diff --git a/.golangci.yml b/.golangci.yml
index 6cf053f5..cdd53eca 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -22,6 +22,16 @@ linters-settings:
 
 run:
   go: "1.23"
+  build-tags:
+    - with_gvisor
+    - with_quic
+    - with_dhcp
+    - with_wireguard
+    - with_ech
+    - with_utls
+    - with_reality_server
+    - with_acme
+    - with_clash_api
 
 issues:
   exclude-dirs:
diff --git a/cmd/sing-box/cmd_tools_fetch_http3.go b/cmd/sing-box/cmd_tools_fetch_http3.go
index 5dc3d915..9a7e4402 100644
--- a/cmd/sing-box/cmd_tools_fetch_http3.go
+++ b/cmd/sing-box/cmd_tools_fetch_http3.go
@@ -21,7 +21,7 @@ func initializeHTTP3Client(instance *box.Box) error {
 		return err
 	}
 	http3Client = &http.Client{
-		Transport: &http3.RoundTripper{
+		Transport: &http3.Transport{
 			Dial: func(ctx context.Context, addr string, tlsCfg *tls.Config, cfg *quic.Config) (quic.EarlyConnection, error) {
 				destination := M.ParseSocksaddr(addr)
 				udpConn, dErr := dialer.DialContext(ctx, N.NetworkUDP, destination)
diff --git a/common/tls/ech_client.go b/common/tls/ech_client.go
index 7f72b4d8..19022d41 100644
--- a/common/tls/ech_client.go
+++ b/common/tls/ech_client.go
@@ -63,6 +63,7 @@ type echConnWrapper struct {
 
 func (c *echConnWrapper) ConnectionState() tls.ConnectionState {
 	state := c.Conn.ConnectionState()
+	//nolint:staticcheck
 	return tls.ConnectionState{
 		Version:                     state.Version,
 		HandshakeComplete:           state.HandshakeComplete,
diff --git a/common/tls/ech_keygen.go b/common/tls/ech_keygen.go
index 1fea131c..5053981f 100644
--- a/common/tls/ech_keygen.go
+++ b/common/tls/ech_keygen.go
@@ -147,6 +147,9 @@ func echKeygen(version uint16, serverName string, conf []myECHKeyConfig, suite [
 		pair.rawConf = b
 
 		secBuf, err := sec.MarshalBinary()
+		if err != nil {
+			return nil, E.Cause(err, "serialize ECH private key")
+		}
 		sk := []byte{}
 		sk = be.AppendUint16(sk, uint16(len(secBuf)))
 		sk = append(sk, secBuf...)
diff --git a/common/tls/ech_quic.go b/common/tls/ech_quic.go
index fef506db..4606090a 100644
--- a/common/tls/ech_quic.go
+++ b/common/tls/ech_quic.go
@@ -28,7 +28,7 @@ func (c *echClientConfig) DialEarly(ctx context.Context, conn net.PacketConn, ad
 }
 
 func (c *echClientConfig) CreateTransport(conn net.PacketConn, quicConnPtr *quic.EarlyConnection, serverAddr M.Socksaddr, quicConfig *quic.Config) http.RoundTripper {
-	return &http3.RoundTripper{
+	return &http3.Transport{
 		TLSClientConfig: c.config,
 		QUICConfig:      quicConfig,
 		Dial: func(ctx context.Context, addr string, tlsCfg *tls.Config, cfg *quic.Config) (quic.EarlyConnection, error) {
diff --git a/common/tls/reality_server.go b/common/tls/reality_server.go
index a9318798..6395f652 100644
--- a/common/tls/reality_server.go
+++ b/common/tls/reality_server.go
@@ -175,6 +175,7 @@ type realityConnWrapper struct {
 
 func (c *realityConnWrapper) ConnectionState() ConnectionState {
 	state := c.Conn.ConnectionState()
+	//nolint:staticcheck
 	return tls.ConnectionState{
 		Version:                     state.Version,
 		HandshakeComplete:           state.HandshakeComplete,
diff --git a/common/tls/utls_client.go b/common/tls/utls_client.go
index 6364740f..15103f05 100644
--- a/common/tls/utls_client.go
+++ b/common/tls/utls_client.go
@@ -69,6 +69,7 @@ type utlsConnWrapper struct {
 
 func (c *utlsConnWrapper) ConnectionState() tls.ConnectionState {
 	state := c.Conn.ConnectionState()
+	//nolint:staticcheck
 	return tls.ConnectionState{
 		Version:                     state.Version,
 		HandshakeComplete:           state.HandshakeComplete,
diff --git a/inbound/hysteria.go b/inbound/hysteria.go
index e415d570..427d7df4 100644
--- a/inbound/hysteria.go
+++ b/inbound/hysteria.go
@@ -61,8 +61,8 @@ func NewHysteria(ctx context.Context, router adapter.Router, logger log.ContextL
 	}
 	if len(options.Down) > 0 {
 		receiveBps, err = humanize.ParseBytes(options.Down)
-		if receiveBps == 0 {
-			return nil, E.New("invalid down speed format: ", options.Down)
+		if err != nil {
+			return nil, E.Cause(err, "invalid down speed format: ", options.Down)
 		}
 	} else {
 		receiveBps = uint64(options.DownMbps) * hysteria.MbpsToBps
diff --git a/outbound/hysteria.go b/outbound/hysteria.go
index cf7f7fed..50383af5 100644
--- a/outbound/hysteria.go
+++ b/outbound/hysteria.go
@@ -63,8 +63,8 @@ func NewHysteria(ctx context.Context, router adapter.Router, logger log.ContextL
 	}
 	if len(options.Down) > 0 {
 		receiveBps, err = humanize.ParseBytes(options.Down)
-		if receiveBps == 0 {
-			return nil, E.New("invalid down speed format: ", options.Down)
+		if err != nil {
+			return nil, E.Cause(err, "invalid down speed format: ", options.Down)
 		}
 	} else {
 		receiveBps = uint64(options.DownMbps) * hysteria.MbpsToBps