diff --git a/.golangci.toml b/.golangci.toml
index 5fd23f7a055..8a83bad028b 100644
--- a/.golangci.toml
+++ b/.golangci.toml
@@ -84,7 +84,11 @@ text = "ST1001"
 # Use golang.org/x/text/cases instead.
 [[issues.exclude-rules]]
 linters = ["staticcheck"]
-text = "SA1019"
+text = "SA1019: strings.Title"
+
+[[issues.exclude-rules]]
+linters = ["staticcheck"]
+text = "use fake service and real access control evaluator instead"
 
 [[issues.exclude-rules]]
 linters = ["gosec"]
diff --git a/go.mod b/go.mod
index fb9aab7c335..576b355b678 100644
--- a/go.mod
+++ b/go.mod
@@ -41,7 +41,7 @@ require (
 	github.com/gchaincl/sqlhooks v1.3.0
 	github.com/getsentry/sentry-go v0.13.0
 	github.com/go-git/go-git/v5 v5.4.2
-	github.com/go-kit/kit v0.12.0
+	github.com/go-kit/kit v0.12.0 // indirect
 	github.com/go-openapi/strfmt v0.21.3
 	github.com/go-redis/redis/v8 v8.11.4
 	github.com/go-sourcemap/sourcemap v2.1.3+incompatible
diff --git a/pkg/build/cmd/fetchimages.go b/pkg/build/cmd/fetchimages.go
index 3845daed5a7..fcdd9fc3eeb 100644
--- a/pkg/build/cmd/fetchimages.go
+++ b/pkg/build/cmd/fetchimages.go
@@ -6,10 +6,11 @@ import (
 	"os/exec"
 	"strings"
 
+	"github.com/urfave/cli/v2"
+
 	"github.com/grafana/grafana/pkg/build/config"
 	"github.com/grafana/grafana/pkg/build/docker"
 	"github.com/grafana/grafana/pkg/build/gcloud"
-	"github.com/urfave/cli/v2"
 )
 
 const (
@@ -20,9 +21,9 @@ const (
 func FetchImages(c *cli.Context) error {
 	if c.NArg() > 0 {
 		if err := cli.ShowSubcommandHelp(c); err != nil {
-			return cli.NewExitError(err.Error(), 1)
+			return cli.Exit(err.Error(), 1)
 		}
-		return cli.NewExitError("", 1)
+		return cli.Exit("", 1)
 	}
 
 	metadata, err := GenerateMetadata(c)
diff --git a/pkg/build/cmd/grafanacom.go b/pkg/build/cmd/grafanacom.go
index 12cf448e26a..ce7f7fc83a4 100644
--- a/pkg/build/cmd/grafanacom.go
+++ b/pkg/build/cmd/grafanacom.go
@@ -15,11 +15,12 @@ import (
 	"strings"
 	"time"
 
+	"github.com/urfave/cli/v2"
+
 	"github.com/grafana/grafana/pkg/build/config"
 	"github.com/grafana/grafana/pkg/build/gcloud"
 	"github.com/grafana/grafana/pkg/build/gcloud/storage"
 	"github.com/grafana/grafana/pkg/build/packaging"
-	"github.com/urfave/cli/v2"
 )
 
 const grafanaAPI = "https://grafana.com/api"
@@ -66,11 +67,11 @@ func GrafanaCom(c *cli.Context) error {
 
 	grafanaAPIKey := strings.TrimSpace(os.Getenv("GRAFANA_COM_API_KEY"))
 	if grafanaAPIKey == "" {
-		return cli.NewExitError("the environment variable GRAFANA_COM_API_KEY must be set", 1)
+		return cli.Exit("the environment variable GRAFANA_COM_API_KEY must be set", 1)
 	}
 	whatsNewURL, releaseNotesURL, err := getReleaseURLs()
 	if err != nil {
-		return cli.NewExitError(err.Error(), 1)
+		return cli.Exit(err.Error(), 1)
 	}
 
