diff --git a/.golangci.yml b/.golangci.yml
index 508e4474d9..255b050f27 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -28,6 +28,7 @@ linters:
     - nilnil # Checks that there is no simultaneous return of nil error and an nil value. ref: https://golangci-lint.run/usage/linters/#nilnil
     - nonamedreturns # Checks that functions with named return values do not return named values. https://golangci-lint.run/usage/linters/#nonamedreturns
     - cyclop # Checks function and package cyclomatic complexity. https://golangci-lint.run/usage/linters/#cyclop
+    - gocritic # Analyze source code for various issues, including bugs, performance hiccups, and non-idiomatic coding practices. https://golangci-lint.run/docs/linters/configuration/#gocritic
 
     # tests
     - testifylint # Checks usage of github.com/stretchr/testify. https://golangci-lint.run/usage/linters/#testifylint
diff --git a/controller/controller.go b/controller/controller.go
index f0a3fbde88..d75bafc437 100644
--- a/controller/controller.go
+++ b/controller/controller.go
@@ -353,7 +353,7 @@ func (c *Controller) Run(ctx context.Context) {
 					consecutiveSoftErrors.Gauge.Set(float64(softErrorCount))
 					log.Errorf("Failed to do run once: %v (consecutive soft errors: %d)", err, softErrorCount)
 				} else {
-					log.Fatalf("Failed to do run once: %v", err)
+					log.Fatalf("Failed to do run once: %v", err) // nolint: gocritic // exitAfterDefer
 				}
 			} else {
 				if softErrorCount > 0 {
diff --git a/controller/execute.go b/controller/execute.go
index d2140c8d4d..bb7ebc5440 100644
--- a/controller/execute.go
+++ b/controller/execute.go
@@ -104,7 +104,7 @@ func Execute() {
 
 	endpointsSource, err := buildSource(ctx, cfg)
 	if err != nil {
-		log.Fatal(err)
+		log.Fatal(err) // nolint: gocritic // exitAfterDefer
 	}
 
 	domainFilter := createDomainFilter(cfg)
diff --git a/endpoint/domain_filter.go b/endpoint/domain_filter.go
index 8d8aad2dc8..502c639cc6 100644
--- a/endpoint/domain_filter.go
+++ b/endpoint/domain_filter.go
@@ -122,13 +122,12 @@ func matchFilter(filters []string, domain string, emptyval bool) bool {
 			continue
 		}
 
-		if strings.HasPrefix(filter, ".") && strings.HasSuffix(strippedDomain, filter) {
+		switch {
+		case strings.HasPrefix(filter, ".") && strings.HasSuffix(strippedDomain, filter):
 			return true
-		} else if strings.Count(strippedDomain, ".") == strings.Count(filter, ".") {
-			if strippedDomain == filter {
-				return true
-			}
-		} else if strings.HasSuffix(strippedDomain, "."+filter) {
+		case strings.Count(strippedDomain, ".") == strings.Count(filter, ".") && strippedDomain == filter:
+			return true
+		case strings.HasSuffix(strippedDomain, "."+filter):
 			return true
 		}
 	}
diff --git a/endpoint/endpoint.go b/endpoint/endpoint.go
index c95aa78c18..059b6421ba 100644
--- a/endpoint/endpoint.go
+++ b/endpoint/endpoint.go
@@ -386,11 +386,12 @@ func FilterEndpointsByOwnerID(ownerID string, eps []*Endpoint) []*Endpoint {
 	filtered := []*Endpoint{}
 	for _, ep := range eps {
 		endpointOwner, ok := ep.Labels[OwnerLabelKey]
-		if !ok {
+		switch {
+		case !ok:
 			log.Debugf(`Skipping endpoint %v because of missing owner label (required: "%s")`, ep, ownerID)
-		} else if endpointOwner != ownerID {
+		case endpointOwner != ownerID:
 			log.Debugf(`Skipping endpoint %v because owner id does not match (found: "%s", required: "%s")`, ep, endpointOwner, ownerID)
-		} else {
+		default:
 			filtered = append(filtered, ep)
 		}
 	}
diff --git a/internal/gen/docs/flags/main.go b/internal/gen/docs/flags/main.go
index dba89ee7d0..6bdf68399f 100644
--- a/internal/gen/docs/flags/main.go
+++ b/internal/gen/docs/flags/main.go
@@ -57,7 +57,7 @@ func main() {
 	if err != nil {
 		_ = fmt.Errorf("failed to generate markdown file '%s': %v", path, err.Error())
 	}
-	content = content + "\n"
+	content += "\n"
 	_ = utils.WriteToFile(path, content)
 }
 
diff --git a/internal/gen/docs/flags/main_test.go b/internal/gen/docs/flags/main_test.go
index 684a35acd5..a5055eba3d 100644
--- a/internal/gen/docs/flags/main_test.go
+++ b/internal/gen/docs/flags/main_test.go
@@ -73,7 +73,7 @@ func TestFlagsMdUpToDate(t *testing.T) {
 	flags := computeFlags()
 	actual, err := flags.generateMarkdownTable()
 	assert.NoError(t, err)
-	actual = actual + "\n"
+	actual += "\n"
 	assert.Len(t, actual, len(expected), "expected file '%s' to be up to date. execute 'make generate-flags-documentation", fileName)
 }
 
diff --git a/internal/gen/docs/metrics/main.go b/internal/gen/docs/metrics/main.go
index e4bc8b9e5e..af90a125cc 100644
--- a/internal/gen/docs/metrics/main.go
+++ b/internal/gen/docs/metrics/main.go
@@ -54,7 +54,7 @@ func main() {
 		_, _ = fmt.Fprintf(os.Stderr, "failed to generate markdown file '%s': %v\n", path, err)
 		os.Exit(1)
 	}
-	content = content + "\n"
+	content += "\n"
 	_ = utils.WriteToFile(path, content)
 }
 
