diff --git a/controllers/idler/idler_controller.go b/controllers/idler/idler_controller.go
index 0d367b8e..d8a82606 100644
--- a/controllers/idler/idler_controller.go
+++ b/controllers/idler/idler_controller.go
@@ -132,6 +132,7 @@ func (r *Reconciler) ensureIdling(ctx context.Context, idler *toolchainv1alpha1.
 	}
 	newStatusPods := make([]toolchainv1alpha1.Pod, 0, 10)
 	for _, pod := range podList.Items {
+		pod := pod // TODO We won't need it after upgrading to go 1.22: https://go.dev/blog/loopvar-preview
 		logger := log.FromContext(ctx)
 		podLogger := logger.WithValues("pod_name", pod.Name, "pod_phase", pod.Status.Phase)
 		if trackedPod := findPodByName(idler, pod.Name); trackedPod != nil {
@@ -154,7 +155,7 @@ func (r *Reconciler) ensureIdling(ctx context.Context, idler *toolchainv1alpha1.
 				}
 				if !deletedByController { // Pod not managed by a controller. We can just delete the pod.
 					logger.Info("Deleting pod without controller")
-					if err := r.AllNamespacesClient.Delete(ctx, &pod); err != nil { // nolint:gosec
+					if err := r.AllNamespacesClient.Delete(ctx, &pod); err != nil {
 						return err
 					}
 					podLogger.Info("Pod deleted")
diff --git a/controllers/nstemplateset/space_roles.go b/controllers/nstemplateset/space_roles.go
index 85227cd1..60768494 100644
--- a/controllers/nstemplateset/space_roles.go
+++ b/controllers/nstemplateset/space_roles.go
@@ -31,6 +31,7 @@ func (r *spaceRolesManager) ensure(ctx context.Context, nsTmplSet *toolchainv1al
 	}
 	logger.Info("ensuring space roles", "namespace_count", len(nss), "role_count", len(nsTmplSet.Spec.SpaceRoles))
 	for _, ns := range nss {
+		ns := ns // TODO We won't need it after upgrading to go 1.22: https://go.dev/blog/loopvar-preview
 		// space roles previously applied
 		// read annotation to see what was applied last time, so we can compare with the new SpaceRoles and remove all obsolete resources (based on their kind/names)
 		var lastAppliedSpaceRoles []toolchainv1alpha1.NSTemplateSetSpaceRole
@@ -47,12 +48,12 @@ func (r *spaceRolesManager) ensure(ctx context.Context, nsTmplSet *toolchainv1al
 				return false, err
 			}
 		}
-		lastAppliedSpaceRoleObjs, err := r.getSpaceRolesObjects(lctx, &ns, lastAppliedSpaceRoles) // nolint:gosec
+		lastAppliedSpaceRoleObjs, err := r.getSpaceRolesObjects(lctx, &ns, lastAppliedSpaceRoles)
 		if err != nil {
 			return false, r.wrapErrorWithStatusUpdateForSpaceRolesFailure(lctx, nsTmplSet, err, "failed to retrieve last applied space roles")
 		}
 		// space roles to apply now
-		spaceRoleObjs, err := r.getSpaceRolesObjects(lctx, &ns, nsTmplSet.Spec.SpaceRoles) // nolint:gosec
+		spaceRoleObjs, err := r.getSpaceRolesObjects(lctx, &ns, nsTmplSet.Spec.SpaceRoles)
 		if err != nil {
 			return false, r.wrapErrorWithStatusUpdateForSpaceRolesFailure(lctx, nsTmplSet, err, "failed to retrieve space roles to apply")
 		}
@@ -84,7 +85,7 @@ func (r *spaceRolesManager) ensure(ctx context.Context, nsTmplSet *toolchainv1al
 				ns.Annotations = map[string]string{}
 			}
 			ns.Annotations[toolchainv1alpha1.LastAppliedSpaceRolesAnnotationKey] = string(sr)
-			if err := r.Client.Update(ctx, &ns); err != nil { // nolint:gosec
+			if err := r.Client.Update(ctx, &ns); err != nil {
 				return false, r.wrapErrorWithStatusUpdate(lctx, nsTmplSet, r.setStatusProvisionFailed, err,
 					fmt.Sprintf("failed to update namespace with '%s' annotation", toolchainv1alpha1.LastAppliedSpaceRolesAnnotationKey))
 			}