diff --git a/cli/main.go b/cli/main.go
index 46137e8c94..5c41877d5f 100644
--- a/cli/main.go
+++ b/cli/main.go
@@ -42,7 +42,7 @@ func buildVersionString() (string, error) {
 
 	fmt.Fprintf(versionsWriter, "container image versions:\n")
 	imageReplacements := strings.Trim(string(cmd.ReleaseImageReplacements), "\n")
-	for _, image := range strings.Split(imageReplacements, "\n") {
+	for image := range strings.SplitSeq(imageReplacements, "\n") {
 		if !strings.HasPrefix(image, "#") {
 			image = strings.Split(image, "=")[1]
 			fmt.Fprintf(versionsWriter, "\t%s\n", image)
diff --git a/coordinator/main.go b/coordinator/main.go
index e88ed24ab9..9696b2261f 100644
--- a/coordinator/main.go
+++ b/coordinator/main.go
@@ -314,9 +314,7 @@ func newGRPCServer(credentials credentials.TransportCredentials, serverMetrics *
 }
 
 func gracefulStopGRPC(ctx context.Context, wg *sync.WaitGroup, server *grpc.Server) {
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
+	wg.Go(func() {
 		cleanupDone := make(chan struct{})
 		go func() {
 			server.GracefulStop()
@@ -327,5 +325,5 @@ func gracefulStopGRPC(ctx context.Context, wg *sync.WaitGroup, server *grpc.Serv
 			server.Stop()
 		case <-cleanupDone:
 		}
-	}()
+	})
 }
diff --git a/packages/scripts.nix b/packages/scripts.nix
index 08ef5536ad..a763036b0c 100644
--- a/packages/scripts.nix
+++ b/packages/scripts.nix
@@ -110,18 +110,17 @@ lib.makeScope pkgs.newScope (scripts: {
     text = ''
       exitcode=0
 
-      tags="${lib.concatStringsSep "," contrastPkgs.contrast.contrast.tags}"
+      export GOFLAGS="-tags=${lib.concatStringsSep "," contrastPkgs.contrast.contrast.tags}"
+      export CGO_ENABLED=0
+
       while IFS= read -r dir; do
-        echo "Running go fix -tags $tags on $dir"
-        go fix -C "$dir" -tags "$tags" ./... || exitcode=$?
+        echo "Running go fix on $dir"
+        go fix -C "$dir" ./... || exitcode=$?
       done < <(go list -f '{{.Dir}}' -m)
 
-      # TODO(katexochen): modernize does not support tags?
-      # The run will fail for packages that contain only code with build tags,
-      # thus we ignore the exit code.
       while IFS= read -r dir; do
         echo "Running modernize on $dir"
-        (cd "$dir" && modernize -fix ./...) || true
+        (cd "$dir" && modernize -fix ./...) || exitcode=$?
       done < <(go list -f '{{.Dir}}' -m)
 
       exit $exitcode