@@ -119,6 +119,7 @@ func getRuntimeMetrics(reg prometheus.Registerer) []string {
 				runtimeMetrics = append(runtimeMetrics, k)
 			}
 		}
+	default:
 	}
 	sort.Strings(runtimeMetrics)
 	return runtimeMetrics
diff --git a/internal/testutils/endpoint_test.go b/internal/testutils/endpoint_test.go
index 8daff40423..ddc80cc4ac 100644
--- a/internal/testutils/endpoint_test.go
+++ b/internal/testutils/endpoint_test.go
@@ -84,7 +84,7 @@ func TestExampleSameEndpoints(t *testing.T) {
 	// example.org 0 IN TXT  load-balancer.org []
 }
 
-func makeEndpoint(DNSName string) *endpoint.Endpoint {
+func makeEndpoint(DNSName string) *endpoint.Endpoint { // nolint: gocritic // captLocal
 	return &endpoint.Endpoint{
 		DNSName:       DNSName,
 		Targets:       endpoint.Targets{"target.com"},
diff --git a/pkg/events/types.go b/pkg/events/types.go
index 17c3ea3974..9f045b1622 100644
--- a/pkg/events/types.go
+++ b/pkg/events/types.go
@@ -177,7 +177,7 @@ func sanitize(input string) string {
 
 	// the name should end with an alphanumeric character
 	if len(sanitized) > 0 && !endsWithAlphaNumeric.MatchString(sanitized) {
-		sanitized = sanitized + "z"
+		sanitized += "z"
 	}
 
 	sanitized = invalidChars.ReplaceAllString(sanitized, "-")
diff --git a/pkg/rfc2317/arpa.go b/pkg/rfc2317/arpa.go
index a79716bac8..0764c9cc85 100644
--- a/pkg/rfc2317/arpa.go
+++ b/pkg/rfc2317/arpa.go
@@ -39,7 +39,7 @@ func CidrToInAddr(cidr string) (string, error) {
 			// address for all IPv4 addresses no matter how they are
 			// expressed internally.
 		} else {
-			cidr = cidr + "/128"
+			cidr += "/128"
 		}
 	}
 
diff --git a/provider/akamai/akamai_test.go b/provider/akamai/akamai_test.go
index 21d414c966..df8b465c80 100644
--- a/provider/akamai/akamai_test.go
+++ b/provider/akamai/akamai_test.go
@@ -287,10 +287,11 @@ func TestCreateRecordsDomainFilter(t *testing.T) {
 	assert.NoError(t, err)
 
 	zoneNameIDMapper := provider.ZoneIDName{"example.com": "example.com"}
-	endpoints := make([]*endpoint.Endpoint, 0)
-	endpoints = append(endpoints, endpoint.NewEndpoint("www.example.com", endpoint.RecordTypeA, "10.0.0.2", "10.0.0.3"))
-	endpoints = append(endpoints, endpoint.NewEndpoint("www.example.com", endpoint.RecordTypeTXT, "heritage=external-dns,external-dns/owner=default"))
-	exclude := append(endpoints, endpoint.NewEndpoint("www.exclude.me", endpoint.RecordTypeA, "10.0.0.2", "10.0.0.3"))
+	exclude := []*endpoint.Endpoint{
+		endpoint.NewEndpoint("www.example.com", endpoint.RecordTypeA, "10.0.0.2", "10.0.0.3"),
+		endpoint.NewEndpoint("www.example.com", endpoint.RecordTypeTXT, "heritage=external-dns,external-dns/owner=default"),
+		endpoint.NewEndpoint("www.exclude.me", endpoint.RecordTypeA, "10.0.0.2", "10.0.0.3"),
+	}
 
 	err = c.createRecordsets(zoneNameIDMapper, exclude)
 	assert.NoError(t, err)
@@ -321,10 +322,11 @@ func TestDeleteRecordsDomainFilter(t *testing.T) {
 	require.NoError(t, err)
 
 	zoneNameIDMapper := provider.ZoneIDName{"example.com": "example.com"}
-	endpoints := make([]*endpoint.Endpoint, 0)
-	endpoints = append(endpoints, endpoint.NewEndpoint("www.example.com", endpoint.RecordTypeA, "10.0.0.2", "10.0.0.3"))
-	endpoints = append(endpoints, endpoint.NewEndpoint("www.example.com", endpoint.RecordTypeTXT, "heritage=external-dns,external-dns/owner=default"))
-	exclude := append(endpoints, endpoint.NewEndpoint("www.exclude.me", endpoint.RecordTypeA, "10.0.0.2", "10.0.0.3"))
+	exclude := []*endpoint.Endpoint{
+		endpoint.NewEndpoint("www.example.com", endpoint.RecordTypeA, "10.0.0.2", "10.0.0.3"),
+		endpoint.NewEndpoint("www.example.com", endpoint.RecordTypeTXT, "heritage=external-dns,external-dns/owner=default"),
+		endpoint.NewEndpoint("www.exclude.me", endpoint.RecordTypeA, "10.0.0.2", "10.0.0.3"),
+	}
 
 	err = c.deleteRecordsets(zoneNameIDMapper, exclude)
 	assert.NoError(t, err)
@@ -355,10 +357,11 @@ func TestUpdateRecordsDomainFilter(t *testing.T) {
 	require.NoError(t, err)
 
 	zoneNameIDMapper := provider.ZoneIDName{"example.com": "example.com"}
-	endpoints := make([]*endpoint.Endpoint, 0)
-	endpoints = append(endpoints, endpoint.NewEndpoint("www.example.com", endpoint.RecordTypeA, "10.0.0.2", "10.0.0.3"))
-	endpoints = append(endpoints, endpoint.NewEndpoint("www.example.com", endpoint.RecordTypeTXT, "heritage=external-dns,external-dns/owner=default"))
-	exclude := append(endpoints, endpoint.NewEndpoint("www.exclude.me", endpoint.RecordTypeA, "10.0.0.2", "10.0.0.3"))
+	exclude := []*endpoint.Endpoint{
+		endpoint.NewEndpoint("www.example.com", endpoint.RecordTypeA, "10.0.0.2", "10.0.0.3"),
+		endpoint.NewEndpoint("www.example.com", endpoint.RecordTypeTXT, "heritage=external-dns,external-dns/owner=default"),
+		endpoint.NewEndpoint("www.exclude.me", endpoint.RecordTypeA, "10.0.0.2", "10.0.0.3"),
+	}
 
