T) {
 	a := assertions.New(t)
 	d := time.Duration(424242)
 	p := 0.1
-	for i := 0; i < 100; i++ {
+	for range 100 {
 		// Jitter of 10%
 		t := Jitter(d, p)
 		df := float64(d)
@@ -72,7 +72,7 @@ func TestCanJitter(t *testing.T) {
 
 	a := assertions.New(t)
 	p := 0.15
-	for d := time.Duration(0); d < 10; d++ {
+	for d := range time.Duration(10) {
 		// Values smaller or equal to 3 get clamped to zero, which cannot be
 		// used as a upper bound for the random number generator.
 		a.So(CanJitter(d, p), should.Equal, d > 3)
diff --git a/pkg/ratelimit/rate_limit_test.go b/pkg/ratelimit/rate_limit_test.go
index b1d927bc26..a0948b81ae 100644
--- a/pkg/ratelimit/rate_limit_test.go
+++ b/pkg/ratelimit/rate_limit_test.go
@@ -67,7 +67,7 @@ func TestRateLimit(t *testing.T) {
 			{"key1", []string{"default"}},
 			{"key2", []string{"default"}},
 		} {
-			for i := uint(0); i < maxRate; i++ {
+			for i := range maxRate {
 				limit, result := limiter.RateLimit(resource)
 
 				a.So(limit, should.BeFalse)
diff --git a/pkg/redis/redis_test.go b/pkg/redis/redis_test.go
index ce433375d6..1aea698f79 100644
--- a/pkg/redis/redis_test.go
+++ b/pkg/redis/redis_test.go
@@ -456,7 +456,7 @@ func TestTaskQueue(t *testing.T) {
 	// specifically LUAI_MAXCSTACK.
 	for _, batchSize := range []int{512 + 1, (512 + 1) * 2, 8192} {
 		p := cl.Pipeline()
-		for i := 0; i < batchSize; i++ {
+		for i := range batchSize {
 			a.So(q.Add(ctx, p, fmt.Sprintf("test%d", i), time.Unix(int64(i), 0), false), should.BeNil)
 		}
 		a.So(func() error {
@@ -465,7 +465,7 @@ func TestTaskQueue(t *testing.T) {
 		}(), should.BeNil)
 
 		times := make(map[string]time.Time)
-		for i := 0; i < batchSize; i++ {
+		for range batchSize {
 			a.So(q.Pop(ctx, "testID", nil, func(p redis.Pipeliner, payload string, startAt time.Time) error {
 				p.Ping(ctx)
 
@@ -477,7 +477,7 @@ func TestTaskQueue(t *testing.T) {
 			}), should.BeNil)
 		}
 		a.So(times, should.HaveLength, batchSize)
-		for i := 0; i < batchSize; i++ {
+		for i := range batchSize {
 			k := fmt.Sprintf("test%d", i)
 
 			t, ok := times[k]
@@ -628,7 +628,7 @@ func TestProtoDeduplicatorRespectsLimit(t *testing.T) {
 
 	bulkedProtosLen := limit + 5
 	bulkedProtos := make([]proto.Message, bulkedProtosLen)
-	for i := 0; i < bulkedProtosLen; i++ {
+	for i := range bulkedProtosLen {
 		s := fmt.Sprintf("proto%d", protoID)
 		bulkedProtos[i] = makeProto(t, s)
 		protoID++
diff --git a/pkg/telemetry/exporter/istelemetry/is.go b/pkg/telemetry/exporter/istelemetry/is.go
index 5d61f4e395..c59721ad10 100644
--- a/pkg/telemetry/exporter/istelemetry/is.go
+++ b/pkg/telemetry/exporter/istelemetry/is.go
@@ -181,7 +181,7 @@ func (it *isTelemetry) countGatewaysByFreqPlan(ctx context.Context) (map[string]
 
 	m := make(map[string]uint64)
 	for _, r := range results {
-		for _, freqPlan := range strings.Split(r.FrequencyPlanID, " ") {
+		for freqPlan := range strings.SplitSeq(r.FrequencyPlanID, " ") {
 			m[freqPlan] += r.Count
 		}
 	}
diff --git a/pkg/telemetry/exporter/task_queue_test.go b/pkg/telemetry/exporter/task_queue_test.go
index 515fef7c6d..c67f0e4ce3 100644
--- a/pkg/telemetry/exporter/task_queue_test.go
+++ b/pkg/telemetry/exporter/task_queue_test.go
@@ -158,7 +158,7 @@ func TestConcurrentTaskSet(t *testing.T) {
 	}(ctx, consumerIDPrefix)
 
 	// Create the pop loop with 3 consumers.
-	for i := 0; i < 3; i++ {
+	for i := range 3 {
 		consumerID := fmt.Sprintf("%s:%d", consumerIDPrefix, i)
 		go func(ctx context.Context, consumerID string) {
 			for {
diff --git a/pkg/ttnpb/application_interfaces.go b/pkg/ttnpb/application_interfaces.go
index c80a4c58b7..8b580a8718 100644
--- a/pkg/ttnpb/application_interfaces.go
+++ b/pkg/ttnpb/application_interfaces.go
@@ -113,43 +113,43 @@ func (m *SetApplicationCollaboratorRequest) IDString() string {
 
 // All ExtractRequestFields methods are used by github.com/grpc-ecosystem/go-grpc-middleware/tags.
 
-func (m *Application) ExtractRequestFields(dst map[string]interface{}) {
+func (m *Application) ExtractRequestFields(dst map[string]any) {
 	m.GetIds().ExtractRequestFields(dst)
 }
 
-func (m *GetApplicationRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *GetApplicationRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetApplicationIds().ExtractRequestFields(dst)
 }
 
-func (m *UpdateApplicationRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *UpdateApplicationRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetApplication().ExtractRequestFields(dst)
 }
 
-func (m *ListApplicationAPIKeysRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ListApplicationAPIKeysRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetApplicationIds().ExtractRequestFields(dst)
 }
 
-func (m *GetApplicationAPIKeyRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *GetApplicationAPIKeyRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetApplicationIds().ExtractRequestFields(dst)
 }
 
-func (m *CreateApplicationAPIKeyRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *CreateApplicationAPIKeyRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetApplicationIds().ExtractRequestFields(dst)
 }
 
-func (m *UpdateApplicationAPIKeyRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *UpdateApplicationAPIKeyRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetApplicationIds().ExtractRequestFields(dst)
 }
 
-func (m *ListApplicationCollaboratorsRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ListApplicationCollaboratorsRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetApplicationIds().ExtractRequestFields(dst)
 }
 
-func (m *GetApplicationCollaboratorRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *GetApplicationCollaboratorRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetApplicationIds().ExtractRequestFields(dst)
 }
 
-func (m *ApplicationUp) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ApplicationUp) ExtractRequestFields(dst map[string]any) {
 	ids := m.EndDeviceIds
 	if ids == nil {
 		return
@@ -157,7 +157,7 @@ func (m *ApplicationUp) ExtractRequestFields(dst map[string]interface{}) {
 	ids.ExtractRequestFields(dst)
 }
 
-func (m *DownlinkQueueRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *DownlinkQueueRequest) ExtractRequestFields(dst map[string]any) {
 	ids := m.EndDeviceIds
 	if ids == nil {
 		return
diff --git a/pkg/ttnpb/applicationserver.go b/pkg/ttnpb/applicationserver.go
index d90f3e8813..30d23cd8e2 100644
--- a/pkg/ttnpb/applicationserver.go
+++ b/pkg/ttnpb/applicationserver.go
@@ -36,10 +36,10 @@ func (m *SetApplicationLinkRequest) IDString() string {
 
 // All ExtractRequestFields methods are used by github.com/grpc-ecosystem/go-grpc-middleware/tags.
 
