Repository: kubernetes-sigs/security-profiles-operator
Pull request #874 (2022-03-31 09:02:32)

Switch to golang native error wrapping
#### What type of PR is this?

/kind cleanup


#### What this PR does / why we need it:

We now use the golang native error wrapping instead of the github.com/pkg/errors package.

#### Which issue(s) this PR fixes:

None

#### Does this PR have test?
None

#### Special notes for your reviewer:
None
#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
None
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/874#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
saschagrunert: /hold

have to fix the linter
k8s-ci-robot: @saschagrunert: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-build | 1db894812779b693d8a4895d694e5722de1c6e42 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-build/1509456100011806720) | true | `/test pull-security-profiles-operator-build`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=874). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @saschagrunert: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-build | 1db894812779b693d8a4895d694e5722de1c6e42 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-build/1509456100011806720) | true | `/test pull-security-profiles-operator-build`
pull-security-profiles-operator-test-unit | 1db894812779b693d8a4895d694e5722de1c6e42 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-test-unit/1509456100083109888) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=874). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @saschagrunert: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-build | 1db894812779b693d8a4895d694e5722de1c6e42 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-build/1509456100011806720) | true | `/test pull-security-profiles-operator-build`
pull-security-profiles-operator-test-unit | 1db894812779b693d8a4895d694e5722de1c6e42 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-test-unit/1509456100083109888) | true | `/test pull-security-profiles-operator-test-unit`
pull-security-profiles-operator-verify | 1db894812779b693d8a4895d694e5722de1c6e42 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-verify/1509456100045361152) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=874). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @saschagrunert: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-build | 1db894812779b693d8a4895d694e5722de1c6e42 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-build/1509456100011806720) | true | `/test pull-security-profiles-operator-build`
pull-security-profiles-operator-test-unit | 1db894812779b693d8a4895d694e5722de1c6e42 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-test-unit/1509456100083109888) | true | `/test pull-security-profiles-operator-test-unit`
pull-security-profiles-operator-verify | 1db894812779b693d8a4895d694e5722de1c6e42 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-verify/1509456100045361152) | true | `/test pull-security-profiles-operator-verify`
pull-security-profiles-operator-build-image | 1db894812779b693d8a4895d694e5722de1c6e42 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-build-image/1509456100120858624) | true | `/test pull-security-profiles-operator-build-image`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=874). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @saschagrunert: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-unit | 1db894812779b693d8a4895d694e5722de1c6e42 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-test-unit/1509456100083109888) | true | `/test pull-security-profiles-operator-test-unit`
pull-security-profiles-operator-verify | 1db894812779b693d8a4895d694e5722de1c6e42 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-verify/1509456100045361152) | true | `/test pull-security-profiles-operator-verify`
pull-security-profiles-operator-build-image | 1db894812779b693d8a4895d694e5722de1c6e42 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-build-image/1509456100120858624) | true | `/test pull-security-profiles-operator-build-image`
pull-security-profiles-operator-build | 186cb35c673d3888d3b8f8877ad52ddced41b227 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-build/1509473805301452800) | true | `/test pull-security-profiles-operator-build`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=874). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @saschagrunert: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | 1db894812779b693d8a4895d694e5722de1c6e42 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-verify/1509456100045361152) | true | `/test pull-security-profiles-operator-verify`
pull-security-profiles-operator-build-image | 1db894812779b693d8a4895d694e5722de1c6e42 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-build-image/1509456100120858624) | true | `/test pull-security-profiles-operator-build-image`
pull-security-profiles-operator-build | 186cb35c673d3888d3b8f8877ad52ddced41b227 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-build/1509473805301452800) | true | `/test pull-security-profiles-operator-build`
pull-security-profiles-operator-test-unit | 186cb35c673d3888d3b8f8877ad52ddced41b227 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-test-unit/1509473805364367360) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=874). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @saschagrunert: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-build | 186cb35c673d3888d3b8f8877ad52ddced41b227 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-build/1509473805301452800) | true | `/test pull-security-profiles-operator-build`
pull-security-profiles-operator-test-unit | 186cb35c673d3888d3b8f8877ad52ddced41b227 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-test-unit/1509473805364367360) | true | `/test pull-security-profiles-operator-test-unit`
pull-security-profiles-operator-verify | 186cb35c673d3888d3b8f8877ad52ddced41b227 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-verify/1509473805330812928) | true | `/test pull-security-profiles-operator-verify`
pull-security-profiles-operator-build-image | 186cb35c673d3888d3b8f8877ad52ddced41b227 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-build-image/1509473805414699008) | true | `/test pull-security-profiles-operator-build-image`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=874). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @saschagrunert: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | 186cb35c673d3888d3b8f8877ad52ddced41b227 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-verify/1509473805330812928) | true | `/test pull-security-profiles-operator-verify`
pull-security-profiles-operator-build-image | 186cb35c673d3888d3b8f8877ad52ddced41b227 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-build-image/1509473805414699008) | true | `/test pull-security-profiles-operator-build-image`
pull-security-profiles-operator-test-unit | a76767b488b2fe3f76f8e67940f6253c5336d39e | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-test-unit/1509477124623306752) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=874). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @saschagrunert: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-unit | 949db8d09da4be4ba44fbb37dd6438bfe2bbcf21 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-test-unit/1509479043680964608) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=874). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @saschagrunert: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 32445b7d962b546bf6dec4067291544e27580a78 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-test-e2e/1509482650602049536) | true | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=874). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
saschagrunert: /test pull-security-profiles-operator-test-e2e
k8s-ci-robot: @saschagrunert: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 57d178a317186c5aa67629559bd469b1e26560c8 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-test-e2e/1509488225180192768) | true | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=874). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @saschagrunert: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 26289aee499550ff4da5965de3e9151e2e119fac | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/874/pull-security-profiles-operator-test-e2e/1509497264307965952) | true | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=874). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
saschagrunert: /unhold
saschagrunert: Just seems flaky, retesting.
saschagrunert: @JAORMX @jhrozek @pjbgf PTAL
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/874#pullrequestreview-930336571" title="LGTM">JAORMX</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/874#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [JAORMX,saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/.golangci.yml b/.golangci.yml
index 4bdfce5d0..b06fb3802 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -9,6 +9,9 @@ issues:
         - dupl
         - gofumpt
         - lll
+    - linters:
+        - goerr113
+      text: do not define dynamic errors, use wrapped static errors instead
 linters:
   disable-all: true
   enable:
diff --git a/api/profilerecording/v1alpha1/profilerecording_types.go b/api/profilerecording/v1alpha1/profilerecording_types.go
index 5aa1803e1..73a5f854b 100644
--- a/api/profilerecording/v1alpha1/profilerecording_types.go
+++ b/api/profilerecording/v1alpha1/profilerecording_types.go
@@ -20,7 +20,6 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/pkg/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/config"
@@ -94,7 +93,7 @@ func (pr *ProfileRecording) CtrAnnotation(replica, ctrName string) (key, value s
 		return pr.ctrAnnotationSelinux(ctrReplicaName, ctrName)
 	}
 
