diff --git a/.golangci-warnings.yml b/.golangci-warnings.yml
index f8d2063475..440a07f7d2 100644
--- a/.golangci-warnings.yml
+++ b/.golangci-warnings.yml
@@ -6,12 +6,15 @@ linters:
   disable-all: true
   enable:
     - deadcode
+    - gosec
     - partitiontest
     - structcheck
     - varcheck
     - unused
 
 linters-settings:
+  gosec: # we are mostly only interested in G601
+    excludes: [G101, G103, G104, G107, G202, G301, G302, G303, G304, G306, G307, G404]
   custom:
     partitiontest:
       path: cmd/partitiontest_linter/plugin.so
@@ -51,6 +54,7 @@ issues:
     - path: _test\.go
       linters:
         - deadcode
+        - gosec
         - structcheck
         - varcheck
         - unused
diff --git a/.golangci.yml b/.golangci.yml
index 335da20685..46463c18bf 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -7,6 +7,7 @@ linters:
   disable-all: true
   enable:
     - errcheck
+    - exportloopref
     - gofmt
     - gosimple
     - govet
@@ -107,6 +108,7 @@ issues:
     - path: _test\.go
       linters:
         - errcheck
+        # - exportloopref
         # - gofmt
         - gosimple
         # - govet
diff --git a/cmd/goal/clerk.go b/cmd/goal/clerk.go
index ed226733d0..2147828947 100644
--- a/cmd/goal/clerk.go
+++ b/cmd/goal/clerk.go
@@ -221,8 +221,8 @@ func createSignedTransaction(client libgoal.Client, signTx bool, dataDir string,
 
 func writeSignedTxnsToFile(stxns []transactions.SignedTxn, filename string) error {
 	var outData []byte
-	for _, stxn := range stxns {
-		outData = append(outData, protocol.Encode(&stxn)...)
+	for i := range stxns {
+		outData = append(outData, protocol.Encode(&stxns[i])...)
 	}
 
 	return writeFile(filename, outData, 0600)
diff --git a/cmd/opdoc/opdoc.go b/cmd/opdoc/opdoc.go
index e0b69fa111..a7f1894018 100644
--- a/cmd/opdoc/opdoc.go
+++ b/cmd/opdoc/opdoc.go
@@ -225,8 +225,8 @@ func opsToMarkdown(out io.Writer) (err error) {
 	out.Write([]byte("# Opcodes\n\nOps have a 'cost' of 1 unless otherwise specified.\n\n"))
 	opSpecs := logic.OpcodesByVersion(uint64(docVersion))
 	written := make(map[string]bool)
-	for _, spec := range opSpecs {
-		err = opToMarkdown(out, &spec, written)
+	for i := range opSpecs {
+		err = opToMarkdown(out, &opSpecs[i], written)
 		if err != nil {
 			return
 		}
diff --git a/daemon/algod/api/server/v2/utils.go b/daemon/algod/api/server/v2/utils.go
index 32f18ea7d4..cf2648e8d4 100644
--- a/daemon/algod/api/server/v2/utils.go
+++ b/daemon/algod/api/server/v2/utils.go
@@ -310,8 +310,8 @@ func convertLogs(txn node.TxnWithStatus) *[][]byte {
 