 	err = c.updateNewRecordsets(zoneNameIDMapper, exclude)
 	require.NoError(t, err)
diff --git a/provider/aws/aws.go b/provider/aws/aws.go
index 90a1c0b3b0..a5d964b67f 100644
--- a/provider/aws/aws.go
+++ b/provider/aws/aws.go
@@ -772,7 +772,7 @@ func (p *AWSProvider) submitChanges(ctx context.Context, changes Route53Changes,
 							log.Errorf("Failed submitting change (error: %v), it will be retried in a separate change batch in the next iteration", err)
 							p.failedChangesQueue[z] = append(p.failedChangesQueue[z], changes...)
 						} else {
-							successfulChanges = successfulChanges + len(changes)
+							successfulChanges += len(changes)
 						}
 					}
 				} else {
diff --git a/provider/awssd/aws_sd.go b/provider/awssd/aws_sd.go
index 9ee0822a7f..16bb8effcb 100644
--- a/provider/awssd/aws_sd.go
+++ b/provider/awssd/aws_sd.go
@@ -195,26 +195,24 @@ func (p *AWSSDProvider) instancesToEndpoint(ns *sdtypes.NamespaceSummary, srv *s
 	}
 
 	for _, inst := range instances {
+		switch {
 		// CNAME
-		if inst.Attributes[sdInstanceAttrCname] != "" && srv.DnsConfig.DnsRecords[0].Type == sdtypes.RecordTypeCname {
+		case inst.Attributes[sdInstanceAttrCname] != "" && srv.DnsConfig.DnsRecords[0].Type == sdtypes.RecordTypeCname:
 			newEndpoint.RecordType = endpoint.RecordTypeCNAME
 			newEndpoint.Targets = append(newEndpoint.Targets, inst.Attributes[sdInstanceAttrCname])
-
-			// ALIAS
-		} else if inst.Attributes[sdInstanceAttrAlias] != "" {
+		// ALIAS
+		case inst.Attributes[sdInstanceAttrAlias] != "":
 			newEndpoint.RecordType = endpoint.RecordTypeCNAME
 			newEndpoint.Targets = append(newEndpoint.Targets, inst.Attributes[sdInstanceAttrAlias])
-
-			// IPv4-based target
-		} else if inst.Attributes[sdInstanceAttrIPV4] != "" {
+		// IPv4-based target
+		case inst.Attributes[sdInstanceAttrIPV4] != "":
 			newEndpoint.RecordType = endpoint.RecordTypeA
 			newEndpoint.Targets = append(newEndpoint.Targets, inst.Attributes[sdInstanceAttrIPV4])
-
-			// IPv6-based target
-		} else if inst.Attributes[sdInstanceAttrIPV6] != "" {
+		// IPv6-based target
+		case inst.Attributes[sdInstanceAttrIPV6] != "":
 			newEndpoint.RecordType = endpoint.RecordTypeAAAA
 			newEndpoint.Targets = append(newEndpoint.Targets, inst.Attributes[sdInstanceAttrIPV6])
-		} else {
+		default:
 			log.Warnf("Invalid instance \"%v\" found in service \"%v\"", inst, srv.Name)
 		}
 	}
diff --git a/provider/azure/azure_privatedns_test.go b/provider/azure/azure_privatedns_test.go
index 3366cc0da0..05d3d7ff97 100644
--- a/provider/azure/azure_privatedns_test.go
+++ b/provider/azure/azure_privatedns_test.go
@@ -23,6 +23,7 @@ import (
 	azcoreruntime "github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
 	privatedns "github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/privatedns/armprivatedns"
+
 	"sigs.k8s.io/external-dns/endpoint"
 	"sigs.k8s.io/external-dns/plan"
 	"sigs.k8s.io/external-dns/provider"
@@ -117,7 +118,6 @@ func (client *mockPrivateRecordSetsClient) CreateOrUpdate(ctx context.Context, r
 		),
 	)
 	return privatedns.RecordSetsClientCreateOrUpdateResponse{}, nil
-	//return parameters, nil
 }
 
 func createMockPrivateZone(zone string, id string) *privatedns.PrivateZone {
diff --git a/provider/civo/civo_test.go b/provider/civo/civo_test.go
index 80910887d8..0afa75e8e0 100644
--- a/provider/civo/civo_test.go
+++ b/provider/civo/civo_test.go
@@ -1170,11 +1170,12 @@ func TestCivoChangesEmpty(t *testing.T) {
 // call to ObjectsAreEqual replaced with cmp.Equal which better handles struct's with pointers to
 // other structs. It also ignores ordering when comparing unlike cmp.Equal.
 func elementsMatch(t *testing.T, listA, listB interface{}, msgAndArgs ...interface{}) bool {
-	if listA == nil && listB == nil {
+	switch {
+	case listA == nil && listB == nil:
 		return true
-	} else if listA == nil {
+	case listA == nil:
 		return isEmpty(listB)
-	} else if listB == nil {
+	case listB == nil:
 		return isEmpty(listA)
 	}
 