 	// TODO: Verify config values
@@ -89,7 +90,7 @@ func GrafanaCom(c *cli.Context) error {
 	}
 
 	if err := publishPackages(cfg); err != nil {
-		return cli.NewExitError(err.Error(), 1)
+		return cli.Exit(err.Error(), 1)
 	}
 
 	log.Println("Successfully published packages to grafana.com!")
diff --git a/pkg/build/cmd/package.go b/pkg/build/cmd/package.go
index 37b8d2e81fd..f5c0b9993a6 100644
--- a/pkg/build/cmd/package.go
+++ b/pkg/build/cmd/package.go
@@ -5,11 +5,12 @@ import (
 	"log"
 	"strings"
 
+	"github.com/urfave/cli/v2"
+
 	"github.com/grafana/grafana/pkg/build/config"
 	"github.com/grafana/grafana/pkg/build/gpg"
 	"github.com/grafana/grafana/pkg/build/packaging"
 	"github.com/grafana/grafana/pkg/build/syncutil"
-	"github.com/urfave/cli/v2"
 )
 
 func Package(c *cli.Context) error {
@@ -22,12 +23,12 @@ func Package(c *cli.Context) error {
 
 	releaseMode, err := metadata.GetReleaseMode()
 	if err != nil {
-		return cli.NewExitError(err.Error(), 1)
+		return cli.Exit(err.Error(), 1)
 	}
 
 	releaseModeConfig, err := config.GetBuildConfig(metadata.ReleaseMode.Mode)
 	if err != nil {
-		return cli.NewExitError(err.Error(), 1)
+		return cli.Exit(err.Error(), 1)
 	}
 
 	cfg := config.Config{
diff --git a/pkg/build/cmd/publishimages_enterprise2.go b/pkg/build/cmd/publishimages_enterprise2.go
index 80ca4188684..1315b2897b0 100644
--- a/pkg/build/cmd/publishimages_enterprise2.go
+++ b/pkg/build/cmd/publishimages_enterprise2.go
@@ -6,18 +6,19 @@ import (
 	"os"
 	"os/exec"
 
+	"github.com/urfave/cli/v2"
+
 	"github.com/grafana/grafana/pkg/build/config"
 	"github.com/grafana/grafana/pkg/build/docker"
 	"github.com/grafana/grafana/pkg/build/gcloud"
-	"github.com/urfave/cli/v2"
 )
 
 func Enterprise2(c *cli.Context) error {
 	if c.NArg() > 0 {
 		if err := cli.ShowSubcommandHelp(c); err != nil {
-			return cli.NewExitError(err.Error(), 1)
+			return cli.Exit(err.Error(), 1)
 		}
-		return cli.NewExitError("", 1)
+		return cli.Exit("", 1)
 	}
 
 	if err := gcloud.ActivateServiceAccount(); err != nil {
diff --git a/pkg/build/cmd/publishmetrics.go b/pkg/build/cmd/publishmetrics.go
index d88911fc328..9d0576891fd 100644
--- a/pkg/build/cmd/publishmetrics.go
+++ b/pkg/build/cmd/publishmetrics.go
@@ -8,8 +8,9 @@ import (
 	"os"
 	"regexp"
 
-	"github.com/grafana/grafana/pkg/build/metrics"
 	"github.com/urfave/cli/v2"
+
+	"github.com/grafana/grafana/pkg/build/metrics"
 )
 
 func PublishMetrics(c *cli.Context) error {
@@ -17,24 +18,24 @@ func PublishMetrics(c *cli.Context) error {
 
 	input, err := io.ReadAll(os.Stdin)
 	if err != nil {
-		return cli.NewExitError(fmt.Sprintf("Reading from stdin failed: %s", err), 1)
+		return cli.Exit(fmt.Sprintf("Reading from stdin failed: %s", err), 1)
 	}
 
 	reMetrics := regexp.MustCompile(`(?ms)^Metrics: (\{.+\})`)
 	ms := reMetrics.FindSubmatch(input)
 	if len(ms) == 0 {
-		return cli.NewExitError(fmt.Sprintf("Input on wrong format: %q", string(input)), 1)
+		return cli.Exit(fmt.Sprintf("Input on wrong format: %q", string(input)), 1)
 	}
 