-func (m *GetApplicationLinkRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *GetApplicationLinkRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetApplicationIds().ExtractRequestFields(dst)
 }
 
-func (m *SetApplicationLinkRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *SetApplicationLinkRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetApplicationIds().ExtractRequestFields(dst)
 }
diff --git a/pkg/ttnpb/applicationserver_integrations_storage.go b/pkg/ttnpb/applicationserver_integrations_storage.go
index ac54bc03f0..898a975cf4 100644
--- a/pkg/ttnpb/applicationserver_integrations_storage.go
+++ b/pkg/ttnpb/applicationserver_integrations_storage.go
@@ -17,11 +17,11 @@ package ttnpb
 var (
 	_ interface {
 		IDStringer
-		ExtractRequestFields(dst map[string]interface{})
+		ExtractRequestFields(dst map[string]any)
 	} = (*GetStoredApplicationUpRequest)(nil)
 	_ interface {
 		IDStringer
-		ExtractRequestFields(dst map[string]interface{})
+		ExtractRequestFields(dst map[string]any)
 	} = (*GetStoredApplicationUpCountRequest)(nil)
 )
 
@@ -75,7 +75,7 @@ func (m *GetStoredApplicationUpRequest) IDString() string {
 }
 
 // ExtractRequestFields is used by github.com/grpc-ecosystem/go-grpc-middleware/tags.
-func (m *GetStoredApplicationUpRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *GetStoredApplicationUpRequest) ExtractRequestFields(dst map[string]any) {
 	if ids := m.GetEndDeviceIds(); ids != nil && !ids.IsZero() {
 		ids.ExtractRequestFields(dst)
 		return
@@ -121,7 +121,7 @@ func (m *GetStoredApplicationUpCountRequest) IDString() string {
 }
 
 // ExtractRequestFields is used by github.com/grpc-ecosystem/go-grpc-middleware/tags.
-func (m *GetStoredApplicationUpCountRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *GetStoredApplicationUpCountRequest) ExtractRequestFields(dst map[string]any) {
 	if ids := m.GetEndDeviceIds(); ids != nil && !ids.IsZero() {
 		ids.ExtractRequestFields(dst)
 		return
diff --git a/pkg/ttnpb/applicationserver_packages.go b/pkg/ttnpb/applicationserver_packages.go
index 855b2db66a..2d0d8a1a53 100644
--- a/pkg/ttnpb/applicationserver_packages.go
+++ b/pkg/ttnpb/applicationserver_packages.go
@@ -100,42 +100,42 @@ func (m *SetApplicationPackageDefaultAssociationRequest) IDString() string {
 
 // All ExtractRequestFields methods are used by github.com/grpc-ecosystem/go-grpc-middleware/tags.
 
-func (m *ApplicationPackageAssociationIdentifiers) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ApplicationPackageAssociationIdentifiers) ExtractRequestFields(dst map[string]any) {
 	m.GetEndDeviceIds().ExtractRequestFields(dst)
 }
 
-func (m *ApplicationPackageAssociation) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ApplicationPackageAssociation) ExtractRequestFields(dst map[string]any) {
 	m.GetIds().ExtractRequestFields(dst)
 }
 
-func (m *GetApplicationPackageAssociationRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *GetApplicationPackageAssociationRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetIds().ExtractRequestFields(dst)
 }
 
-func (m *ListApplicationPackageAssociationRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ListApplicationPackageAssociationRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetIds().ExtractRequestFields(dst)
 }
 
-func (m *SetApplicationPackageAssociationRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *SetApplicationPackageAssociationRequest) ExtractRequestFields(dst map[string]any) {
 	m.Association.ExtractRequestFields(dst)
 }
 
-func (m *ApplicationPackageDefaultAssociationIdentifiers) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ApplicationPackageDefaultAssociationIdentifiers) ExtractRequestFields(dst map[string]any) {
 	m.GetApplicationIds().ExtractRequestFields(dst)
 }
 
-func (m *ApplicationPackageDefaultAssociation) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ApplicationPackageDefaultAssociation) ExtractRequestFields(dst map[string]any) {
 	m.GetIds().ExtractRequestFields(dst)
 }
 
-func (m *GetApplicationPackageDefaultAssociationRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *GetApplicationPackageDefaultAssociationRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetIds().ExtractRequestFields(dst)
 }
 
-func (m *ListApplicationPackageDefaultAssociationRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ListApplicationPackageDefaultAssociationRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetIds().ExtractRequestFields(dst)
 }
 
-func (m *SetApplicationPackageDefaultAssociationRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *SetApplicationPackageDefaultAssociationRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetDefault().ExtractRequestFields(dst)
 }
diff --git a/pkg/ttnpb/applicationserver_pubsub.go b/pkg/ttnpb/applicationserver_pubsub.go
index 78431f46a7..e31be0aed9 100644
--- a/pkg/ttnpb/applicationserver_pubsub.go
+++ b/pkg/ttnpb/applicationserver_pubsub.go
@@ -65,22 +65,22 @@ func (m *SetApplicationPubSubRequest) IDString() string {
 
 // All ExtractRequestFields methods are used by github.com/grpc-ecosystem/go-grpc-middleware/tags.
 
-func (m *ApplicationPubSubIdentifiers) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ApplicationPubSubIdentifiers) ExtractRequestFields(dst map[string]any) {
 	m.GetApplicationIds().ExtractRequestFields(dst)
 }
 
-func (m *ApplicationPubSub) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ApplicationPubSub) ExtractRequestFields(dst map[string]any) {
 	m.GetIds().ExtractRequestFields(dst)
 }
 
-func (m *GetApplicationPubSubRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *GetApplicationPubSubRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetIds().ExtractRequestFields(dst)
 }
 
-func (m *ListApplicationPubSubsRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ListApplicationPubSubsRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetApplicationIds().ExtractRequestFields(dst)
 }
 
-func (m *SetApplicationPubSubRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *SetApplicationPubSubRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetPubsub().ExtractRequestFields(dst)
 }
diff --git a/pkg/ttnpb/applicationserver_web.go b/pkg/ttnpb/applicationserver_web.go
index be04864f37..d93ea08835 100644
--- a/pkg/ttnpb/applicationserver_web.go
+++ b/pkg/ttnpb/applicationserver_web.go
@@ -68,22 +68,22 @@ func (m *SetApplicationWebhookRequest) IDString() string {
 
 // All ExtractRequestFields methods are used by github.com/grpc-ecosystem/go-grpc-middleware/tags.
 
-func (m *ApplicationWebhookIdentifiers) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ApplicationWebhookIdentifiers) ExtractRequestFields(dst map[string]any) {
 	m.GetApplicationIds().ExtractRequestFields(dst)
 }
 
-func (m *ApplicationWebhook) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ApplicationWebhook) ExtractRequestFields(dst map[string]any) {
 	m.GetIds().ExtractRequestFields(dst)
 }
 
-func (m *GetApplicationWebhookRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *GetApplicationWebhookRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetIds().ExtractRequestFields(dst)
 }
 
-func (m *ListApplicationWebhooksRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ListApplicationWebhooksRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetApplicationIds().ExtractRequestFields(dst)
 }
 
-func (m *SetApplicationWebhookRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *SetApplicationWebhookRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetWebhook().ExtractRequestFields(dst)
 }
diff --git a/pkg/ttnpb/client_interfaces.go b/pkg/ttnpb/client_interfaces.go
index fbaac73f52..da90956c44 100644
--- a/pkg/ttnpb/client_interfaces.go
+++ b/pkg/ttnpb/client_interfaces.go
@@ -81,23 +81,23 @@ func (m *SetClientCollaboratorRequest) IDString() string {
 
 // All ExtractRequestFields methods are used by github.com/grpc-ecosystem/go-grpc-middleware/tags.
 