diff --git a/provider/cloudflare/cloudflare.go b/provider/cloudflare/cloudflare.go
index c852962da1..743a3b27d7 100644
--- a/provider/cloudflare/cloudflare.go
+++ b/provider/cloudflare/cloudflare.go
@@ -651,7 +651,8 @@ func (p *CloudFlareProvider) submitChanges(ctx context.Context, changes []*cloud
 			if chErr != nil {
 				return fmt.Errorf("could not fetch custom hostnames from zone, %w", chErr)
 			}
-			if change.Action == cloudFlareUpdate {
+			switch change.Action {
+			case cloudFlareUpdate:
 				if !p.submitCustomHostnameChanges(ctx, zoneID, change, chs, logFields) {
 					failedChange = true
 				}
@@ -666,7 +667,7 @@ func (p *CloudFlareProvider) submitChanges(ctx context.Context, changes []*cloud
 					failedChange = true
 					log.WithFields(logFields).Errorf("failed to update record: %v", err)
 				}
-			} else if change.Action == cloudFlareDelete {
+			case cloudFlareDelete:
 				recordID := p.getRecordID(records, change.ResourceRecord)
 				if recordID == "" {
 					log.WithFields(logFields).Errorf("failed to find previous record: %v", change.ResourceRecord)
@@ -680,7 +681,7 @@ func (p *CloudFlareProvider) submitChanges(ctx context.Context, changes []*cloud
 				if !p.submitCustomHostnameChanges(ctx, zoneID, change, chs, logFields) {
 					failedChange = true
 				}
-			} else if change.Action == cloudFlareCreate {
+			case cloudFlareCreate:
 				recordParam := getCreateDNSRecordParam(zoneID, change)
 				_, err := p.Client.CreateDNSRecord(ctx, recordParam)
 				if err != nil {
diff --git a/provider/coredns/coredns.go b/provider/coredns/coredns.go
index 55e0cd1764..b6c881dcf6 100644
--- a/provider/coredns/coredns.go
+++ b/provider/coredns/coredns.go
@@ -163,9 +163,10 @@ func getETCDConfig() (*etcdcv3.Config, error) {
 	firstURL := strings.ToLower(etcdURLs[0])
 	etcdUsername := os.Getenv("ETCD_USERNAME")
 	etcdPassword := os.Getenv("ETCD_PASSWORD")
-	if strings.HasPrefix(firstURL, "http://") {
+	switch {
+	case strings.HasPrefix(firstURL, "http://"):
 		return &etcdcv3.Config{Endpoints: etcdURLs, Username: etcdUsername, Password: etcdPassword}, nil
-	} else if strings.HasPrefix(firstURL, "https://") {
+	case strings.HasPrefix(firstURL, "https://"):
 		tlsConfig, err := tlsutils.CreateTLSConfig("ETCD")
 		if err != nil {
 			return nil, err
@@ -177,7 +178,7 @@ func getETCDConfig() (*etcdcv3.Config, error) {
 			Username:  etcdUsername,
 			Password:  etcdPassword,
 		}, nil
-	} else {
+	default:
 		return nil, errors.New("etcd URLs must start with either http:// or https://")
 	}
 }
diff --git a/provider/digitalocean/digital_ocean_test.go b/provider/digitalocean/digital_ocean_test.go
index e174fe067f..deee1a8cd9 100644
--- a/provider/digitalocean/digital_ocean_test.go
+++ b/provider/digitalocean/digital_ocean_test.go
@@ -195,11 +195,12 @@ func isEmpty(xs interface{}) bool {
 // call to ObjectsAreEqual replaced with cmp.Equal which better handles struct's with pointers to
 // other structs. It also ignores ordering when comparing unlike cmp.Equal.
 func elementsMatch(t *testing.T, listA, listB interface{}, msgAndArgs ...interface{}) bool {
-	if listA == nil && listB == nil {
+	switch {
+	case listA == nil && listB == nil:
 		return true
-	} else if listA == nil {
+	case listA == nil:
 		return isEmpty(listB)
-	} else if listB == nil {
+	case listB == nil:
 		return isEmpty(listA)
 	}
 
diff --git a/provider/godaddy/godaddy.go b/provider/godaddy/godaddy.go
index 045cd2332b..d732f79113 100644
--- a/provider/godaddy/godaddy.go
+++ b/provider/godaddy/godaddy.go
@@ -178,16 +178,17 @@ func (p *GDProvider) zonesRecords(ctx context.Context, all bool) ([]string, []gd
 		return nil, nil, err
 	}
 
-	if len(zones) == 0 {
+	switch len(zones) {
+	case 0:
 		allRecords = []gdRecords{}
-	} else if len(zones) == 1 {
+	case 1:
 		record, err := p.records(&ctx, zones[0], all)
 		if err != nil {
 			return nil, nil, err
 		}
 
 		allRecords = append(allRecords, *record)
-	} else {
+	default:
 		chRecords := make(chan gdRecords, len(zones))
 
 		eg, ctx := errgroup.WithContext(ctx)
diff --git a/provider/oci/oci.go b/provider/oci/oci.go
index dcd999e64f..88b2fef0d3 100644
--- a/provider/oci/oci.go
+++ b/provider/oci/oci.go
@@ -100,7 +100,8 @@ func NewOCIProvider(cfg OCIConfig, domainFilter *endpoint.DomainFilter, zoneIDFi
 	if cfg.Auth.UseInstancePrincipal && cfg.Auth.UseWorkloadIdentity {
 		return nil, errors.New("only one of 'useInstancePrincipal' and 'useWorkloadIdentity' may be enabled for Oracle authentication")
 	}
-	if cfg.Auth.UseWorkloadIdentity {
+	switch {
+	case cfg.Auth.UseWorkloadIdentity:
 		// OCI SDK requires specific, dynamic environment variables for workload identity.
 		if err := os.Setenv(auth.ResourcePrincipalVersionEnvVar, auth.ResourcePrincipalVersion2_2); err != nil {
 			return nil, fmt.Errorf("unable to set OCI SDK environment variable: %s: %w", auth.ResourcePrincipalVersionEnvVar, err)
@@ -112,12 +113,12 @@ func NewOCIProvider(cfg OCIConfig, domainFilter *endpoint.DomainFilter, zoneIDFi
 		if err != nil {
 			return nil, fmt.Errorf("error creating OCI workload identity config provider: %w", err)
 		}
-	} else if cfg.Auth.UseInstancePrincipal {
+	case cfg.Auth.UseInstancePrincipal:
 		configProvider, err = auth.InstancePrincipalConfigurationProvider()
 		if err != nil {
 			return nil, fmt.Errorf("error creating OCI instance principal config provider: %w", err)
 		}
-	} else {
+	default:
 		configProvider = common.NewRawConfigurationProvider(
 			cfg.Auth.TenancyID,
 			cfg.Auth.UserID,
diff --git a/provider/ovh/ovh.go b/provider/ovh/ovh.go
index d3c696ad65..ac5d31b2c4 100644
--- a/provider/ovh/ovh.go
+++ b/provider/ovh/ovh.go
@@ -552,7 +552,7 @@ func (p *OVHProvider) newOvhChangeCreateDelete(action int, endpoints []*endpoint
 	return ovhChanges, existingRecords
 }
 