 	m := map[string]string{}
 	if err := json.Unmarshal(ms[1], &m); err != nil {
-		return cli.NewExitError(fmt.Sprintf("decoding metrics failed: %s", err), 1)
+		return cli.Exit(fmt.Sprintf("decoding metrics failed: %s", err), 1)
 	}
 
 	log.Printf("Received metrics %+v", m)
 
 	if err := metrics.Publish(m, apiKey); err != nil {
-		return cli.NewExitError(fmt.Sprintf("publishing metrics failed: %s", err), 1)
+		return cli.Exit(fmt.Sprintf("publishing metrics failed: %s", err), 1)
 	}
 
 	return nil
diff --git a/pkg/build/cmd/uploadcdn.go b/pkg/build/cmd/uploadcdn.go
index e9c4b72acab..3c202a35157 100644
--- a/pkg/build/cmd/uploadcdn.go
+++ b/pkg/build/cmd/uploadcdn.go
@@ -6,18 +6,19 @@ import (
 	"os"
 	"path/filepath"
 
+	"github.com/urfave/cli/v2"
+
 	"github.com/grafana/grafana/pkg/build/config"
 	"github.com/grafana/grafana/pkg/build/gcloud/storage"
-	"github.com/urfave/cli/v2"
 )
 
 // UploadCDN implements the sub-command "upload-cdn".
 func UploadCDN(c *cli.Context) error {
 	if c.NArg() > 0 {
 		if err := cli.ShowSubcommandHelp(c); err != nil {
-			return cli.NewExitError(err.Error(), 1)
+			return cli.Exit(err.Error(), 1)
 		}
-		return cli.NewExitError("", 1)
+		return cli.Exit("", 1)
 	}
 
 	metadata, err := GenerateMetadata(c)
@@ -27,7 +28,7 @@ func UploadCDN(c *cli.Context) error {
 
 	version := metadata.GrafanaVersion
 	if err != nil {
-		return cli.NewExitError(err.Error(), 1)
+		return cli.Exit(err.Error(), 1)
 	}
 
 	buildConfig, err := config.GetBuildConfig(metadata.ReleaseMode.Mode)
diff --git a/pkg/build/cmd/uploadpackages.go b/pkg/build/cmd/uploadpackages.go
index a677ec807f5..0a0778bb055 100644
--- a/pkg/build/cmd/uploadpackages.go
+++ b/pkg/build/cmd/uploadpackages.go
@@ -9,10 +9,11 @@ import (
 	"path/filepath"
 	"strings"
 
+	"github.com/urfave/cli/v2"
+
 	"github.com/grafana/grafana/pkg/build/config"
 	"github.com/grafana/grafana/pkg/build/gcloud"
 	"github.com/grafana/grafana/pkg/build/packaging"
-	"github.com/urfave/cli/v2"
 )
 
 const releaseFolder = "release"
@@ -32,24 +33,24 @@ type uploadConfig struct {
 func UploadPackages(c *cli.Context) error {
 	if c.NArg() > 0 {
 		if err := cli.ShowSubcommandHelp(c); err != nil {
-			return cli.NewExitError(err.Error(), 1)
+			return cli.Exit(err.Error(), 1)
 		}
-		return cli.NewExitError("", 1)
+		return cli.Exit("", 1)
 	}
 
 	gcpKeyB64 := strings.TrimSpace(os.Getenv("GCP_KEY"))
 	if gcpKeyB64 == "" {
-		return cli.NewExitError("the environment variable GCP_KEY must be set", 1)
+		return cli.Exit("the environment variable GCP_KEY must be set", 1)
 	}
 	gcpKeyB, err := base64.StdEncoding.DecodeString(gcpKeyB64)
 	if err != nil {
-		return cli.NewExitError("failed to base64 decode $GCP_KEY", 1)
+		return cli.Exit("failed to base64 decode $GCP_KEY", 1)
 	}
 	gcpKey := string(gcpKeyB)
 