-func (m *Client) ExtractRequestFields(dst map[string]interface{}) {
+func (m *Client) ExtractRequestFields(dst map[string]any) {
 	m.GetIds().ExtractRequestFields(dst)
 }
 
-func (m *GetClientRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *GetClientRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetClientIds().ExtractRequestFields(dst)
 }
 
-func (m *UpdateClientRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *UpdateClientRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetClient().ExtractRequestFields(dst)
 }
 
-func (m *ListClientCollaboratorsRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ListClientCollaboratorsRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetClientIds().ExtractRequestFields(dst)
 }
 
-func (m *GetClientCollaboratorRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *GetClientCollaboratorRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetClientIds().ExtractRequestFields(dst)
 }
 
diff --git a/pkg/ttnpb/end_device.go b/pkg/ttnpb/end_device.go
index c79b74fe40..50b0e77767 100644
--- a/pkg/ttnpb/end_device.go
+++ b/pkg/ttnpb/end_device.go
@@ -2997,35 +2997,35 @@ func (*CreateEndDeviceRequest) RateLimitKey() string {
 
 // All ExtractRequestFields methods are used by github.com/grpc-ecosystem/go-grpc-middleware/tags.
 
-func (m *ResetAndGetEndDeviceRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ResetAndGetEndDeviceRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetEndDeviceIds().ExtractRequestFields(dst)
 }
 
-func (m *CreateEndDeviceRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *CreateEndDeviceRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetEndDevice().ExtractRequestFields(dst)
 }
 
-func (m *UpdateEndDeviceRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *UpdateEndDeviceRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetEndDevice().ExtractRequestFields(dst)
 }
 
-func (m *SetEndDeviceRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *SetEndDeviceRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetEndDevice().ExtractRequestFields(dst)
 }
 
-func (m *EndDeviceTemplate) ExtractRequestFields(dst map[string]interface{}) {
+func (m *EndDeviceTemplate) ExtractRequestFields(dst map[string]any) {
 	m.GetEndDevice().ExtractRequestFields(dst)
 }
 
-func (m *GetEndDeviceRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *GetEndDeviceRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetEndDeviceIds().ExtractRequestFields(dst)
 }
 
-func (m *ListEndDevicesRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ListEndDevicesRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetApplicationIds().ExtractRequestFields(dst)
 }
 
-func (m *EndDevice) ExtractRequestFields(dst map[string]interface{}) {
+func (m *EndDevice) ExtractRequestFields(dst map[string]any) {
 	m.GetIds().ExtractRequestFields(dst)
 }
 
diff --git a/pkg/ttnpb/errors.go b/pkg/ttnpb/errors.go
index 78277458f6..578fd19e32 100644
--- a/pkg/ttnpb/errors.go
+++ b/pkg/ttnpb/errors.go
@@ -35,7 +35,7 @@ func (e errorDetails) Error() string {
 func (e errorDetails) Namespace() string     { return e.GetNamespace() }
 func (e errorDetails) Name() string          { return e.GetName() }
 func (e errorDetails) MessageFormat() string { return e.GetMessageFormat() }
-func (e errorDetails) PublicAttributes() map[string]interface{} {
+func (e errorDetails) PublicAttributes() map[string]any {
 	attributes, err := goproto.Map(e.GetAttributes())
 	if err != nil {
 		panic(fmt.Sprintf("Failed to decode error attributes: %s", err)) // Likely a bug in goproto.
@@ -128,13 +128,13 @@ func init() {
 	}
 }
 
-type valueErr func(interface{}) *errors.Error
+type valueErr func(any) *errors.Error
 
 func unexpectedValue(err interface {
-	WithAttributes(kv ...interface{}) *errors.Error
+	WithAttributes(kv ...any) *errors.Error
 },
 ) valueErr {
-	return func(value interface{}) *errors.Error {
+	return func(value any) *errors.Error {
 		return err.WithAttributes(valueKey, value)
 	}
 }
@@ -148,11 +148,11 @@ var (
 	errInvalidField = errors.DefineInvalidArgument("field", "invalid field `{field}`")
 )
 
-func errExpectedLowerOrEqual(lorawanField string, max interface{}) valueErr {
+func errExpectedLowerOrEqual(lorawanField string, max any) valueErr {
 	return unexpectedValue(errFieldHasMax.WithAttributes("field", lorawanField, "max", max))
 }
 
-func errExpectedBetween(lorawanField string, min, max interface{}) valueErr {
+func errExpectedBetween(lorawanField string, min, max any) valueErr {
 	return unexpectedValue(errFieldBound.WithAttributes("field", lorawanField, "min", min, "max", max))
 }
 
diff --git a/pkg/ttnpb/fieldmask_utils.go b/pkg/ttnpb/fieldmask_utils.go
index 7bcd376c74..95c6cc381c 100644
--- a/pkg/ttnpb/fieldmask_utils.go
+++ b/pkg/ttnpb/fieldmask_utils.go
@@ -15,6 +15,7 @@
 package ttnpb
 
 import (
+	"slices"
 	"strings"
 
 	"go.thethings.network/lorawan-stack/v3/pkg/errors"
@@ -158,12 +159,7 @@ func ProhibitFields(requested []string, search ...string) error {
 
 // ContainsField returns true if the given paths contains the field path.
 func ContainsField(path string, allowedPaths []string) bool {
-	for _, allowedPath := range allowedPaths {
-		if path == allowedPath {
-			return true
-		}
-	}
-	return false
+	return slices.Contains(allowedPaths, path)
 }
 
 // AllowedFields returns the paths from the given paths that are in the allowed paths.
diff --git a/pkg/ttnpb/gateway_interfaces.go b/pkg/ttnpb/gateway_interfaces.go
index fda0441298..78b953c4f9 100644
--- a/pkg/ttnpb/gateway_interfaces.go
+++ b/pkg/ttnpb/gateway_interfaces.go
@@ -113,39 +113,39 @@ func (m *SetGatewayCollaboratorRequest) IDString() string {
 
 // All ExtractRequestFields methods are used by github.com/grpc-ecosystem/go-grpc-middleware/tags.
 
-func (m *Gateway) ExtractRequestFields(dst map[string]interface{}) {
+func (m *Gateway) ExtractRequestFields(dst map[string]any) {
 	m.GetIds().ExtractRequestFields(dst)
 }
 
-func (m *GetGatewayRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *GetGatewayRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetGatewayIds().ExtractRequestFields(dst)
 }
 
-func (m *UpdateGatewayRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *UpdateGatewayRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetGateway().ExtractRequestFields(dst)
 }
 
-func (m *ListGatewayAPIKeysRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ListGatewayAPIKeysRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetGatewayIds().ExtractRequestFields(dst)
 }
 
-func (m *GetGatewayAPIKeyRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *GetGatewayAPIKeyRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetGatewayIds().ExtractRequestFields(dst)
 }
 
-func (m *CreateGatewayAPIKeyRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *CreateGatewayAPIKeyRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetGatewayIds().ExtractRequestFields(dst)
 }
 
-func (m *UpdateGatewayAPIKeyRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *UpdateGatewayAPIKeyRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetGatewayIds().ExtractRequestFields(dst)
 }
 
-func (m *ListGatewayCollaboratorsRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ListGatewayCollaboratorsRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetGatewayIds().ExtractRequestFields(dst)
 }
 
-func (m *GetGatewayCollaboratorRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *GetGatewayCollaboratorRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetGatewayIds().ExtractRequestFields(dst)
 }
 
diff --git a/pkg/ttnpb/keys.go b/pkg/ttnpb/keys.go
index 49561039ec..04c6821f1e 100644
--- a/pkg/ttnpb/keys.go
+++ b/pkg/ttnpb/keys.go
@@ -95,7 +95,7 @@ func (v *KeyEnvelope) DecodeMsgpack(dec *msgpack.Decoder) error {
 		return err
 	}
 	v.Reset()
-	for i := 0; i < n; i++ {
+	for range n {
 		s, err := dec.DecodeString()
 		if err != nil {
 			return err
diff --git a/pkg/ttnpb/logfields.go b/pkg/ttnpb/logfields.go
index ea3497ed34..b783dbc758 100644
--- a/pkg/ttnpb/logfields.go
+++ b/pkg/ttnpb/logfields.go
@@ -14,21 +14,21 @@
 
 package ttnpb
 
-func (ids *ApplicationIdentifiers) ExtractRequestFields(m map[string]interface{}) {
+func (ids *ApplicationIdentifiers) ExtractRequestFields(m map[string]any) {
 	if ids == nil {
 		return
 	}
 	m["application_id"] = ids.ApplicationId
 }
 