-func convertDNSNameIntoSubDomain(DNSName string, zoneName string) string {
+func convertDNSNameIntoSubDomain(DNSName string, zoneName string) string { // nolint: gocritic // captLocal
 	if DNSName == zoneName {
 		return ""
 	}
diff --git a/provider/pdns/pdns_test.go b/provider/pdns/pdns_test.go
index 2dad269550..cac49221ef 100644
--- a/provider/pdns/pdns_test.go
+++ b/provider/pdns/pdns_test.go
@@ -688,11 +688,12 @@ func (c *PDNSAPIClientStubEmptyZones) PartitionZones(zones []pgo.Zone) ([]pgo.Zo
 }
 
 func (c *PDNSAPIClientStubEmptyZones) ListZone(zoneID string) (pgo.Zone, *http.Response, error) {
-	if strings.Contains(zoneID, "example.com") {
+	switch {
+	case strings.Contains(zoneID, "example.com"):
 		return ZoneEmpty, nil, nil
-	} else if strings.Contains(zoneID, "mock.test") {
+	case strings.Contains(zoneID, "mock.test"):
 		return ZoneEmpty2, nil, nil
-	} else if strings.Contains(zoneID, "long.domainname.example.com") {
+	case strings.Contains(zoneID, "long.domainname.example.com"):
 		return ZoneEmptyLong, nil, nil
 	}
 	return pgo.Zone{}, nil, nil
@@ -751,13 +752,14 @@ func (c *PDNSAPIClientStubPartitionZones) ListZones() ([]pgo.Zone, *http.Respons
 }
 
 func (c *PDNSAPIClientStubPartitionZones) ListZone(zoneID string) (pgo.Zone, *http.Response, error) {
-	if strings.Contains(zoneID, "example.com") {
+	switch {
+	case strings.Contains(zoneID, "example.com"):
 		return ZoneEmpty, nil, nil
-	} else if strings.Contains(zoneID, "mock.test") {
+	case strings.Contains(zoneID, "mock.test"):
 		return ZoneEmpty2, nil, nil
-	} else if strings.Contains(zoneID, "long.domainname.example.com") {
+	case strings.Contains(zoneID, "long.domainname.example.com"):
 		return ZoneEmptyLong, nil, nil
-	} else if strings.Contains(zoneID, "simexample.com") {
+	case strings.Contains(zoneID, "simexample.com"):
 		return ZoneEmptySimilar, nil, nil
 	}
 	return pgo.Zone{}, nil, nil
diff --git a/provider/pihole/clientV6.go b/provider/pihole/clientV6.go
index 3168b497cf..ab616ddcf1 100644
--- a/provider/pihole/clientV6.go
+++ b/provider/pihole/clientV6.go
@@ -191,7 +191,7 @@ func (p *piholeClientV6) listRecords(ctx context.Context, rtype string) ([]*endp
 		ep := endpoint.NewEndpointWithTTL(DNSName, rtype, Ttl, Target)
 
 		if oldEp, ok := endpoints[DNSName]; ok {
-			ep.Targets = append(oldEp.Targets, Target)
+			ep.Targets = append(oldEp.Targets, Target) // nolint: gocritic // appendAssign
 		}
 
 		endpoints[DNSName] = ep
@@ -353,11 +353,9 @@ func (p *piholeClientV6) retrieveNewToken(ctx context.Context) error {
 	var apiResponse ApiAuthResponse
 	if err := json.Unmarshal(jRes, &apiResponse); err != nil {
 		log.Errorf("Auth Query : failed to unmarshal error response: %v", err)
-	} else {
+	} else if apiResponse.Session.SID != "" {
 		// Set the token
-		if apiResponse.Session.SID != "" {
-			p.token = apiResponse.Session.SID
-		}
+		p.token = apiResponse.Session.SID
 	}
 	return err
 }
diff --git a/provider/pihole/clientV6_test.go b/provider/pihole/clientV6_test.go
index 5b53937746..34be0e28b3 100644
--- a/provider/pihole/clientV6_test.go
+++ b/provider/pihole/clientV6_test.go
@@ -27,6 +27,7 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+
 	"sigs.k8s.io/external-dns/endpoint"
 )
 