 	distDir, err := filepath.Abs("dist")
 	if err != nil {
-		return cli.NewExitError(err.Error(), 1)
+		return cli.Exit(err.Error(), 1)
 	}
 
 	metadata, err := GenerateMetadata(c)
@@ -61,12 +62,12 @@ func UploadPackages(c *cli.Context) error {
 
 	releaseMode, err := metadata.GetReleaseMode()
 	if err != nil {
-		return cli.NewExitError(err.Error(), 1)
+		return cli.Exit(err.Error(), 1)
 	}
 
 	releaseModeConfig, err := config.GetBuildConfig(releaseMode.Mode)
 	if err != nil {
-		return cli.NewExitError(err.Error(), 1)
+		return cli.Exit(err.Error(), 1)
 	}
 
 	var edition config.Edition
@@ -103,7 +104,7 @@ func UploadPackages(c *cli.Context) error {
 	}
 
 	if err := uploadPackages(cfg); err != nil {
-		return cli.NewExitError(err.Error(), 1)
+		return cli.Exit(err.Error(), 1)
 	}
 
 	log.Println("Successfully uploaded packages!")
diff --git a/pkg/build/cmd/verifydrone.go b/pkg/build/cmd/verifydrone.go
index ed34e0f77df..19da6fb5a35 100644
--- a/pkg/build/cmd/verifydrone.go
+++ b/pkg/build/cmd/verifydrone.go
@@ -13,10 +13,11 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 
-	"github.com/grafana/grafana/pkg/build/fsutil"
 	cliv1 "github.com/urfave/cli"
 	"github.com/urfave/cli/v2"
 	"gopkg.in/yaml.v3"
+
+	"github.com/grafana/grafana/pkg/build/fsutil"
 )
 
 func VerifyDrone(c *cli.Context) error {
@@ -24,7 +25,7 @@ func VerifyDrone(c *cli.Context) error {
 	const backup = ".drone.yml.bak"
 
 	if err := fsutil.CopyFile(yml, backup); err != nil {
-		return cli.NewExitError(fmt.Sprintf("failed to copy %s to %s: %s", yml, backup, err), 1)
+		return cli.Exit(fmt.Sprintf("failed to copy %s to %s: %s", yml, backup, err), 1)
 	}
 	defer func() {
 		if err := os.Remove(yml); err != nil {
@@ -73,7 +74,7 @@ func readConfig(fpath string) ([]map[string]interface{}, error) {
 	//nolint:gosec
 	f, err := os.Open(fpath)
 	if err != nil {
-		return nil, cli.NewExitError(fmt.Sprintf("failed to read %s: %s", fpath, err), 1)
+		return nil, cli.Exit(fmt.Sprintf("failed to read %s: %s", fpath, err), 1)
 	}
 	defer func() {
 		if err := f.Close(); err != nil {
@@ -90,7 +91,7 @@ func readConfig(fpath string) ([]map[string]interface{}, error) {
 			if errors.Is(err, io.EOF) {
 				break
 			}
-			return nil, cli.NewExitError(fmt.Sprintf("Failed to decode %s: %s", fpath, err), 1)
+			return nil, cli.Exit(fmt.Sprintf("Failed to decode %s: %s", fpath, err), 1)
 		}
 
 		if m["kind"] == "signature" {
@@ -118,7 +119,7 @@ func verifyYAML(yml, backup string) error {
 	}
 
 	if !cmp.Equal(c1, c2) {
-		return cli.NewExitError(fmt.Sprintf("%s is out of sync with .drone.star - regenerate it with drone starlark convert",
+		return cli.Exit(fmt.Sprintf("%s is out of sync with .drone.star - regenerate it with drone starlark convert",
 			yml), 1)
 	}
 
diff --git a/pkg/build/cmd/verifystorybook.go b/pkg/build/cmd/verifystorybook.go
index 052206f1660..c074bb76857 100644
--- a/pkg/build/cmd/verifystorybook.go
+++ b/pkg/build/cmd/verifystorybook.go
@@ -6,8 +6,9 @@ import (
 	"log"
 	"path/filepath"
 