-func (ids *ClientIdentifiers) ExtractRequestFields(m map[string]interface{}) {
+func (ids *ClientIdentifiers) ExtractRequestFields(m map[string]any) {
 	if ids == nil {
 		return
 	}
 	m["client_id"] = ids.ClientId
 }
 
-func (ids *EndDeviceIdentifiers) ExtractRequestFields(m map[string]interface{}) {
+func (ids *EndDeviceIdentifiers) ExtractRequestFields(m map[string]any) {
 	if ids == nil {
 		return
 	}
@@ -36,28 +36,28 @@ func (ids *EndDeviceIdentifiers) ExtractRequestFields(m map[string]interface{})
 	m["device_id"] = ids.DeviceId
 }
 
-func (ids *GatewayIdentifiers) ExtractRequestFields(m map[string]interface{}) {
+func (ids *GatewayIdentifiers) ExtractRequestFields(m map[string]any) {
 	if ids == nil {
 		return
 	}
 	m["gateway_id"] = ids.GatewayId
 }
 
-func (ids *OrganizationIdentifiers) ExtractRequestFields(m map[string]interface{}) {
+func (ids *OrganizationIdentifiers) ExtractRequestFields(m map[string]any) {
 	if ids == nil {
 		return
 	}
 	m["organization_id"] = ids.OrganizationId
 }
 
-func (ids *UserIdentifiers) ExtractRequestFields(m map[string]interface{}) {
+func (ids *UserIdentifiers) ExtractRequestFields(m map[string]any) {
 	if ids == nil {
 		return
 	}
 	m["user_id"] = ids.UserId
 }
 
-func extractCollaboratorFields(m map[string]interface{}, ids *OrganizationOrUserIdentifiers) {
+func extractCollaboratorFields(m map[string]any, ids *OrganizationOrUserIdentifiers) {
 	if ids == nil {
 		return
 	}
@@ -72,7 +72,7 @@ func extractCollaboratorFields(m map[string]interface{}, ids *OrganizationOrUser
 	}
 }
 
-func (req *CreateApplicationRequest) ExtractRequestFields(m map[string]interface{}) {
+func (req *CreateApplicationRequest) ExtractRequestFields(m map[string]any) {
 	if req == nil {
 		return
 	}
@@ -80,7 +80,7 @@ func (req *CreateApplicationRequest) ExtractRequestFields(m map[string]interface
 	extractCollaboratorFields(m, req.GetCollaborator())
 }
 
-func (req *CreateClientRequest) ExtractRequestFields(m map[string]interface{}) {
+func (req *CreateClientRequest) ExtractRequestFields(m map[string]any) {
 	if req == nil {
 		return
 	}
@@ -88,7 +88,7 @@ func (req *CreateClientRequest) ExtractRequestFields(m map[string]interface{}) {
 	extractCollaboratorFields(m, req.GetCollaborator())
 }
 
-func (req *CreateGatewayRequest) ExtractRequestFields(m map[string]interface{}) {
+func (req *CreateGatewayRequest) ExtractRequestFields(m map[string]any) {
 	if req == nil {
 		return
 	}
@@ -96,7 +96,7 @@ func (req *CreateGatewayRequest) ExtractRequestFields(m map[string]interface{})
 	extractCollaboratorFields(m, req.GetCollaborator())
 }
 
-func (req *CreateOrganizationRequest) ExtractRequestFields(m map[string]interface{}) {
+func (req *CreateOrganizationRequest) ExtractRequestFields(m map[string]any) {
 	if req == nil {
 		return
 	}
@@ -104,7 +104,7 @@ func (req *CreateOrganizationRequest) ExtractRequestFields(m map[string]interfac
 	extractCollaboratorFields(m, req.GetCollaborator())
 }
 
-func (req *SetApplicationCollaboratorRequest) ExtractRequestFields(m map[string]interface{}) {
+func (req *SetApplicationCollaboratorRequest) ExtractRequestFields(m map[string]any) {
 	if req == nil {
 		return
 	}
@@ -112,7 +112,7 @@ func (req *SetApplicationCollaboratorRequest) ExtractRequestFields(m map[string]
 	extractCollaboratorFields(m, req.GetCollaborator().GetIds())
 }
 
-func (req *SetClientCollaboratorRequest) ExtractRequestFields(m map[string]interface{}) {
+func (req *SetClientCollaboratorRequest) ExtractRequestFields(m map[string]any) {
 	if req == nil {
 		return
 	}
@@ -120,7 +120,7 @@ func (req *SetClientCollaboratorRequest) ExtractRequestFields(m map[string]inter
 	extractCollaboratorFields(m, req.GetCollaborator().GetIds())
 }
 
-func (req *SetGatewayCollaboratorRequest) ExtractRequestFields(m map[string]interface{}) {
+func (req *SetGatewayCollaboratorRequest) ExtractRequestFields(m map[string]any) {
 	if req == nil {
 		return
 	}
@@ -128,7 +128,7 @@ func (req *SetGatewayCollaboratorRequest) ExtractRequestFields(m map[string]inte
 	extractCollaboratorFields(m, req.GetCollaborator().GetIds())
 }
 
-func (req *SetOrganizationCollaboratorRequest) ExtractRequestFields(m map[string]interface{}) {
+func (req *SetOrganizationCollaboratorRequest) ExtractRequestFields(m map[string]any) {
 	if req == nil {
 		return
 	}
diff --git a/pkg/ttnpb/lorawan_interfaces.go b/pkg/ttnpb/lorawan_interfaces.go
index d87f937c81..d3e4bef554 100644
--- a/pkg/ttnpb/lorawan_interfaces.go
+++ b/pkg/ttnpb/lorawan_interfaces.go
@@ -36,10 +36,10 @@ func (m *UplinkToken) IDString() string {
 
 // All ExtractRequestFields methods are used by github.com/grpc-ecosystem/go-grpc-middleware/tags.
 
-func (m *GatewayAntennaIdentifiers) ExtractRequestFields(dst map[string]interface{}) {
+func (m *GatewayAntennaIdentifiers) ExtractRequestFields(dst map[string]any) {
 	m.GetGatewayIds().ExtractRequestFields(dst)
 }
 
-func (m *UplinkToken) ExtractRequestFields(dst map[string]interface{}) {
+func (m *UplinkToken) ExtractRequestFields(dst map[string]any) {
 	m.GetIds().ExtractRequestFields(dst)
 }
diff --git a/pkg/ttnpb/oauth.go b/pkg/ttnpb/oauth.go
index 2773da524d..3a474072ed 100644
--- a/pkg/ttnpb/oauth.go
+++ b/pkg/ttnpb/oauth.go
@@ -76,30 +76,30 @@ func (m *ListOAuthAccessTokensRequest) IDString() string {
 
 // All ExtractRequestFields methods are used by github.com/grpc-ecosystem/go-grpc-middleware/tags.
 