@@ -62,7 +63,7 @@ func TestIsValidIPv6(t *testing.T) {
 	}{
 		{"2001:0db8:85a3:0000:0000:8a2e:0370:7334", true},
 		{"2001:db8:85a3::8a2e:370:7334", true},
-		//IPv6 dual, the format is y:y:y:y:y:y:x.x.x.x.
+		// IPv6 dual, the format is y:y:y:y:y:y:x.x.x.x.
 		{"::ffff:192.168.20.3", true},
 		{"::1", true},
 		{"::", true},
@@ -191,7 +192,8 @@ func TestNewPiholeClientV6(t *testing.T) {
 func TestListRecordsV6(t *testing.T) {
 	// Create a test server
 	srvr := newTestServerV6(t, func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == "/api/config/dns/hosts" && r.Method == http.MethodGet {
+		switch {
+		case r.URL.Path == "/api/config/dns/hosts" && r.Method == http.MethodGet:
 
 			w.WriteHeader(http.StatusOK)
 			w.Header().Set("Content-Type", "application/json")
@@ -220,7 +222,7 @@ func TestListRecordsV6(t *testing.T) {
 			}`)); err != nil {
 				t.Fatal(err)
 			}
-		} else if r.URL.Path == "/api/config/dns/cnameRecords" && r.Method == http.MethodGet {
+		case r.URL.Path == "/api/config/dns/cnameRecords" && r.Method == http.MethodGet:
 
 			w.WriteHeader(http.StatusOK)
 			w.Header().Set("Content-Type", "application/json")
@@ -238,7 +240,7 @@ func TestListRecordsV6(t *testing.T) {
 				},
 				"took": 5
 			}`))
-		} else {
+		default:
 			http.NotFound(w, r)
 		}
 	})
@@ -391,7 +393,7 @@ func TestListRecordsV6(t *testing.T) {
 }
 
 func TestErrorsV6(t *testing.T) {
-	//Error test cases
+	// Error test cases
 
 	// Create a client
 	cfgErrURL := PiholeConfig{
@@ -439,7 +441,8 @@ func TestErrorsV6(t *testing.T) {
 
 	// bad record format return by server
 	srvrErr := newTestServerV6(t, func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == "/api/config/dns/hosts" && r.Method == http.MethodGet {
+		switch {
+		case r.URL.Path == "/api/config/dns/hosts" && r.Method == http.MethodGet:
 			w.WriteHeader(http.StatusOK)
 			w.Header().Set("Content-Type", "application/json")
 
@@ -454,7 +457,7 @@ func TestErrorsV6(t *testing.T) {
 				},
 				"took": 5
 			}`))
-		} else if r.URL.Path == "/api/config/dns/cnameRecords" && r.Method == http.MethodGet {
+		case r.URL.Path == "/api/config/dns/cnameRecords" && r.Method == http.MethodGet:
 			w.WriteHeader(http.StatusOK)
 			w.Header().Set("Content-Type", "application/json")
 
@@ -470,7 +473,7 @@ func TestErrorsV6(t *testing.T) {
 				},
 				"took": 5
 			}`))
-		} else {
+		default:
 			http.NotFound(w, r)
 		}
 	})
@@ -619,7 +622,8 @@ func TestTokenValidity(t *testing.T) {
 func TestDo(t *testing.T) {
 
 	srvDo := newTestServerV6(t, func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == "/api/auth/ok" && r.Method == http.MethodGet {
+		switch {
+		case r.URL.Path == "/api/auth/ok" && r.Method == http.MethodGet:
 			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusOK)
 			// Return bad content
@@ -634,7 +638,7 @@ func TestDo(t *testing.T) {
 			},
 			"took": 0.16
 			}`))
-		} else if r.URL.Path == "/api/auth" && r.Method == http.MethodPost {
+		case r.URL.Path == "/api/auth" && r.Method == http.MethodPost:
 			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusOK)
 			// Return bad content
@@ -649,7 +653,7 @@ func TestDo(t *testing.T) {
 			},
 			"took": 0.15
 			}`))
-		} else if r.URL.Path == "/api/auth" && r.Method == http.MethodGet {
+		case r.URL.Path == "/api/auth" && r.Method == http.MethodGet:
 			w.WriteHeader(http.StatusUnauthorized)
 			// Return bad content
 			w.Write([]byte(`{
@@ -660,7 +664,7 @@ func TestDo(t *testing.T) {
 			},
 			"took": 0.14
 			}`))
-		} else if r.URL.Path == "/api/auth/418" && r.Method == http.MethodGet {
+		case r.URL.Path == "/api/auth/418" && r.Method == http.MethodGet:
 			w.WriteHeader(http.StatusTeapot)
 			// Return bad content
 			w.Write([]byte(`{
@@ -671,11 +675,11 @@ func TestDo(t *testing.T) {
 			},
 			"took": 0.13
 			}`))
-		} else if r.URL.Path == "/api/auth/nojson" && r.Method == http.MethodGet {
+		case r.URL.Path == "/api/auth/nojson" && r.Method == http.MethodGet:
 			// Return bad content
 			w.WriteHeader(http.StatusTeapot)
 			w.Write([]byte(`Not a JSON`))
-		} else if r.URL.Path == "/api/auth/401" && r.Method == http.MethodGet {
+		case r.URL.Path == "/api/auth/401" && r.Method == http.MethodGet:
 			w.WriteHeader(http.StatusUnauthorized)
 			// Return bad content
 			w.Write([]byte(`{
diff --git a/provider/pihole/client_test.go b/provider/pihole/client_test.go
index 912b631b5b..02745271ba 100644
--- a/provider/pihole/client_test.go
+++ b/provider/pihole/client_test.go
@@ -238,7 +238,7 @@ func testErrorScenarios(t *testing.T, srvrErr *httptest.Server) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	//set clExpired.token to a valid token
+	// set clExpired.token to a valid token
 	clExpired.(*piholeClient).token = "expired"
 	clExpired.(*piholeClient).cfg.Password = "notcorrect"
 
@@ -297,7 +297,7 @@ func TestErrorScenarios(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	//set clExpired.token to a valid token
+	// set clExpired.token to a valid token
 	clExpired.(*piholeClient).token = "expired"
 	clExpired.(*piholeClient).cfg.Password = "notcorrect"
 
diff --git a/provider/rfc2136/rfc2136_test.go b/provider/rfc2136/rfc2136_test.go
index fc3d65c3ff..6adebe979a 100644
--- a/provider/rfc2136/rfc2136_test.go
+++ b/provider/rfc2136/rfc2136_test.go
@@ -116,7 +116,7 @@ func (r *rfc2136Stub) SendMessage(msg *dns.Msg) error {
 			break
 		}
 
