diff --git a/pkg/cli/workflows.go b/pkg/cli/workflows.go
index eb07f7aa9e0..072443b1a78 100644
--- a/pkg/cli/workflows.go
+++ b/pkg/cli/workflows.go
@@ -28,7 +28,8 @@ const workflowTitleScannerBufferSize = 4 * 1024
 
 var workflowTitleScannerBufferPool = sync.Pool{
 	New: func() any {
-		return make([]byte, workflowTitleScannerBufferSize)
+		b := make([]byte, workflowTitleScannerBufferSize)
+		return &b
 	},
 }
 
@@ -346,13 +347,17 @@ func fastParseTitleFromReader(r io.Reader) (string, error) {
 	scanner := bufio.NewScanner(r)
 	// Reuse the small initial scanner buffer across calls while still allowing
 	// growth up to 1 MB for large frontmatter values or long base64-encoded lines.
-	scannerBuffer := workflowTitleScannerBufferPool.Get().([]byte)
+	scannerBufferPtr := workflowTitleScannerBufferPool.Get().(*[]byte)
+	scannerBuffer := *scannerBufferPtr
 	if cap(scannerBuffer) != workflowTitleScannerBufferSize {
 		scannerBuffer = make([]byte, workflowTitleScannerBufferSize)
 	} else {
 		scannerBuffer = scannerBuffer[:workflowTitleScannerBufferSize]
 	}
-	defer workflowTitleScannerBufferPool.Put(scannerBuffer)
+	defer func() {
+		*scannerBufferPtr = scannerBuffer
+		workflowTitleScannerBufferPool.Put(scannerBufferPtr)
+	}()
 	scanner.Buffer(scannerBuffer, 1024*1024)
 	firstLine := true
 	inFrontmatter := false
diff --git a/pkg/workflow/compiler_experiments_sparse_interaction_warning_test.go b/pkg/workflow/compiler_experiments_sparse_interaction_warning_test.go
index 8c18fc2428a..03e78360873 100644
--- a/pkg/workflow/compiler_experiments_sparse_interaction_warning_test.go
+++ b/pkg/workflow/compiler_experiments_sparse_interaction_warning_test.go
@@ -22,8 +22,8 @@ func TestValidateToolConfigurationSparseInteractionWarning(t *testing.T) {
 			name: "warns for multiple experiments with weighted traffic",
 			workflowData: &WorkflowData{
 				Experiments: map[string][]string{
-					"prompt_style": []string{"concise", "verbose"},
-					"emoji":        []string{"none", "heavy"},
+					"prompt_style": {"concise", "verbose"},
+					"emoji":        {"none", "heavy"},
 				},
 				ExperimentConfigs: map[string]*ExperimentConfig{
 					"prompt_style": {
@@ -41,7 +41,7 @@ func TestValidateToolConfigurationSparseInteractionWarning(t *testing.T) {
 			name: "does not warn for single experiment even when weighted",
 			workflowData: &WorkflowData{
 				Experiments: map[string][]string{
-					"prompt_style": []string{"concise", "verbose"},
+					"prompt_style": {"concise", "verbose"},
 				},
 				ExperimentConfigs: map[string]*ExperimentConfig{
 					"prompt_style": {
@@ -56,8 +56,8 @@ func TestValidateToolConfigurationSparseInteractionWarning(t *testing.T) {
 			name: "does not warn for multiple experiments without weighted traffic",
 			workflowData: &WorkflowData{
 				Experiments: map[string][]string{
-					"prompt_style": []string{"concise", "verbose"},
-					"emoji":        []string{"none", "heavy"},
+					"prompt_style": {"concise", "verbose"},
+					"emoji":        {"none", "heavy"},
 				},
 				ExperimentConfigs: map[string]*ExperimentConfig{
 					"prompt_style": {
diff --git a/pkg/workflow/engine_helpers.go b/pkg/workflow/engine_helpers.go
index 300f721bc5b..cabb38fb4fc 100644
--- a/pkg/workflow/engine_helpers.go
+++ b/pkg/workflow/engine_helpers.go
@@ -373,8 +373,8 @@ func FilterEnvForSecrets(env map[string]string, allowedNamesAndKeys []string) ma
 //
 // Returns the normalized command and whether normalization was applied.
 func normalizeBashCommand(cmdStr string) (string, bool) {
-	if strings.HasSuffix(cmdStr, " *") {
-		return strings.TrimSuffix(cmdStr, " *"), true
+	if after, found := strings.CutSuffix(cmdStr, " *"); found {
+		return after, true
 	}
 	return cmdStr, false
 }
diff --git a/pkg/workflow/firewall_args_test.go b/pkg/workflow/firewall_args_test.go
index 8ec688d45e8..4bc4504b2ef 100644
--- a/pkg/workflow/firewall_args_test.go
+++ b/pkg/workflow/firewall_args_test.go
@@ -53,7 +53,7 @@ func TestFirewallArgsInCopilotEngine(t *testing.T) {
 		conditionIdx := strings.Index(stepContent, conditionSnippet)
 		flagIdx := strings.Index(stepContent, flagAssignmentSnippet)
 		argsRefIdx := strings.Index(stepContent, argsRefSnippet)
-		if initIdx == -1 || conditionIdx == -1 || flagIdx == -1 || argsRefIdx == -1 || !(initIdx < conditionIdx && conditionIdx < flagIdx && flagIdx < argsRefIdx) {
+		if initIdx == -1 || conditionIdx == -1 || flagIdx == -1 || argsRefIdx == -1 || initIdx >= conditionIdx || conditionIdx >= flagIdx || flagIdx >= argsRefIdx {
 			t.Error("Expected command to initialize probe variable, evaluate DOCKER_HOST condition, assign docker-host-path-prefix flag, then expand args variable in AWF invocation")
 		}
 
diff --git a/pkg/workflow/runtime_detection.go b/pkg/workflow/runtime_detection.go
index 674700f6c22..459dcb8b63e 100644
--- a/pkg/workflow/runtime_detection.go
+++ b/pkg/workflow/runtime_detection.go
@@ -135,7 +135,7 @@ func detectRuntimeFromCommand(cmdLine string, requirements map[string]*RuntimeRe
 	})
 
 	// Special handling for "gh aw" command pair.
-	for i := 0; i < len(words)-1; i++ {
+	for i := range len(words) - 1 {
 		if strings.EqualFold(words[i], "gh") && strings.EqualFold(words[i+1], "aw") {
 			if runtime := findRuntimeByID("gh-aw"); runtime != nil {
 				updateRequiredRuntime(runtime, getDefaultGhAWRuntimeVersion(), requirements)