diff --git a/.golangci.yml b/.golangci.yml
index b12dd5f13..c260a8e92 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -37,11 +37,10 @@ linters:
   - gochecksumtype
   # - goconst - TODO(ben): Consider moving consts into separate package
   - gocritic
+  - godot
 
 
 # TODO(ben): Enable those linters step by step and fix existing issues.
-# - gocyclo
-# - godot
 # - godox
 # - gofmt
 # - gofumpt
diff --git a/src/k8s/pkg/client/dqlite/util_test.go b/src/k8s/pkg/client/dqlite/util_test.go
index b1d8084f1..83cea9d63 100644
--- a/src/k8s/pkg/client/dqlite/util_test.go
+++ b/src/k8s/pkg/client/dqlite/util_test.go
@@ -26,7 +26,7 @@ var nextDqlitePort = 37312
 //			})
 //		}
 //
-// ```
+// ```.
 func withDqliteCluster(t *testing.T, size int, f func(ctx context.Context, dirs []string)) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
diff --git a/src/k8s/pkg/client/helm/mock/mock.go b/src/k8s/pkg/client/helm/mock/mock.go
index 6eea2d797..52a0f2f45 100644
--- a/src/k8s/pkg/client/helm/mock/mock.go
+++ b/src/k8s/pkg/client/helm/mock/mock.go
@@ -13,14 +13,14 @@ type MockApplyArguments struct {
 	Values  map[string]any
 }
 
-// Mock is a mock implementation of helm.Client
+// Mock is a mock implementation of helm.Client.
 type Mock struct {
 	ApplyCalledWith []MockApplyArguments
 	ApplyChanged    bool
 	ApplyErr        error
 }
 
-// Apply implements helm.Client
+// Apply implements helm.Client.
 func (m *Mock) Apply(ctx context.Context, c helm.InstallableChart, desired helm.State, values map[string]any) (bool, error) {
 	m.ApplyCalledWith = append(m.ApplyCalledWith, MockApplyArguments{Context: ctx, Chart: c, State: desired, Values: values})
 	return m.ApplyChanged, m.ApplyErr
diff --git a/src/k8s/pkg/client/kubernetes/server_groups.go b/src/k8s/pkg/client/kubernetes/server_groups.go
index cb58b9d0c..a3581d7a8 100644
--- a/src/k8s/pkg/client/kubernetes/server_groups.go
+++ b/src/k8s/pkg/client/kubernetes/server_groups.go
@@ -6,7 +6,7 @@ import (
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
-// ListResourcesForGroupVersion lists the resources for a given group version (e.g. "cilium.io/v2alpha1")
+// ListResourcesForGroupVersion lists the resources for a given group version (e.g. "cilium.io/v2alpha1").
 func (c *Client) ListResourcesForGroupVersion(groupVersion string) (*v1.APIResourceList, error) {
 	resources, err := c.Discovery().ServerResourcesForGroupVersion(groupVersion)
 	if err != nil {
diff --git a/src/k8s/pkg/k8sd/api/certificates_refresh.go b/src/k8s/pkg/k8sd/api/certificates_refresh.go
index 804c5bf81..540f87a40 100644
--- a/src/k8s/pkg/k8sd/api/certificates_refresh.go
+++ b/src/k8s/pkg/k8sd/api/certificates_refresh.go
@@ -190,7 +190,7 @@ func refreshCertsRunControlPlane(s state.State, r *http.Request, snap snap.Snap)
 
 }
 
-// refreshCertsRunWorker refreshes the certificates for a worker node
+// refreshCertsRunWorker refreshes the certificates for a worker node.
 func refreshCertsRunWorker(s state.State, r *http.Request, snap snap.Snap) response.Response {
 	log := log.FromContext(r.Context())
 
diff --git a/src/k8s/pkg/k8sd/api/response.go b/src/k8s/pkg/k8sd/api/response.go
index 626aadfa8..01c94e373 100644
--- a/src/k8s/pkg/k8sd/api/response.go
+++ b/src/k8s/pkg/k8sd/api/response.go
@@ -5,9 +5,9 @@ import (
 )
 
 const (
-	// StatusNodeUnavailable is the Http status code that the API returns if the node isn't in the cluster
+	// StatusNodeUnavailable is the Http status code that the API returns if the node isn't in the cluster.
 	StatusNodeUnavailable = 520
-	// StatusNodeInUse is the Http status code that the API returns if the node is already in the cluster
+	// StatusNodeInUse is the Http status code that the API returns if the node is already in the cluster.
 	StatusNodeInUse = 521
 )
 
