diff --git a/.github/workflows/scripts/install-docker.sh b/.github/workflows/scripts/install-docker.sh
new file mode 100755
index 00000000..d6a215e9
--- /dev/null
+++ b/.github/workflows/scripts/install-docker.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+set -x
+VER="20.10.19"
+curl -L -o /tmp/docker-$VER.tgz https://download.docker.com/linux/static/stable/x86_64/docker-$VER.tgz
+tar -xz -C /tmp -f /tmp/docker-$VER.tgz
+mkdir -vp ~/.docker/cli-plugins/
+curl --silent -L "https://github.com/docker/buildx/releases/download/v0.3.0/buildx-v0.3.0.linux-amd64" > ~/.docker/cli-plugins/docker-buildx
+chmod a+x ~/.docker/cli-plugins/docker-buildx
+mv /tmp/docker/* /usr/bin
+docker run --privileged --rm tonistiigi/binfmt --install all
diff --git a/.github/workflows/test-build-deploy.yml b/.github/workflows/test-build-deploy.yml
index ca671be5..6be57848 100644
--- a/.github/workflows/test-build-deploy.yml
+++ b/.github/workflows/test-build-deploy.yml
@@ -34,17 +34,14 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - name: Setup Git safe.directory
-        run: |
-          echo "this step is needed because when running in container, actions/checkout does not set safe.directory effectively."
-          echo "See https://github.com/actions/runner/issues/2033. We should use --system instead of --global"
-          git config --system --add safe.directory $GITHUB_WORKSPACE
-        # Commands in the Makefile are hardcoded with an assumed file structure of the CI container
-        # Symlink ensures paths specified in previous commands don’t break
       - name: Sym Link Expected Path to Workspace
         run: |
-          mkdir -p /go/src/github.com/cortexproject/weaveworks-common
-          ln -s $GITHUB_WORKSPACE/* /go/src/github.com/cortexproject/weaveworks-common
+          sudo mkdir -p /go/src/github.com/cortexproject/weaveworks-common
+          sudo ln -s $GITHUB_WORKSPACE/* /go/src/github.com/cortexproject/weaveworks-common
+      - name: Install Docker Client
+        run: sudo ./.github/workflows/scripts/install-docker.sh
+      - name: Go mod Vendor
+        run: go mod vendor
       - name: CheckProtos
         run: make check-protos
 
diff --git a/Makefile b/Makefile
index 82fdf0d0..f33c8ea7 100644
--- a/Makefile
+++ b/Makefile
@@ -14,9 +14,9 @@ GO_FLAGS := -ldflags "-extldflags \"-static\" -linkmode=external -s -w" -tags ne
 PROTOC_IMAGE=namely/protoc:1.23_0
 
 protos:
-	docker run $(RM) --user $(id -u):$(id -g) -v $(shell pwd):/go/src/github.com/weaveworks/common -w /go/src/github.com/weaveworks/common $(PROTOC_IMAGE) --proto_path=/go/src/github.com/weaveworks/common --go_out=plugins=grpc:/go/src/ server/fake_server.proto
-	docker run $(RM) --user $(id -u):$(id -g) -v $(shell pwd):/go/src/github.com/weaveworks/common -w /go/src/github.com/weaveworks/common $(PROTOC_IMAGE) --proto_path=/go/src/github.com/weaveworks/common --go_out=plugins=grpc:/go/src/ middleware/middleware_test/echo_server.proto
-	docker run $(RM) --user $(id -u):$(id -g) -v $(shell pwd):/go/src/github.com/weaveworks/common -w /go/src/github.com/weaveworks/common $(PROTOC_IMAGE) -I/go/src/github.com/weaveworks/common -I/go/src/github.com/weaveworks/common/vendor/github.com/gogo/protobuf/ --proto_path=/go/src/github.com/weaveworks/common --gogofast_out=plugins=grpc:/go/src/ httpgrpc/httpgrpc.proto
+	docker run $(RM) --user $(id -u):$(id -g) -v $(shell pwd):/go/src/github.com/cortexproject/weaveworks-common -w /go/src/github.com/cortexproject/weaveworks-common $(PROTOC_IMAGE) --proto_path=/go/src/github.com/cortexproject/weaveworks-common --go_out=plugins=grpc:/go/src/ server/fake_server.proto
+	docker run $(RM) --user $(id -u):$(id -g) -v $(shell pwd):/go/src/github.com/cortexproject/weaveworks-common -w /go/src/github.com/cortexproject/weaveworks-common $(PROTOC_IMAGE) --proto_path=/go/src/github.com/cortexproject/weaveworks-common --go_out=plugins=grpc:/go/src/ middleware/middleware_test/echo_server.proto
+	docker run $(RM) --user $(id -u):$(id -g) -v $(shell pwd):/go/src/github.com/cortexproject/weaveworks-common -w /go/src/github.com/cortexproject/weaveworks-common $(PROTOC_IMAGE) -I/go/src/github.com/cortexproject/weaveworks-common -I/go/src/github.com/cortexproject/weaveworks-common/vendor/github.com/gogo/protobuf/ --proto_path=/go/src/github.com/cortexproject/weaveworks-common --gogofast_out=plugins=grpc:/go/src/ httpgrpc/httpgrpc.proto
 