-		line = strings.Replace(line, "\t", " ", -1)
+		line = strings.ReplaceAll(line, "\t", " ")
 		log.Info(line)
 		record := strings.Split(line, " ")[0]
 		if !strings.HasSuffix(record, zone) {
diff --git a/registry/txt.go b/registry/txt.go
index d814192183..fef387e26a 100644
--- a/registry/txt.go
+++ b/registry/txt.go
@@ -60,7 +60,7 @@ type TXTRegistry struct {
 	txtEncryptEnabled bool
 	txtEncryptAESKey  []byte
 
-	//Handle Owner ID migration
+	// Handle Owner ID migration
 	oldOwnerID string
 
 	// existingTXTs is the TXT records that already exist in the zone so that
diff --git a/registry/txt_test.go b/registry/txt_test.go
index b5146aa49b..ed3876479a 100644
--- a/registry/txt_test.go
+++ b/registry/txt_test.go
@@ -2032,7 +2032,7 @@ func TestTXTRegistryRecreatesMissingRecords(t *testing.T) {
 					registry, err := NewTXTRegistry(p, "", "", ownerId, time.Hour, "", managedRecords, nil, false, nil, "")
 					assert.NoError(t, err)
 
-					expectedRecords := append(existing, expectedCreate...)
+					expectedRecords := append(existing, expectedCreate...) // nolint:gocritic
 
 					// Simulate the reconciliation loop by executing multiple times
 					reconciliationLoops := 3
diff --git a/source/annotations/provider_specific.go b/source/annotations/provider_specific.go
index 31f059a51d..fa70a8654a 100644
--- a/source/annotations/provider_specific.go
+++ b/source/annotations/provider_specific.go
@@ -55,27 +55,28 @@ func ProviderSpecificAnnotations(annotations map[string]string) (endpoint.Provid
 				Value: v,
 			})
 		} else if strings.HasPrefix(k, CloudflarePrefix) {
-			if strings.Contains(k, CloudflareCustomHostnameKey) {
+			switch {
+			case strings.Contains(k, CloudflareCustomHostnameKey):
 				providerSpecificAnnotations = append(providerSpecificAnnotations, endpoint.ProviderSpecificProperty{
 					Name:  CloudflareCustomHostnameKey,
 					Value: v,
 				})
-			} else if strings.Contains(k, CloudflareProxiedKey) {
+			case strings.Contains(k, CloudflareProxiedKey):
 				providerSpecificAnnotations = append(providerSpecificAnnotations, endpoint.ProviderSpecificProperty{
 					Name:  CloudflareProxiedKey,
 					Value: v,
 				})
-			} else if strings.Contains(k, CloudflareRegionKey) {
+			case strings.Contains(k, CloudflareRegionKey):
 				providerSpecificAnnotations = append(providerSpecificAnnotations, endpoint.ProviderSpecificProperty{
 					Name:  CloudflareRegionKey,
 					Value: v,
 				})
-			} else if strings.Contains(k, CloudflareRecordCommentKey) {
+			case strings.Contains(k, CloudflareRecordCommentKey):
 				providerSpecificAnnotations = append(providerSpecificAnnotations, endpoint.ProviderSpecificProperty{
 					Name:  CloudflareRecordCommentKey,
 					Value: v,
 				})
-			} else if strings.Contains(k, CloudflareTagsKey) {
+			case strings.Contains(k, CloudflareTagsKey):
 				providerSpecificAnnotations = append(providerSpecificAnnotations, endpoint.ProviderSpecificProperty{
 					Name:  CloudflareTagsKey,
 					Value: v,
diff --git a/source/gateway_test.go b/source/gateway_test.go
index 940622e958..0391855f2c 100644
--- a/source/gateway_test.go
+++ b/source/gateway_test.go
@@ -154,7 +154,7 @@ func TestGatewayMatchingProtocol(t *testing.T) {
 						tt.route, tt.lis, ok, tt.ok,
 					)
 				}
-				//tt.a, tt.b = tt.b, tt.a
+				// tt.a, tt.b = tt.b, tt.a
 			}
 		})
 
diff --git a/source/gloo_proxy.go b/source/gloo_proxy.go
index 63eafecf0e..cfeefa2ed0 100644
--- a/source/gloo_proxy.go
+++ b/source/gloo_proxy.go
@@ -229,8 +229,7 @@ func (gs *glooSource) proxyTargets(ctx context.Context, name string, namespace s
 }
 
 func sourceKind(kind string) *schema.GroupVersionResource {
-	switch kind {
-	case "*v1.VirtualService":
+	if kind == "*v1.VirtualService" {
 		return &virtualServiceGVR
 	}
 	return nil
diff --git a/source/service.go b/source/service.go
index a4e2f522f3..e2d3f4cfef 100644
--- a/source/service.go
+++ b/source/service.go
@@ -455,7 +455,8 @@ func (sc *serviceSource) getTargetsForDomain(
 	endpointsType, headlessDomain string) endpoint.Targets {
 	targets := annotations.TargetsFromTargetAnnotation(pod.Annotations)
 	if len(targets) == 0 {
-		if endpointsType == EndpointsTypeNodeExternalIP {
+		switch {
+		case endpointsType == EndpointsTypeNodeExternalIP:
 			if sc.nodeInformer == nil {
 				log.Warnf("Skipping EndpointSlice %s/%s as --service-type-filter disable node informer", endpointSlice.Namespace, endpointSlice.Name)
 				return nil
@@ -471,10 +472,10 @@ func (sc *serviceSource) getTargetsForDomain(
 					log.Debugf("Generating matching endpoint %s with NodeExternalIP %s", headlessDomain, address.Address)
 				}
 			}
-		} else if endpointsType == EndpointsTypeHostIP || sc.publishHostIP {
+		case endpointsType == EndpointsTypeHostIP || sc.publishHostIP:
 			targets = endpoint.Targets{pod.Status.HostIP}
 			log.Debugf("Generating matching endpoint %s with HostIP %s", headlessDomain, pod.Status.HostIP)
-		} else {
+		default:
 			if len(ep.Addresses) == 0 {
 				log.Warnf("EndpointSlice %s/%s has no addresses for endpoint %v", endpointSlice.Namespace, endpointSlice.Name, ep)
 				return nil
@@ -744,7 +745,7 @@ func (sc *serviceSource) nodesExternalTrafficPolicyTypeLocal(svc *v1.Service) []
 			}
 