diff --git a/src/k8s/pkg/k8sd/app/app.go b/src/k8s/pkg/k8sd/app/app.go
index d6172d124..720401e3f 100644
--- a/src/k8s/pkg/k8sd/app/app.go
+++ b/src/k8s/pkg/k8sd/app/app.go
@@ -236,7 +236,7 @@ func (a *App) Run(ctx context.Context, customHooks *state.Hooks) error {
 // markNodeReady will decrement the readyWg counter to signal that the node is ready.
 // The node is ready if:
 // - the microcluster database is accessible
-// - the kubernetes endpoint is reachable
+// - the kubernetes endpoint is reachable.
 func (a *App) markNodeReady(ctx context.Context, s state.State) error {
 	log := log.FromContext(ctx).WithValues("startup", "waitForReady")
 
diff --git a/src/k8s/pkg/k8sd/app/provider.go b/src/k8s/pkg/k8sd/app/provider.go
index 0125633aa..5cae366a1 100644
--- a/src/k8s/pkg/k8sd/app/provider.go
+++ b/src/k8s/pkg/k8sd/app/provider.go
@@ -43,5 +43,5 @@ func (a *App) NotifyFeatureController(network, gateway, ingress, loadBalancer, l
 	}
 }
 
-// Ensure App implements api.Provider
+// Ensure App implements api.Provider.
 var _ api.Provider = &App{}
diff --git a/src/k8s/pkg/k8sd/controllers/control_plane_configuration.go b/src/k8s/pkg/k8sd/controllers/control_plane_configuration.go
index c70713060..326267e0d 100644
--- a/src/k8s/pkg/k8sd/controllers/control_plane_configuration.go
+++ b/src/k8s/pkg/k8sd/controllers/control_plane_configuration.go
@@ -23,7 +23,7 @@ type ControlPlaneConfigurationController struct {
 }
 
 // NewControlPlaneConfigurationController creates a new controller.
-// triggerCh is typically a `time.NewTicker(<duration>).C`
+// triggerCh is typically a `time.NewTicker(<duration>).C`.
 func NewControlPlaneConfigurationController(snap snap.Snap, waitReady func(), triggerCh <-chan time.Time) *ControlPlaneConfigurationController {
 	return &ControlPlaneConfigurationController{
 		snap:      snap,
@@ -35,7 +35,7 @@ func NewControlPlaneConfigurationController(snap snap.Snap, waitReady func(), tr
 // Run starts the controller.
 // Run accepts a context to manage the lifecycle of the controller.
 // Run accepts a function that retrieves the current cluster configuration.
-// Run will loop every time the trigger channel is
+// Run will loop every time the trigger channel is.
 func (c *ControlPlaneConfigurationController) Run(ctx context.Context, getClusterConfig func(context.Context) (types.ClusterConfig, error)) {
 	c.waitReady()
 
diff --git a/src/k8s/pkg/k8sd/controllers/control_plane_configuration_test.go b/src/k8s/pkg/k8sd/controllers/control_plane_configuration_test.go
index 88035dbb9..89bda62a8 100644
--- a/src/k8s/pkg/k8sd/controllers/control_plane_configuration_test.go
+++ b/src/k8s/pkg/k8sd/controllers/control_plane_configuration_test.go
@@ -16,7 +16,7 @@ import (
 	. "github.com/onsi/gomega"
 )
 
-// channelSendTimeout is the timeout for pushing to channels for TestControlPlaneConfigController
+// channelSendTimeout is the timeout for pushing to channels for TestControlPlaneConfigController.
 const channelSendTimeout = 100 * time.Millisecond
 
 type configProvider struct {
diff --git a/src/k8s/pkg/k8sd/controllers/csrsigning/const.go b/src/k8s/pkg/k8sd/controllers/csrsigning/const.go
index 074066396..a6729df73 100644
--- a/src/k8s/pkg/k8sd/controllers/csrsigning/const.go
+++ b/src/k8s/pkg/k8sd/controllers/csrsigning/const.go
@@ -3,9 +3,9 @@ package csrsigning
 import "time"
 
 const (
-	// requeueAfterSigningFailure is the time to requeue requests when any step of the signing process failed
+	// requeueAfterSigningFailure is the time to requeue requests when any step of the signing process failed.
 	requeueAfterSigningFailure = 3 * time.Second
 