 protos: $(GENERATED_PROTOS)
 
diff --git a/instrument/instrument_test.go b/instrument/instrument_test.go
index 91934e06..29d8c606 100644
--- a/instrument/instrument_test.go
+++ b/instrument/instrument_test.go
@@ -60,7 +60,7 @@ func TestCollectedRequest(t *testing.T) {
 
 func TestCollectedRequest_Error(t *testing.T) {
 	c := &spyCollector{}
-	require.NoError(t, instrument.CollectedRequest(context.Background(), "test", c, nil, func(_ context.Context) error {
+	require.Error(t, instrument.CollectedRequest(context.Background(), "test", c, nil, func(_ context.Context) error {
 		return errors.New("boom")
 	}))
 	assert.True(t, c.before)
diff --git a/mflag/flag_test.go b/mflag/flag_test.go
index 505dbc60..810edf5a 100644
--- a/mflag/flag_test.go
+++ b/mflag/flag_test.go
@@ -85,7 +85,7 @@ func TestEverything(t *testing.T) {
 	require.NoError(t, Set("test_uint64", "1"))
 	require.NoError(t, Set("test_string", "1"))
 	require.NoError(t, Set("test_float64", "1"))
-	require.NoError(t, Set("testrequire.NoError(_duration", "1s"))
+	require.NoError(t, Set("test_duration", "1s"))
 	desired = "1"
 	Visit(visitor)
 	if len(m) != 8 {
@@ -276,7 +276,7 @@ func testPanic(f *FlagSet, t *testing.T) {
 	args := []string{
 		"-int", "21",
 	}
-	require.NoError(t, f.Parse(args))
+	f.Parse(args) //nolint:errcheck
 }
 
 func TestParsePanic(t *testing.T) {
@@ -368,7 +368,7 @@ func TestSetOutput(t *testing.T) {
 	var buf bytes.Buffer
 	flags.SetOutput(&buf)
 	flags.Init("test", ContinueOnError)
-	require.NoError(t, flags.Parse([]string{"-unknown"}))
+	flags.Parse([]string{"-unknown"}) //nolint:errcheck
 	if out := buf.String(); !strings.Contains(out, "-unknown") {
 		t.Logf("expected output mentioning unknown; got %q", out)
 	}
diff --git a/middleware/logging_test.go b/middleware/logging_test.go
index 2c44718b..fb8339aa 100644
--- a/middleware/logging_test.go
+++ b/middleware/logging_test.go
@@ -38,8 +38,7 @@ func TestBadWriteLogging(t *testing.T) {
 			Log: logging.Logrus(logrusLogger),
 		}
 		handler := func(w http.ResponseWriter, r *http.Request) {
-			_, err := io.WriteString(w, "<html><body>Hello World!</body></html>")
-			require.NoError(t, err)
+			io.WriteString(w, "<html><body>Hello World!</body></html>") //nolint:errcheck
 		}
 		loggingHandler := loggingMiddleware.Wrap(http.HandlerFunc(handler))
 