-	"github.com/grafana/grafana/pkg/infra/fs"
 	"github.com/urfave/cli/v2"
+
+	"github.com/grafana/grafana/pkg/infra/fs"
 )
 
 // VerifyStorybook Action implements the sub-command "verify-storybook".
@@ -20,7 +21,7 @@ func VerifyStorybook(c *cli.Context) error {
 	for _, p := range paths {
 		exists, err := fs.Exists(filepath.Join(grafanaDir, p))
 		if err != nil {
-			return cli.NewExitError(fmt.Sprintf("failed to verify Storybook build: %s", err), 1)
+			return cli.Exit(fmt.Sprintf("failed to verify Storybook build: %s", err), 1)
 		}
 		if !exists {
 			return fmt.Errorf("failed to verify Storybook build, missing %q", p)
diff --git a/pkg/build/packaging/deb.go b/pkg/build/packaging/deb.go
index a5c01bd2ea6..094207b0270 100644
--- a/pkg/build/packaging/deb.go
+++ b/pkg/build/packaging/deb.go
@@ -8,10 +8,11 @@ import (
 	"path/filepath"
 	"strings"
 
+	"github.com/urfave/cli/v2"
+
 	"github.com/grafana/grafana/pkg/build/config"
 	"github.com/grafana/grafana/pkg/build/fsutil"
 	"github.com/grafana/grafana/pkg/infra/fs"
-	"github.com/urfave/cli/v2"
 )
 
 func writeAptlyConf(dbDir, repoDir string) error {
@@ -166,7 +167,7 @@ func UpdateDebRepo(cfg PublishConfig, workDir string) error {
 		cmd := exec.Command("aptly", "publish", "update", "-batch", passArg, "-force-overwrite", tp,
 			"filesystem:repo:grafana")
 		if output, err := cmd.CombinedOutput(); err != nil {
-			return cli.NewExitError(fmt.Sprintf("failed to update Debian %q repository: %s", tp, output), 1)
+			return cli.Exit(fmt.Sprintf("failed to update Debian %q repository: %s", tp, output), 1)
 		}
 	}
 
@@ -179,7 +180,7 @@ func UpdateDebRepo(cfg PublishConfig, workDir string) error {
 		//nolint:gosec
 		cmd = exec.Command("gsutil", "-m", "rsync", "-r", "-d", dbDir, u)
 		if output, err := cmd.CombinedOutput(); err != nil {
-			return cli.NewExitError(fmt.Sprintf("failed to upload Debian repo database to GCS: %s", output), 1)
+			return cli.Exit(fmt.Sprintf("failed to upload Debian repo database to GCS: %s", output), 1)
 		}
 	}
 
@@ -193,14 +194,14 @@ func UpdateDebRepo(cfg PublishConfig, workDir string) error {
 		//nolint:gosec
 		cmd = exec.Command("gsutil", "-m", "rsync", "-r", "-d", grafDir, u)
 		if output, err := cmd.CombinedOutput(); err != nil {
-			return cli.NewExitError(fmt.Sprintf("failed to upload Debian repo resources to GCS: %s", output), 1)
+			return cli.Exit(fmt.Sprintf("failed to upload Debian repo resources to GCS: %s", output), 1)
 		}
 		allRepoResources := fmt.Sprintf("%s/**/*", u)
 		log.Printf("Setting cache ttl for Debian repo resources on GCS (%s)...\n", allRepoResources)
 		//nolint:gosec
 		cmd = exec.Command("gsutil", "-m", "setmeta", "-h", CacheSettings+cfg.TTL, allRepoResources)
 		if output, err := cmd.CombinedOutput(); err != nil {
-			return cli.NewExitError(fmt.Sprintf("failed to set cache ttl for Debian repo resources on GCS: %s", output), 1)
+			return cli.Exit(fmt.Sprintf("failed to set cache ttl for Debian repo resources on GCS: %s", output), 1)
 		}
 	}
 