-	// requeueAfterWaitingForApproved is the amount of time to requeue requests if waiting for CSR to be approved
+	// requeueAfterWaitingForApproved is the amount of time to requeue requests if waiting for CSR to be approved.
 	requeueAfterWaitingForApproved = 10 * time.Second
 )
diff --git a/src/k8s/pkg/k8sd/database/util_test.go b/src/k8s/pkg/k8sd/database/util_test.go
index d1cf02d63..e9c9b7da2 100644
--- a/src/k8s/pkg/k8sd/database/util_test.go
+++ b/src/k8s/pkg/k8sd/database/util_test.go
@@ -12,14 +12,14 @@ import (
 )
 
 const (
-	// microclusterDatabaseInitTimeout is the timeout for microcluster database initialization operations
+	// microclusterDatabaseInitTimeout is the timeout for microcluster database initialization operations.
 	microclusterDatabaseInitTimeout = 3 * time.Second
-	// microclusterDatabaseShutdownTimeout is the timeout for microcluster database shutdown operations
+	// microclusterDatabaseShutdownTimeout is the timeout for microcluster database shutdown operations.
 	microclusterDatabaseShutdownTimeout = 3 * time.Second
 )
 
 var (
-	// nextIdx is used to pick different listen ports for each microcluster instance
+	// nextIdx is used to pick different listen ports for each microcluster instance.
 	nextIdx int
 )
 
diff --git a/src/k8s/pkg/k8sd/features/cilium/internal.go b/src/k8s/pkg/k8sd/features/cilium/internal.go
index 88849ade7..72758019b 100644
--- a/src/k8s/pkg/k8sd/features/cilium/internal.go
+++ b/src/k8s/pkg/k8sd/features/cilium/internal.go
@@ -11,9 +11,9 @@ import (
 )
 
 const (
-	// minVLANIDValue is the minimum valid 802.1Q VLAN ID value
+	// minVLANIDValue is the minimum valid 802.1Q VLAN ID value.
 	minVLANIDValue = 0
-	// maxVLANIDValue is the maximum valid 802.1Q VLAN ID value
+	// maxVLANIDValue is the maximum valid 802.1Q VLAN ID value.
 	maxVLANIDValue = 4094
 )
 
diff --git a/src/k8s/pkg/k8sd/features/cilium/network.go b/src/k8s/pkg/k8sd/features/cilium/network.go
index e9a8085bb..e9eb72011 100644
--- a/src/k8s/pkg/k8sd/features/cilium/network.go
+++ b/src/k8s/pkg/k8sd/features/cilium/network.go
@@ -17,7 +17,7 @@ const (
 	networkDeployFailedMsgTmpl = "Failed to deploy Cilium Network, the error was: %v"
 )
 
-// required for unittests
+// required for unittests.
 var (
 	getMountPath            = utils.GetMountPath
 	getMountPropagationType = utils.GetMountPropagationType
diff --git a/src/k8s/pkg/k8sd/features/contour/gateway.go b/src/k8s/pkg/k8sd/features/contour/gateway.go
index 320140d3b..dd52e9bff 100644
--- a/src/k8s/pkg/k8sd/features/contour/gateway.go
+++ b/src/k8s/pkg/k8sd/features/contour/gateway.go
@@ -94,7 +94,7 @@ func ApplyGateway(ctx context.Context, snap snap.Snap, gateway types.Gateway, ne
 }
 
 // waitForRequiredContourCommonCRDs waits for the required contour CRDs to be available
-// by checking the API resources by group version
+// by checking the API resources by group version.
 func waitForRequiredContourCommonCRDs(ctx context.Context, snap snap.Snap) error {
 	client, err := snap.KubernetesClient("")
 	if err != nil {
diff --git a/src/k8s/pkg/k8sd/features/contour/ingress.go b/src/k8s/pkg/k8sd/features/contour/ingress.go
index 062016a0e..ea5a6e030 100644
--- a/src/k8s/pkg/k8sd/features/contour/ingress.go
+++ b/src/k8s/pkg/k8sd/features/contour/ingress.go
@@ -24,7 +24,7 @@ const (
 // deployment.
 // ApplyIngress returns an error if anything fails. The error is also wrapped in the .Message field of the
 // returned FeatureStatus.
-// Contour CRDS are applied through a ck-contour common chart (Overlap with gateway)
+// Contour CRDS are applied through a ck-contour common chart (Overlap with gateway).
 func ApplyIngress(ctx context.Context, snap snap.Snap, ingress types.Ingress, _ types.Network, _ types.Annotations) (types.FeatureStatus, error) {
 	m := snap.HelmClient()
 