-func (m *OAuthClientAuthorizationIdentifiers) ExtractRequestFields(dst map[string]interface{}) {
+func (m *OAuthClientAuthorizationIdentifiers) ExtractRequestFields(dst map[string]any) {
 	m.GetUserIds().ExtractRequestFields(dst)
 }
 
-func (m *OAuthClientAuthorization) ExtractRequestFields(dst map[string]interface{}) {
+func (m *OAuthClientAuthorization) ExtractRequestFields(dst map[string]any) {
 	m.GetUserIds().ExtractRequestFields(dst)
 }
 
-func (m *ListOAuthClientAuthorizationsRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ListOAuthClientAuthorizationsRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetUserIds().ExtractRequestFields(dst)
 }
 
-func (m *OAuthAuthorizationCode) ExtractRequestFields(dst map[string]interface{}) {
+func (m *OAuthAuthorizationCode) ExtractRequestFields(dst map[string]any) {
 	m.GetUserIds().ExtractRequestFields(dst)
 }
 
-func (m *OAuthAccessTokenIdentifiers) ExtractRequestFields(dst map[string]interface{}) {
+func (m *OAuthAccessTokenIdentifiers) ExtractRequestFields(dst map[string]any) {
 	m.GetUserIds().ExtractRequestFields(dst)
 }
 
-func (m *OAuthAccessToken) ExtractRequestFields(dst map[string]interface{}) {
+func (m *OAuthAccessToken) ExtractRequestFields(dst map[string]any) {
 	m.GetUserIds().ExtractRequestFields(dst)
 }
 
-func (m *ListOAuthAccessTokensRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ListOAuthAccessTokensRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetUserIds().ExtractRequestFields(dst)
 }
diff --git a/pkg/ttnpb/organization_interfaces.go b/pkg/ttnpb/organization_interfaces.go
index dbd1df23ec..548aaad659 100644
--- a/pkg/ttnpb/organization_interfaces.go
+++ b/pkg/ttnpb/organization_interfaces.go
@@ -113,39 +113,39 @@ func (m *SetOrganizationCollaboratorRequest) IDString() string {
 
 // All ExtractRequestFields methods are used by github.com/grpc-ecosystem/go-grpc-middleware/tags.
 
-func (m *Organization) ExtractRequestFields(dst map[string]interface{}) {
+func (m *Organization) ExtractRequestFields(dst map[string]any) {
 	m.GetIds().ExtractRequestFields(dst)
 }
 
-func (m *GetOrganizationRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *GetOrganizationRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetOrganizationIds().ExtractRequestFields(dst)
 }
 
-func (m *UpdateOrganizationRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *UpdateOrganizationRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetOrganization().GetIds().ExtractRequestFields(dst)
 }
 
-func (m *ListOrganizationAPIKeysRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ListOrganizationAPIKeysRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetOrganizationIds().ExtractRequestFields(dst)
 }
 
-func (m *GetOrganizationAPIKeyRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *GetOrganizationAPIKeyRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetOrganizationIds().ExtractRequestFields(dst)
 }
 
-func (m *CreateOrganizationAPIKeyRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *CreateOrganizationAPIKeyRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetOrganizationIds().ExtractRequestFields(dst)
 }
 
-func (m *UpdateOrganizationAPIKeyRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *UpdateOrganizationAPIKeyRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetOrganizationIds().ExtractRequestFields(dst)
 }
 
-func (m *ListOrganizationCollaboratorsRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ListOrganizationCollaboratorsRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetOrganizationIds().ExtractRequestFields(dst)
 }
 
-func (m *GetOrganizationCollaboratorRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *GetOrganizationCollaboratorRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetOrganizationIds().ExtractRequestFields(dst)
 }
 
diff --git a/pkg/ttnpb/search_services_interfaces.go b/pkg/ttnpb/search_services_interfaces.go
index 2da5896311..7ec66dac66 100644
--- a/pkg/ttnpb/search_services_interfaces.go
+++ b/pkg/ttnpb/search_services_interfaces.go
@@ -25,6 +25,6 @@ func (m *SearchEndDevicesRequest) IDString() string {
 }
 
 // ExtractRequestFields is used by github.com/grpc-ecosystem/go-grpc-middleware/tags.
-func (m *SearchEndDevicesRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *SearchEndDevicesRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetApplicationIds().ExtractRequestFields(dst)
 }
diff --git a/pkg/ttnpb/ttnpb_encoding_test.go b/pkg/ttnpb/ttnpb_encoding_test.go
index 0e1a244f37..409cc13774 100644
--- a/pkg/ttnpb/ttnpb_encoding_test.go
+++ b/pkg/ttnpb/ttnpb_encoding_test.go
@@ -42,44 +42,44 @@ func TestMarshalers(t *testing.T) {
 		}
 	}()
 
-	var vals [][]interface{}
+	var vals [][]any
 
-	vals = append(vals, []interface{}{
+	vals = append(vals, []any{
 		&BoolValue{},
 		&BoolValue{Value: true},
 	})
 
-	var mTypes []interface{}
+	var mTypes []any
 	for i := range MType_name {
 		mTypes = append(mTypes, MType(i))
 	}
 	vals = append(vals, mTypes)
 
-	var majors []interface{}
+	var majors []any
 	for i := range Major_name {
 		majors = append(majors, Major(i))
 	}
 	vals = append(vals, majors)
 
-	var macVers []interface{}
+	var macVers []any
 	for i := range MACVersion_name {
 		macVers = append(macVers, MACVersion(i))
 	}
 	vals = append(vals, macVers)
 
-	var phyVers []interface{}
+	var phyVers []any
 	for i := range PHYVersion_name {
 		phyVers = append(phyVers, PHYVersion(i))
 	}
 	vals = append(vals, phyVers)
 
-	var drIdxs []interface{}
+	var drIdxs []any
 	for i := range DataRateIndex_name {
 		drIdxs = append(drIdxs, DataRateIndex(i))
 	}
 	vals = append(vals, drIdxs)
 
-	var drIdxVals []interface{}
+	var drIdxVals []any
 	for i := range DataRateIndex_name {
 		drIdxVals = append(drIdxVals, &DataRateIndexValue{
 			Value: DataRateIndex(i),
@@ -87,13 +87,13 @@ func TestMarshalers(t *testing.T) {
 	}
 	vals = append(vals, drIdxVals)
 
-	var drOffsets []interface{}
+	var drOffsets []any
 	for i := range DataRateOffset_name {
 		drOffsets = append(drOffsets, DataRateOffset(i))
 	}
 	vals = append(vals, drOffsets)
 
-	var drOffsetVals []interface{}
+	var drOffsetVals []any
 	for i := range DataRateOffset_name {
 		drOffsetVals = append(drOffsetVals, &DataRateOffsetValue{
 			Value: DataRateOffset(i),
@@ -101,62 +101,62 @@ func TestMarshalers(t *testing.T) {
 	}
 	vals = append(vals, drOffsetVals)
 
-	vals = append(vals, []interface{}{
+	vals = append(vals, []any{
 		&FrequencyValue{Value: 100000},
 		&FrequencyValue{Value: 2000000},
 		&FrequencyValue{Value: 30000000},
 	})
 
-	vals = append(vals, []interface{}{
+	vals = append(vals, []any{
 		&ZeroableFrequencyValue{Value: 0},
 		&ZeroableFrequencyValue{Value: 100000},
 		&ZeroableFrequencyValue{Value: 2000000},
 		&ZeroableFrequencyValue{Value: 30000000},
 	})
 
-	var joinRequestTypes []interface{}
+	var joinRequestTypes []any
 	for i := range JoinRequestType_name {
 		joinRequestTypes = append(joinRequestTypes, JoinRequestType(i))
 	}
 	vals = append(vals, joinRequestTypes)
 
-	var rejoinRequestTypes []interface{}
+	var rejoinRequestTypes []any
 	for i := range RejoinRequestType_name {
 		rejoinRequestTypes = append(rejoinRequestTypes, RejoinRequestType(i))
 	}
 	vals = append(vals, rejoinRequestTypes)
 
-	var cfLists []interface{}
+	var cfLists []any
 	for i := range CFListType_name {
 		cfLists = append(cfLists, CFListType(i))
 	}
 	vals = append(vals, cfLists)
 
-	var classes []interface{}
+	var classes []any
 	for i := range Class_name {
 		classes = append(classes, Class(i))
 	}
 	vals = append(vals, classes)
 