@@ -238,7 +239,7 @@ func addPkgsToRepo(cfg PublishConfig, workDir, tmpDir, repoName string) error {
 	//nolint:gosec
 	cmd := exec.Command("aptly", "repo", "add", "-force-replace", repoName, tmpDir)
 	if output, err := cmd.CombinedOutput(); err != nil {
-		return cli.NewExitError(fmt.Sprintf("failed to add packages to local Debian repository: %s", output), 1)
+		return cli.Exit(fmt.Sprintf("failed to add packages to local Debian repository: %s", output), 1)
 	}
 
 	return nil
diff --git a/pkg/build/packaging/rpm.go b/pkg/build/packaging/rpm.go
index 24da71a185a..a4e8e557221 100644
--- a/pkg/build/packaging/rpm.go
+++ b/pkg/build/packaging/rpm.go
@@ -10,12 +10,15 @@ import (
 	"path/filepath"
 	"strings"
 
+	// Consider switching this over to a community fork unless there is
+	// an option to move us away from OpenPGP.
+	"golang.org/x/crypto/openpgp"        //nolint:staticcheck
+	"golang.org/x/crypto/openpgp/armor"  //nolint:staticcheck
+	"golang.org/x/crypto/openpgp/packet" //nolint:staticcheck
+
 	"github.com/grafana/grafana/pkg/build/config"
 	"github.com/grafana/grafana/pkg/build/fsutil"
 	"github.com/grafana/grafana/pkg/infra/fs"
-	"golang.org/x/crypto/openpgp"
-	"golang.org/x/crypto/openpgp/armor"
-	"golang.org/x/crypto/openpgp/packet"
 )
 
 // UpdateRPMRepo updates the RPM repository with the new release.
diff --git a/pkg/infra/log/text/text_logger.go b/pkg/infra/log/text/text_logger.go
index ad9891ea511..36c0b4e3e30 100644
--- a/pkg/infra/log/text/text_logger.go
+++ b/pkg/infra/log/text/text_logger.go
@@ -6,7 +6,7 @@ import (
 	"io"
 	"reflect"
 
-	gokitlog "github.com/go-kit/kit/log"
+	gokitlog "github.com/go-kit/log"
 )
 
 type textLogger struct {
diff --git a/pkg/services/datasources/service/datasource_test.go b/pkg/services/datasources/service/datasource_test.go
index cd22275f6a0..2e3fdbe7068 100644
--- a/pkg/services/datasources/service/datasource_test.go
+++ b/pkg/services/datasources/service/datasource_test.go
@@ -364,6 +364,9 @@ func TestService_GetHttpTransport(t *testing.T) {
 		tr := configuredTransport
 
 		require.False(t, tr.TLSClientConfig.InsecureSkipVerify)
+		// Ignoring deprecation, the system will not include the root CA
+		// used in this scenario.
+		//nolint:staticcheck
 		require.Len(t, tr.TLSClientConfig.RootCAs.Subjects(), 1)
 		require.Equal(t, "server-name", tr.TLSClientConfig.ServerName)
 	})
diff --git a/pkg/services/sqlstore/migrator/migrator.go b/pkg/services/sqlstore/migrator/migrator.go
index 69cd34810f1..a9ab04d987c 100644
--- a/pkg/services/sqlstore/migrator/migrator.go
+++ b/pkg/services/sqlstore/migrator/migrator.go
@@ -251,7 +251,7 @@ func (mg *Migrator) InTransaction(callback dbTransactionFunc) error {
 }
 
 func casRestoreOnErr(lock *atomic.Bool, o, n bool, casErr error, f func(LockCfg) error, lockCfg LockCfg) error {
-	if !lock.CAS(o, n) {
+	if !lock.CompareAndSwap(o, n) {
 		return casErr
 	}
 	if err := f(lockCfg); err != nil {