diff --git a/src/k8s/pkg/k8sd/types/cluster_config_certificates.go b/src/k8s/pkg/k8sd/types/cluster_config_certificates.go
index 9d2b7d066..ce61a612a 100644
--- a/src/k8s/pkg/k8sd/types/cluster_config_certificates.go
+++ b/src/k8s/pkg/k8sd/types/cluster_config_certificates.go
@@ -46,5 +46,5 @@ func (c Certificates) GetAdminClientKey() string  { return getField(c.AdminClien
 func (c Certificates) GetK8sdPublicKey() string   { return getField(c.K8sdPublicKey) }
 func (c Certificates) GetK8sdPrivateKey() string  { return getField(c.K8sdPrivateKey) }
 
-// Empty returns true if all Certificates fields are unset
+// Empty returns true if all Certificates fields are unset.
 func (c Certificates) Empty() bool { return c == Certificates{} }
diff --git a/src/k8s/pkg/k8sd/types/cluster_config_datastore.go b/src/k8s/pkg/k8sd/types/cluster_config_datastore.go
index 6f0d4dbd0..1f354904b 100644
--- a/src/k8s/pkg/k8sd/types/cluster_config_datastore.go
+++ b/src/k8s/pkg/k8sd/types/cluster_config_datastore.go
@@ -29,7 +29,7 @@ func (c Datastore) GetExternalClientCert() string { return getField(c.ExternalCl
 func (c Datastore) GetExternalClientKey() string  { return getField(c.ExternalClientKey) }
 func (c Datastore) Empty() bool                   { return c == Datastore{} }
 
-// DatastorePathsProvider is to avoid circular dependency for snap.Snap in Datastore.ToKubeAPIServerArguments()
+// DatastorePathsProvider is to avoid circular dependency for snap.Snap in Datastore.ToKubeAPIServerArguments().
 type DatastorePathsProvider interface {
 	K8sDqliteStateDir() string
 	EtcdPKIDir() string
diff --git a/src/k8s/pkg/utils/certificate.go b/src/k8s/pkg/utils/certificate.go
index 2cf5fd93a..b817083d8 100644
--- a/src/k8s/pkg/utils/certificate.go
+++ b/src/k8s/pkg/utils/certificate.go
@@ -10,7 +10,7 @@ import (
 )
 
 // SplitIPAndDNSSANs splits a list of SANs into IP and DNS SANs
-// Returns a list of IP addresses and a list of DNS names
+// Returns a list of IP addresses and a list of DNS names.
 func SplitIPAndDNSSANs(extraSANs []string) ([]net.IP, []string) {
 	var ipSANs []net.IP
 	var dnsSANs []string
@@ -57,7 +57,7 @@ func TLSClientConfigWithTrustedCertificate(remoteCert *x509.Certificate, rootCAs
 
 // GetRemoteCertificate retrieves the remote certificate from a given address
 // The address should be in the format of "hostname:port"
-// Returns the remote certificate or an error
+// Returns the remote certificate or an error.
 func GetRemoteCertificate(address string) (*x509.Certificate, error) {
 	// validate address
 	_, _, err := net.SplitHostPort(address)
@@ -95,7 +95,7 @@ func GetRemoteCertificate(address string) (*x509.Certificate, error) {
 	return resp.TLS.PeerCertificates[0], nil
 }
 
-// CertFingerprint returns the SHA256 fingerprint of a certificate
+// CertFingerprint returns the SHA256 fingerprint of a certificate.
 func CertFingerprint(cert *x509.Certificate) string {
 	return fmt.Sprintf("%x", sha256.Sum256(cert.Raw))
 }
diff --git a/src/k8s/pkg/utils/time.go b/src/k8s/pkg/utils/time.go
index 19102c1c5..d414e7232 100644
--- a/src/k8s/pkg/utils/time.go
+++ b/src/k8s/pkg/utils/time.go
@@ -39,7 +39,7 @@ func SecondsToExpirationDate(now time.Time, seconds int) time.Time {
 // - y: years
 // - mo: months
 // - d: days
-// - any other unit supported by time.ParseDuration
+// - any other unit supported by time.ParseDuration.
 func TTLToSeconds(ttl string) (int, error) {
 	if len(ttl) < 2 {
 		return 0, fmt.Errorf("invalid TTL length: %s", ttl)