-	var txSchedulePrios []interface{}
+	var txSchedulePrios []any
 	for i := range TxSchedulePriority_name {
 		txSchedulePrios = append(txSchedulePrios, TxSchedulePriority(i))
 	}
 	vals = append(vals, txSchedulePrios)
 
-	var cids []interface{}
+	var cids []any
 	for i := range MACCommandIdentifier_name {
 		cids = append(cids, MACCommandIdentifier(i))
 	}
 	vals = append(vals, cids)
 
-	var dutyCycles []interface{}
+	var dutyCycles []any
 	for i := range AggregatedDutyCycle_name {
 		dutyCycles = append(dutyCycles, AggregatedDutyCycle(i))
 	}
 	vals = append(vals, dutyCycles)
 
-	var dutyCycleVals []interface{}
+	var dutyCycleVals []any
 	for i := range AggregatedDutyCycle_name {
 		dutyCycleVals = append(dutyCycleVals, &AggregatedDutyCycleValue{
 			Value: AggregatedDutyCycle(i),
@@ -164,13 +164,13 @@ func TestMarshalers(t *testing.T) {
 	}
 	vals = append(vals, dutyCycleVals)
 
-	var pingSlots []interface{}
+	var pingSlots []any
 	for i := range PingSlotPeriod_name {
 		pingSlots = append(pingSlots, PingSlotPeriod(i))
 	}
 	vals = append(vals, pingSlots)
 
-	var pingSlotVals []interface{}
+	var pingSlotVals []any
 	for i := range PingSlotPeriod_name {
 		pingSlotVals = append(pingSlotVals, &PingSlotPeriodValue{
 			Value: PingSlotPeriod(i),
@@ -178,31 +178,31 @@ func TestMarshalers(t *testing.T) {
 	}
 	vals = append(vals, pingSlotVals)
 
-	var rejoinCounts []interface{}
+	var rejoinCounts []any
 	for i := range RejoinCountExponent_name {
 		rejoinCounts = append(rejoinCounts, RejoinCountExponent(i))
 	}
 	vals = append(vals, rejoinCounts)
 
-	var rejoinTimes []interface{}
+	var rejoinTimes []any
 	for i := range RejoinTimeExponent_name {
 		rejoinTimes = append(rejoinTimes, RejoinTimeExponent(i))
 	}
 	vals = append(vals, rejoinTimes)
 
-	var rejoinPeriods []interface{}
+	var rejoinPeriods []any
 	for i := range RejoinPeriodExponent_name {
 		rejoinPeriods = append(rejoinPeriods, RejoinPeriodExponent(i))
 	}
 	vals = append(vals, rejoinPeriods)
 
-	var deviceEIRPs []interface{}
+	var deviceEIRPs []any
 	for i := range DeviceEIRP_name {
 		deviceEIRPs = append(deviceEIRPs, DeviceEIRP(i))
 	}
 	vals = append(vals, deviceEIRPs)
 
-	var deviceEIRPVals []interface{}
+	var deviceEIRPVals []any
 	for i := range DeviceEIRP_name {
 		deviceEIRPVals = append(deviceEIRPVals, &DeviceEIRPValue{
 			Value: DeviceEIRP(i),
@@ -210,13 +210,13 @@ func TestMarshalers(t *testing.T) {
 	}
 	vals = append(vals, deviceEIRPVals)
 
-	var ackLimitExponents []interface{}
+	var ackLimitExponents []any
 	for i := range ADRAckLimitExponent_name {
 		ackLimitExponents = append(ackLimitExponents, ADRAckLimitExponent(i))
 	}
 	vals = append(vals, ackLimitExponents)
 
-	var ackLimitExponentVals []interface{}
+	var ackLimitExponentVals []any
 	for i := range ADRAckLimitExponent_name {
 		ackLimitExponentVals = append(ackLimitExponentVals, &ADRAckLimitExponentValue{
 			Value: ADRAckLimitExponent(i),
@@ -224,13 +224,13 @@ func TestMarshalers(t *testing.T) {
 	}
 	vals = append(vals, ackLimitExponentVals)
 
-	var ackDelayExponents []interface{}
+	var ackDelayExponents []any
 	for i := range ADRAckDelayExponent_name {
 		ackDelayExponents = append(ackDelayExponents, ADRAckDelayExponent(i))
 	}
 	vals = append(vals, ackDelayExponents)
 
-	var ackDelayExponentVals []interface{}
+	var ackDelayExponentVals []any
 	for i := range ADRAckDelayExponent_name {
 		ackDelayExponentVals = append(ackDelayExponentVals, &ADRAckDelayExponentValue{
 			Value: ADRAckDelayExponent(i),
@@ -238,13 +238,13 @@ func TestMarshalers(t *testing.T) {
 	}
 	vals = append(vals, ackDelayExponentVals)
 
-	var rxDelays []interface{}
+	var rxDelays []any
 	for i := range RxDelay_name {
 		rxDelays = append(rxDelays, RxDelay(i))
 	}
 	vals = append(vals, rxDelays)
 
-	var rxDelayVals []interface{}
+	var rxDelayVals []any
 	for i := range RxDelay_name {
 		rxDelayVals = append(rxDelayVals, &RxDelayValue{
 			Value: RxDelay(i),
@@ -252,43 +252,43 @@ func TestMarshalers(t *testing.T) {
 	}
 	vals = append(vals, rxDelayVals)
 
-	var minors []interface{}
+	var minors []any
 	for i := range Minor_name {
 		minors = append(minors, Minor(i))
 	}
 	vals = append(vals, minors)
 
-	var grants []interface{}
+	var grants []any
 	for i := range GrantType_name {
 		grants = append(grants, GrantType(i))
 	}
 	vals = append(vals, grants)
 
-	var clusterRoles []interface{}
+	var clusterRoles []any
 	for i := range ClusterRole_name {
 		clusterRoles = append(clusterRoles, ClusterRole(i))
 	}
 	vals = append(vals, clusterRoles)
 
-	var states []interface{}
+	var states []any
 	for i := range State_name {
 		states = append(states, State(i))
 	}
 	vals = append(vals, states)
 
-	var locationSources []interface{}
+	var locationSources []any
 	for i := range LocationSource_name {
 		locationSources = append(locationSources, LocationSource(i))
 	}
 	vals = append(vals, locationSources)
 
-	var rights []interface{}
+	var rights []any
 	for i := range Right_name {
 		rights = append(rights, Right(i))
 	}
 	vals = append(vals, rights)
 
-	var gatewayAntennaPlacements []interface{}
+	var gatewayAntennaPlacements []any
 	for i := range GatewayAntennaPlacement_name {
 		gatewayAntennaPlacements = append(gatewayAntennaPlacements, GatewayAntennaPlacement(i))
 	}
@@ -301,7 +301,7 @@ func TestMarshalers(t *testing.T) {
 		if typ.Kind() == reflect.Pointer {
 			typName = typ.Elem().String()
 		}
-		newV := func() interface{} {
+		newV := func() any {
 			if typ.Kind() == reflect.Pointer {
 				return reflect.New(typ.Elem()).Interface()
 			}
diff --git a/pkg/ttnpb/udp/translation.go b/pkg/ttnpb/udp/translation.go
index d2eb31120b..92b66eba02 100644
--- a/pkg/ttnpb/udp/translation.go
+++ b/pkg/ttnpb/udp/translation.go
@@ -16,6 +16,7 @@ package udp
 
 import (
 	"encoding/base64"
+	"maps"
 	"strconv"
 	"strings"
 	"time"
@@ -300,9 +301,7 @@ func convertStatus(stat Stat, md UpstreamMetadata) *ttnpb.GatewayStatus {
 	}
 
 	addVersions(status, stat)
-	for versionName, version := range ttnVersions {
-		status.Versions[versionName] = version
-	}
+	maps.Copy(status.Versions, ttnVersions)
 	addMetrics(status, stat)
 	return status
 }
diff --git a/pkg/ttnpb/user_interfaces.go b/pkg/ttnpb/user_interfaces.go
index 91f8a9a578..0b71cc3f8a 100644
--- a/pkg/ttnpb/user_interfaces.go
+++ b/pkg/ttnpb/user_interfaces.go
@@ -147,59 +147,59 @@ func (m *CreateLoginTokenRequest) IDString() string {
 
 // All ExtractRequestFields methods are used by github.com/grpc-ecosystem/go-grpc-middleware/tags.
 