 func convertInners(txn *node.TxnWithStatus) *[]PreEncodedTxInfo {
 	inner := make([]PreEncodedTxInfo, len(txn.ApplyData.EvalDelta.InnerTxns))
-	for i, itxn := range txn.ApplyData.EvalDelta.InnerTxns {
-		inner[i] = convertInnerTxn(&itxn)
+	for i := range txn.ApplyData.EvalDelta.InnerTxns {
+		inner[i] = convertInnerTxn(&txn.ApplyData.EvalDelta.InnerTxns[i])
 	}
 	return &inner
 }
diff --git a/data/pools/transactionPool.go b/data/pools/transactionPool.go
index bed4e17e68..c99391ccc4 100644
--- a/data/pools/transactionPool.go
+++ b/data/pools/transactionPool.go
@@ -869,7 +869,7 @@ func (pool *TransactionPool) AssembleBlock(round basics.Round, deadline time.Tim
 					}
 					stats.TotalLength += uint64(encodedLen)
 					if txib.Txn.Type == protocol.StateProofTx {
-						stats.StateProofStats = pool.getStateProofStats(&txib, encodedLen)
+						stats.StateProofStats = pool.getStateProofStats(&payset[i], encodedLen)
 					}
 				}
 				stats.AverageFee = totalFees / uint64(stats.IncludedCount)
diff --git a/data/transactions/logic/assembler_test.go b/data/transactions/logic/assembler_test.go
index cc5cd97a44..8cdf8174d0 100644
--- a/data/transactions/logic/assembler_test.go
+++ b/data/transactions/logic/assembler_test.go
@@ -658,9 +658,9 @@ func testProg(t testing.TB, source string, ver uint64, expected ...Expect) *OpSt
 				}
 			} else {
 				var found *lineError
-				for _, err := range errors {
-					if err.Line == exp.l {
-						found = &err
+				for i := range errors {
+					if errors[i].Line == exp.l {
+						found = &errors[i]
 						break
 					}
 				}
diff --git a/data/transactions/verify/txn.go b/data/transactions/verify/txn.go
index 2edd69aa05..564c9b4ba1 100644
--- a/data/transactions/verify/txn.go
+++ b/data/transactions/verify/txn.go
@@ -226,7 +226,7 @@ func txnGroupBatchPrep(stxs []transactions.SignedTxn, contextHdr *bookkeeping.Bl
 	minFeeCount := uint64(0)
 	feesPaid := uint64(0)
 	for i, stxn := range stxs {
-		prepErr := txnBatchPrep(&stxn, i, groupCtx, verifier, evalTracer)
+		prepErr := txnBatchPrep(&stxs[i], i, groupCtx, verifier, evalTracer)
 		if prepErr != nil {
 			// re-wrap the error with more details
 			prepErr.err = fmt.Errorf("transaction %+v invalid : %w", stxn, prepErr.err)
diff --git a/ledger/store/accountsV2.go b/ledger/store/accountsV2.go
index cb2c1d34eb..ecaaf5970f 100644
--- a/ledger/store/accountsV2.go
+++ b/ledger/store/accountsV2.go
@@ -710,8 +710,8 @@ func (w *accountsV2Writer) AccountsPutOnlineRoundParams(onlineRoundParamsData []
 		return err
 	}
 
-	for i, onlineRoundParams := range onlineRoundParamsData {
-		_, err = insertStmt.Exec(startRound+basics.Round(i), protocol.Encode(&onlineRoundParams))
+	for i := range onlineRoundParamsData {
+		_, err = insertStmt.Exec(startRound+basics.Round(i), protocol.Encode(&onlineRoundParamsData[i]))
 		if err != nil {
 			return err
 		}
diff --git a/ledger/store/schema.go b/ledger/store/schema.go
index acbd102b15..339c660a11 100644
--- a/ledger/store/schema.go
+++ b/ledger/store/schema.go
@@ -205,7 +205,7 @@ func accountsInit(tx *sql.Tx, initAccounts map[basics.Address]basics.AccountData
 
 		for addr, data := range initAccounts {
 			_, err = tx.Exec("INSERT INTO accountbase (address, data) VALUES (?, ?)",
-				addr[:], protocol.Encode(&data))
+				addr[:], protocol.Encode(&data)) //nolint:gosec // Encode does not hold on to reference
 			if err != nil {
 				return true, err
 			}
diff --git a/scripts/check_deps.sh b/scripts/check_deps.sh
index a42405733d..95c7599f78 100755
--- a/scripts/check_deps.sh
+++ b/scripts/check_deps.sh
@@ -35,19 +35,36 @@ missing_dep() {
 }
 
 GO_DEPS=(
-    "$GO_BIN/stringer"
-    "$GO_BIN/msgp"
-    "$GO_BIN/golangci-lint"
+    "msgp"
+    "golangci-lint"
+    "oapi-codegen"
+    "swagger"
 )
 
+check_go_binary_version() {
+  binary_name=$1
+  expected_version=$(grep "$binary_name" scripts/buildtools/versions | awk '{print $2}')
+  actual_version=$(go version -m "$GO_BIN/$binary_name" | awk 'NR==3 {print $3}')
+
+  if [ "$expected_version" != "$actual_version" ]; then
+      echo "$YELLOW_FG[WARNING]$END_FG_COLOR $binary_name version mismatch, expected $expected_version, but got $actual_version"
+  fi
+}
+
 check_deps() {
-    for path in ${GO_DEPS[*]}
+    for dep in ${GO_DEPS[*]}
     do
-        if [ ! -f "$path" ]
+        if [ ! -f "$GO_BIN/$dep" ]
         then
             # Parameter expansion is faster than invoking another process.
             # https://www.linuxjournal.com/content/bash-parameter-expansion
-            missing_dep "${path##*/}"
+            missing_dep "${dep##*/}"
+        fi
+
+        # go 1.17 on arm64 macs has an issue checking binaries with "go version", skip version check
+        if [[ "$(uname)" != "Darwin" ]] || [[ "$(uname -m)" != "arm64" ]] || ! [[ "$(go version | awk '{print $3}')" < "go1.17" ]]
+        then
+           check_go_binary_version "$dep"
         fi
     done