 			if _, ok := nodesMap[node]; !ok {
-				nodesMap[node] = *new(struct{})
+				nodesMap[node] = struct{}{}
 				nodesRunning = append(nodesRunning, node)
 
 				if isPodStatusReady(v.Status) {
@@ -761,14 +762,15 @@ func (sc *serviceSource) nodesExternalTrafficPolicyTypeLocal(svc *v1.Service) []
 	// Prioritize nodes with non-terminating ready pods
 	// If none available, fall back to nodes with ready pods
 	// If still none, use nodes with any running pods
-	if len(nodes) > 0 {
+	switch {
+	case len(nodes) > 0:
 		// Works the same as service endpoints
-	} else if len(nodesReady) > 0 {
+	case len(nodesReady) > 0:
 		// 2 level of panic modes as safeguard, because old wrong behavior can be used by someone
 		// Publish all endpoints not always a bad thing
 		log.Debugf("All pods in terminating state, use ready")
 		nodes = nodesReady
-	} else {
+	default:
 		log.Debugf("All pods not ready, use all running")
 		nodes = nodesRunning
 	}
diff --git a/source/store.go b/source/store.go
index 9dbc568726..103ec94a3d 100644
--- a/source/store.go
+++ b/source/store.go
@@ -20,9 +20,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"net/http"
 	"os"
-
 	"sync"
 	"time"
 
@@ -627,9 +625,7 @@ func instrumentedRESTConfig(kubeConfig, apiServerURL string, requestTimeout time
 		return nil, err
 	}
 
-	config.WrapTransport = func(rt http.RoundTripper) http.RoundTripper {
-		return extdnshttp.NewInstrumentedTransport(rt)
-	}
+	config.WrapTransport = extdnshttp.NewInstrumentedTransport
 
 	config.Timeout = requestTimeout
 	return config, nil
diff --git a/source/utils.go b/source/utils.go
index 5858fddb85..3eb303ed07 100644
--- a/source/utils.go
+++ b/source/utils.go
@@ -46,11 +46,12 @@ func ParseIngress(ingress string) (string, string, error) {
 	var namespace, name string
 	var err error
 	parts := strings.Split(ingress, "/")
-	if len(parts) == 2 {
+	switch len(parts) {
+	case 2:
 		namespace, name = parts[0], parts[1]
-	} else if len(parts) == 1 {
+	case 1:
 		name = parts[0]
-	} else {
+	default:
 		err = fmt.Errorf("invalid ingress name (name or namespace/name) found %q", ingress)
 	}
 
diff --git a/source/wrappers/multisource_test.go b/source/wrappers/multisource_test.go
index 082ed1c7cf..9ba418c2f8 100644
--- a/source/wrappers/multisource_test.go
+++ b/source/wrappers/multisource_test.go
@@ -132,8 +132,8 @@ func testMultiSourceEndpointsDefaultTargets(t *testing.T) {
 		defaultTargetsA := []string{"127.0.0.1", "127.0.0.2"}
 		defaultTargetsAAAA := []string{"2001:db8::1"}
 		defaultTargetsCName := []string{"foo.example.org"}
-		defaultTargets := append(defaultTargetsA, defaultTargetsCName...)
-		defaultTargets = append(defaultTargets, defaultTargetsAAAA...)
+		defaultTargets := append(defaultTargetsA, defaultTargetsCName...) // nolint: gocritic // appendAssign
+		defaultTargets = append(defaultTargets, defaultTargetsAAAA...)    // nolint: gocritic // appendAssign
 		labels := endpoint.Labels{"foo": "bar"}
 
 		// Endpoints FROM SOURCE has NO targets
@@ -200,8 +200,8 @@ func testMultiSourceEndpointsDefaultTargets(t *testing.T) {
 		defaultTargetsA := []string{"127.0.0.1", "127.0.0.2"}
 		defaultTargetsAAAA := []string{"2001:db8::1"}
 		defaultTargetsCName := []string{"foo.example.org"}
-		defaultTargets := append(defaultTargetsA, defaultTargetsCName...)
-		defaultTargets = append(defaultTargets, defaultTargetsAAAA...)
+		defaultTargets := append(defaultTargetsA, defaultTargetsCName...) // nolint: gocritic // appendAssign
+		defaultTargets = append(defaultTargets, defaultTargetsAAAA...)    // nolint: gocritic // appendAssign
 		labels := endpoint.Labels{"foo": "bar"}
 
 		// Endpoints FROM SOURCE HAS targets
@@ -238,8 +238,8 @@ func testMultiSourceEndpointsDefaultTargets(t *testing.T) {
 		defaultTargetsA := []string{"127.0.0.1", "127.0.0.2"}
 		defaultTargetsAAAA := []string{"2001:db8::1"}
 		defaultTargetsCName := []string{"foo.example.org"}
-		defaultTargets := append(defaultTargetsA, defaultTargetsAAAA...)
-		defaultTargets = append(defaultTargets, defaultTargetsCName...)
+		defaultTargets := append(defaultTargetsA, defaultTargetsAAAA...) // nolint: gocritic // appendAssign
+		defaultTargets = append(defaultTargets, defaultTargetsCName...)  // nolint: gocritic // appendAssign
 
 		labels := endpoint.Labels{"foo": "bar"}