-func (m *GetUserRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *GetUserRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetUserIds().ExtractRequestFields(dst)
 }
 
-func (m *CreateUserRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *CreateUserRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetUser().GetIds().ExtractRequestFields(dst)
 }
 
-func (m *UpdateUserRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *UpdateUserRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetUser().GetIds().ExtractRequestFields(dst)
 }
 
-func (m *CreateTemporaryPasswordRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *CreateTemporaryPasswordRequest) ExtractRequestFields(dst map[string]any) {
 	m.UserIds.ExtractRequestFields(dst)
 }
 
-func (m *UpdateUserPasswordRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *UpdateUserPasswordRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetUserIds().ExtractRequestFields(dst)
 }
 
-func (m *ListUserAPIKeysRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ListUserAPIKeysRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetUserIds().ExtractRequestFields(dst)
 }
 
-func (m *GetUserAPIKeyRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *GetUserAPIKeyRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetUserIds().ExtractRequestFields(dst)
 }
 
-func (m *CreateUserAPIKeyRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *CreateUserAPIKeyRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetUserIds().ExtractRequestFields(dst)
 }
 
-func (m *UpdateUserAPIKeyRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *UpdateUserAPIKeyRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetUserIds().ExtractRequestFields(dst)
 }
 
-func (m *UserSessionIdentifiers) ExtractRequestFields(dst map[string]interface{}) {
+func (m *UserSessionIdentifiers) ExtractRequestFields(dst map[string]any) {
 	m.GetUserIds().ExtractRequestFields(dst)
 }
 
-func (m *UserSession) ExtractRequestFields(dst map[string]interface{}) {
+func (m *UserSession) ExtractRequestFields(dst map[string]any) {
 	m.GetUserIds().ExtractRequestFields(dst)
 }
 
-func (m *ListUserSessionsRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *ListUserSessionsRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetUserIds().ExtractRequestFields(dst)
 }
 
-func (m *LoginToken) ExtractRequestFields(dst map[string]interface{}) {
+func (m *LoginToken) ExtractRequestFields(dst map[string]any) {
 	m.GetUserIds().ExtractRequestFields(dst)
 }
 
-func (m *CreateLoginTokenRequest) ExtractRequestFields(dst map[string]interface{}) {
+func (m *CreateLoginTokenRequest) ExtractRequestFields(dst map[string]any) {
 	m.GetUserIds().ExtractRequestFields(dst)
 }
 
diff --git a/pkg/types/devaddr.go b/pkg/types/devaddr.go
index f8f20025f5..53195a5477 100644
--- a/pkg/types/devaddr.go
+++ b/pkg/types/devaddr.go
@@ -393,7 +393,7 @@ func (prefix *DevAddrPrefix) Unmarshal(data []byte) error { return prefix.Unmars
 // MarshalJSON implements the json.Marshaler interface.
 func (prefix DevAddrPrefix) MarshalJSON() ([]byte, error) {
 	str := append([]byte(`"`+hex.EncodeToString(prefix.DevAddr[:])), '/')
-	str = append(str, []byte(fmt.Sprintf("%d", prefix.Length))...)
+	str = append(str, fmt.Appendf(nil, "%d", prefix.Length)...)
 	return append(str, '"'), nil
 }
 
@@ -525,7 +525,7 @@ func UnmarshalDevAddrPrefixSlice(s *jsonplugin.UnmarshalState) [][]byte {
 // WithPrefix returns the DevAddr, but with the first length bits replaced by the Prefix.
 func (addr DevAddr) WithPrefix(prefix DevAddrPrefix) (prefixed DevAddr) {
 	k := uint(prefix.Length)
-	for i := 0; i < 4; i++ {
+	for i := range 4 {
 		if k >= 8 {
 			prefixed[i] = prefix.DevAddr[i] & 0xff
 			k -= 8
diff --git a/pkg/types/eui.go b/pkg/types/eui.go
index 0c04ab8be5..e6becc8948 100644
--- a/pkg/types/eui.go
+++ b/pkg/types/eui.go
@@ -345,7 +345,7 @@ func (prefix EUI64Prefix) ConfigString() string {
 // WithPrefix returns the EUI64, but with the first length bits replaced by the Prefix.
 func (eui EUI64) WithPrefix(prefix EUI64Prefix) (prefixed EUI64) {
 	k := uint(prefix.Length)
-	for i := 0; i < 8; i++ {
+	for i := range 8 {
 		if k < 8 {
 			prefixed[i] = (prefix.EUI64[i] & ^byte(0xff>>k)) | (eui[i] & byte(0xff>>k))
 			return
diff --git a/pkg/unique/unique.go b/pkg/unique/unique.go
index 20e6d52fc9..8419160da3 100644
--- a/pkg/unique/unique.go
+++ b/pkg/unique/unique.go
@@ -72,14 +72,14 @@ func ToClientID(uid string) (id *ttnpb.ClientIdentifiers, err error) {
 // ToDeviceID returns the end device identifier of the specified unique ID.
 func ToDeviceID(uid string) (id *ttnpb.EndDeviceIdentifiers, err error) {
 	id = &ttnpb.EndDeviceIdentifiers{}
-	sepIdx := strings.Index(uid, ".")
-	if sepIdx == -1 {
+	before, after, ok := strings.Cut(uid, ".")
+	if !ok {
 		return nil, errFormat.WithAttributes("value", uid)
 	}
 	id.ApplicationIds = &ttnpb.ApplicationIdentifiers{
-		ApplicationId: uid[:sepIdx],
+		ApplicationId: before,
 	}
-	id.DeviceId = uid[sepIdx+1:]
+	id.DeviceId = after
 	if err := id.ValidateFields("device_id", "application_ids"); err != nil {
 		return nil, errUniqueIdentifier.WithCause(err).WithAttributes("uid", uid)
 	}
diff --git a/pkg/util/store/conncheck_other.go b/pkg/util/store/conncheck_other.go
index 05ddd6fdf0..ee774c9d03 100644
--- a/pkg/util/store/conncheck_other.go
+++ b/pkg/util/store/conncheck_other.go
@@ -13,7 +13,6 @@
 // limitations under the License.
 
 //go:build !linux && !darwin
-// +build !linux,!darwin
 
 package store
 
diff --git a/pkg/util/store/conncheck_unix.go b/pkg/util/store/conncheck_unix.go
index 45c75367f4..2391dc701f 100644
--- a/pkg/util/store/conncheck_unix.go
+++ b/pkg/util/store/conncheck_unix.go
@@ -13,7 +13,6 @@
 // limitations under the License.
 