@@ -129,8 +128,7 @@ func TestLoggingRequestsAtInfoLevel(t *testing.T) {
 			LogRequestAtInfoLevel: true,
 		}
 		handler := func(w http.ResponseWriter, r *http.Request) {
-			_, err := io.WriteString(w, "<html><body>Hello World!</body></html>")
-			require.NoError(t, err)
+			io.WriteString(w, "<html><body>Hello World!</body></html>") //nolint:errcheck
 		}
 		loggingHandler := loggingMiddleware.Wrap(http.HandlerFunc(handler))
 
diff --git a/server/server_test.go b/server/server_test.go
index a8395eb7..437a0aa9 100644
--- a/server/server_test.go
+++ b/server/server_test.go
@@ -125,12 +125,12 @@ func TestDefaultAddresses(t *testing.T) {
 		w.WriteHeader(204)
 	})
 
-	go require.NoError(t, server.Run())
+	go server.Run() //nolint:errcheck
 	defer server.Shutdown()
 
 	conn, err := grpc.Dial("localhost:9095", grpc.WithTransportCredentials(insecure.NewCredentials()))
 	require.NoError(t, err)
-	defer require.NoError(t, conn.Close())
+	defer conn.Close() //nolint:errcheck
 
 	empty := protobuf.Empty{}
 	client := NewFakeServerClient(conn)
@@ -167,11 +167,11 @@ func TestErrorInstrumentationMiddleware(t *testing.T) {
 		w.WriteHeader(http.StatusNotFound)
 	})
 
-	go require.NoError(t, server.Run())
+	go server.Run() //nolint:errcheck
 
 	conn, err := grpc.Dial("localhost:1234", grpc.WithTransportCredentials(insecure.NewCredentials()))
 	require.NoError(t, err)
-	defer require.NoError(t, conn.Close())
+	defer conn.Close() //nolint:errcheck
 
 	empty := protobuf.Empty{}
 	client := NewFakeServerClient(conn)
@@ -306,7 +306,7 @@ func TestHTTPInstrumentationMetrics(t *testing.T) {
 		_ = cancelableSleep(r.Context(), time.Second*10)
 	})
 
-	go require.NoError(t, server.Run())
+	go server.Run() //nolint:errcheck
 
 	callThenCancel := func(f func(ctx context.Context) error) error {
 		ctx, cancel := context.WithCancel(context.Background())
@@ -501,7 +501,7 @@ func TestMiddlewareLogging(t *testing.T) {
 		w.WriteHeader(500)
 	})
 
-	go require.NoError(t, server.Run())
+	go server.Run() //nolint:errcheck
 	defer server.Shutdown()
 
 	req, err := http.NewRequest("GET", "http://127.0.0.1:9192/error500", nil)
@@ -550,7 +550,7 @@ func TestTLSServer(t *testing.T) {
 	fakeServer := FakeServer{}
 	RegisterFakeServerServer(server.GRPC, fakeServer)
 
-	go require.NoError(t, server.Run())
+	go server.Run() //nolint:errcheck
 	defer server.Shutdown()
 
 	clientCert, err := tls.LoadX509KeyPair("certs/client.crt", "certs/client.key")
@@ -574,7 +574,7 @@ func TestTLSServer(t *testing.T) {
 	client := &http.Client{Transport: tr}
 	res, err := client.Get("https://localhost:9193/testhttps")
 	require.NoError(t, err)
-	defer require.NoError(t, res.Body.Close())
+	defer res.Body.Close() //nolint:errcheck
 
 	require.Equal(t, res.StatusCode, http.StatusOK)
 
@@ -585,7 +585,7 @@ func TestTLSServer(t *testing.T) {
 
 	conn, err := grpc.Dial("localhost:9194", grpc.WithTransportCredentials(credentials.NewTLS(tlsConfig)))
 	require.NoError(t, err)
-	defer require.NoError(t, conn.Close())
+	defer conn.Close() //nolint:errcheck
 
 	empty := protobuf.Empty{}
 	grpcClient := NewFakeServerClient(conn)
@@ -645,7 +645,7 @@ func TestLogSourceIPs(t *testing.T) {
 		w.WriteHeader(500)
 	})
 
-	go require.NoError(t, server.Run())
+	go server.Run() //nolint:errcheck
 	defer server.Shutdown()
 
 	require.Empty(t, fake.sourceIPs)