 //go:build linux || darwin
-// +build linux darwin
 
 package store
 
diff --git a/pkg/util/test/assertions/context.go b/pkg/util/test/assertions/context.go
index c99e9ce1c8..8459b153d1 100644
--- a/pkg/util/test/assertions/context.go
+++ b/pkg/util/test/assertions/context.go
@@ -27,13 +27,13 @@ const (
 	shouldHaveParentContext = "Expected context to have parent '%v' (but it didn't)!"
 )
 
-var contextType = reflect.TypeOf((*context.Context)(nil)).Elem()
+var contextType = reflect.TypeFor[context.Context]()
 
 // contextParent returns the parent context of ctx and true if one is found, nil and false otherwise.
 // contextParent assumes that ctx has a parent iff it's located at field named Context.
 func contextParent(ctx context.Context) (context.Context, bool) {
 	rv := reflect.ValueOf(ctx)
-	for rv.Kind() == reflect.Ptr {
+	for rv.Kind() == reflect.Pointer {
 		rv = rv.Elem()
 	}
 	if !rv.IsValid() {
@@ -60,7 +60,7 @@ func contextParent(ctx context.Context) (context.Context, bool) {
 	}
 
 	fv := rv.FieldByName("Context")
-	if (fv.Kind() == reflect.Ptr || fv.Kind() == reflect.Interface) && fv.IsNil() {
+	if (fv.Kind() == reflect.Pointer || fv.Kind() == reflect.Interface) && fv.IsNil() {
 		return nil, true
 	}
 	return fv.Interface().(context.Context), true
diff --git a/pkg/util/test/assertions/resemble.go b/pkg/util/test/assertions/resemble.go
index 9ddd545d61..42433f6263 100644
--- a/pkg/util/test/assertions/resemble.go
+++ b/pkg/util/test/assertions/resemble.go
@@ -66,7 +66,7 @@ func ShouldResembleFields(actual any, expected ...any) (message string) {
 		return fmt.Sprintf(needAtLeastValues, 1, len(expected))
 	}
 
-	ps := reflect.MakeSlice(reflect.TypeOf([]string{}), 0, 0)
+	ps := reflect.MakeSlice(reflect.TypeFor[[]string](), 0, 0)
 	for _, p := range expected[1:] {
 		pv := reflect.ValueOf(p)
 		switch pv.Kind() {
@@ -90,7 +90,7 @@ func ShouldResembleFields(actual any, expected ...any) (message string) {
 	}
 	selectFields := func(v any) (any, string) {
 		t := reflect.TypeOf(v)
-		if t.Kind() != reflect.Ptr {
+		if t.Kind() != reflect.Pointer {
 			return nil, fmt.Sprintf(needPointer, v)
 		}
 		sv := reflect.New(t.Elem())
diff --git a/pkg/util/test/events.go b/pkg/util/test/events.go
index f2e42f2590..0f2dd50fab 100644
--- a/pkg/util/test/events.go
+++ b/pkg/util/test/events.go
@@ -92,7 +92,7 @@ func AssertEventPubSubPublishRequests(ctx context.Context, reqCh <-chan EventPub
 	t.Helper()
 
 	var evs []events.Event
-	for i := 0; i < n; i++ {
+	for i := range n {
 		if !AssertEventPubSubPublishRequest(ctx, reqCh, func(ev events.Event) bool {
 			t.Logf("Received event number %d out of %d expected: %v", i+1, n, ev)
 			evs = append(evs, ev)
diff --git a/pkg/util/test/generate_constructors.go b/pkg/util/test/generate_constructors.go
index 7efdbfd65a..c6acc9d724 100644
--- a/pkg/util/test/generate_constructors.go
+++ b/pkg/util/test/generate_constructors.go
@@ -13,7 +13,6 @@
 // limitations under the License.
 
 //go:build ignore
-// +build ignore
 
 package main
 
diff --git a/pkg/util/test/redis.go b/pkg/util/test/redis.go
index 54464b4906..fdb72204e3 100644
--- a/pkg/util/test/redis.go
+++ b/pkg/util/test/redis.go
@@ -73,11 +73,12 @@ func (h redisHook) ProcessPipelineHook(hook redis.ProcessPipelineHook) redis.Pro
 		if len(cmds) == 0 {
 			printLog("Executing empty pipeline")
 		} else {
-			s := fmt.Sprintf("Executing %d commands in pipeline:", len(cmds))
+			var s strings.Builder
+			s.WriteString(fmt.Sprintf("Executing %d commands in pipeline:", len(cmds)))
 			for _, cmd := range cmds {
-				s += fmt.Sprintf("\n   %s", h.formatCommand(cmd))
+				s.WriteString(fmt.Sprintf("\n   %s", h.formatCommand(cmd)))
 			}
-			printLog(s)
+			printLog(s.String())
 		}
 		return hook(ctx, cmds)
 	}
diff --git a/pkg/util/test/time_test.go b/pkg/util/test/time_test.go
index d9a7906297..95531b1178 100644
--- a/pkg/util/test/time_test.go
+++ b/pkg/util/test/time_test.go
@@ -42,7 +42,7 @@ func TestMockTime(t *testing.T) {
 
 	n := 5
 	afterCh := clock.After(time.Duration(n) * time.Nanosecond)
-	for i := 0; i < n; i++ {
+	for range n {
 		select {
 		case <-afterCh:
 			t.Error("After channel read succeeded too soon")
diff --git a/pkg/util/test/util.go b/pkg/util/test/util.go
index 02d23f938f..cfb376988d 100644
--- a/pkg/util/test/util.go
+++ b/pkg/util/test/util.go
@@ -30,14 +30,14 @@ func FormatError(err error) string {
 	if err == nil {
 		return "nil"
 	}
-	var s string
+	var s strings.Builder
 	for i, err := range errors.Stack(err) {
-		s += fmt.Sprintf(`
+		s.WriteString(fmt.Sprintf(`
 %s-> %s (attributes: %v)`,
 			strings.Repeat("-", i), err, errors.Attributes(err),
-		)
+		))
 	}
-	return s
+	return s.String()
 }
 
 // Delay is the value, which can be used to slowdown the execution of time-dependent tests.
diff --git a/pkg/web/oauthclient/oauthclient.go b/pkg/web/oauthclient/oauthclient.go
index a7947f2c17..93d48d8ca4 100644
--- a/pkg/web/oauthclient/oauthclient.go
+++ b/pkg/web/oauthclient/oauthclient.go
@@ -105,8 +105,8 @@ func (oc *OAuthClient) defaultOAuthConfig(ctx context.Context) (*oauth2.Config,
 	redirectURL := fmt.Sprintf("%s/oauth/callback", strings.TrimSuffix(config.RootURL, "/"))
 	if oauthRootURL, err := url.Parse(config.RootURL); err == nil {
 		rootURL := (&url.URL{Scheme: oauthRootURL.Scheme, Host: oauthRootURL.Host}).String()
-		if strings.HasPrefix(authorizeURL, rootURL) {
-			authorizeURL = strings.TrimPrefix(authorizeURL, rootURL)
+		if after, ok := strings.CutPrefix(authorizeURL, rootURL); ok {
+			authorizeURL = after
 			redirectURL = strings.TrimPrefix(redirectURL, rootURL)
 		}
 	}
diff --git a/pkg/workerpool/workerpool_test.go b/pkg/workerpool/workerpool_test.go
index 07fafbc0ca..e94d464fd3 100644
--- a/pkg/workerpool/workerpool_test.go
+++ b/pkg/workerpool/workerpool_test.go
@@ -42,7 +42,7 @@ func TestAtomicConditionals(t *testing.T) {
 	value := int32(5_000)
 	lowerBound := int32(100)
 	upperBound := int32(10_000)
-	for k := 0; k < 100_000; k++ {
+	for k := range 100_000 {
 		k := k
 
 		wg.Add(1)
@@ -156,7 +156,7 @@ func testWorkerPool(t *testing.T, minWorkers int, maxWorkers int, queueSize int,
 
 	totalWork := 100_000
 	expectedHandlerCalls := int32(0)
-	for i := 0; i < totalWork; i++ {
+	for i := range totalWork {
 		if err := wp.Publish(workCtx, i); err != nil {
 			workFailed.Store(i, 0)
 		} else {
@@ -248,7 +248,7 @@ func benchmarkWorkerPool(b *testing.B, processingDelay time.Duration, publishing
 		var wg sync.WaitGroup
 		publisher := func() {
 			defer wg.Done()
-			for p := 0; p < 1_000; p++ {
+			for range 1_000 {
 				if err := wp.Publish(ctx, time.Now()); err != nil {
 					atomic.AddInt64(&dropped, 1)
 				} else {