-	return "", "", errors.Errorf(
+	return "", "", fmt.Errorf(
 		"invalid kind: %s", pr.Spec.Kind,
 	)
 }
@@ -140,7 +139,7 @@ func (pr *ProfileRecording) ctrAnnotationSeccomp(ctrReplicaName, ctrName string)
 		)
 
 	default:
-		return "", "", errors.Errorf(
+		return "", "", fmt.Errorf(
 			"invalid recorder: %s", pr.Spec.Recorder,
 		)
 	}
@@ -165,7 +164,7 @@ func (pr *ProfileRecording) ctrAnnotationSelinux(ctrReplicaName, ctrName string)
 	case ProfileRecorderHook:
 	case ProfileRecorderBpf:
 	default:
-		return "", "", errors.Errorf(
+		return "", "", fmt.Errorf(
 			"invalid recorder: %s, only %s is supported", pr.Spec.Recorder, ProfileRecorderLogs,
 		)
 	}
diff --git a/cmd/security-profiles-operator/main.go b/cmd/security-profiles-operator/main.go
index 511c97644..3bb96ce52 100644
--- a/cmd/security-profiles-operator/main.go
+++ b/cmd/security-profiles-operator/main.go
@@ -18,6 +18,7 @@ package main
 
 import (
 	"context"
+	"errors"
 	"flag"
 	"fmt"
 	"log"
@@ -29,7 +30,6 @@ import (
 
 	certmanagerv1 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1"
 	configv1 "github.com/openshift/api/config/v1"
-	"github.com/pkg/errors"
 	monitoringv1 "github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1"
 	"github.com/urfave/cli/v2"
 	"k8s.io/klog/v2"
@@ -104,7 +104,7 @@ func main() {
 				if c.Bool(jsonFlag) {
 					j, err := info.JSONString()
 					if err != nil {
-						return errors.Wrap(err, "unable to generate JSON from version info")
+						return fmt.Errorf("unable to generate JSON from version info: %w", err)
 					}
 					res = j
 				}
@@ -216,7 +216,7 @@ func main() {
 
 func initialize(ctx *cli.Context) error {
 	if err := initLogging(ctx); err != nil {
-		return errors.Wrap(err, "init logging")
+		return fmt.Errorf("init logging: %w", err)
 	}
 
 	initProfiling(ctx)
@@ -231,7 +231,7 @@ func initLogging(ctx *cli.Context) error {
 
 	level := ctx.Uint("verbosity")
 	if err := set.Parse([]string{fmt.Sprintf("-v=%d", level)}); err != nil {
-		return errors.Wrap(err, "parse verbosity flag")
+		return fmt.Errorf("parse verbosity flag: %w", err)
 	}
 
 	ctrl.Log.Info(fmt.Sprintf("Set logging verbosity to %d", level))
@@ -266,7 +266,7 @@ func runManager(ctx *cli.Context, info *version.Info) error {
 	printInfo("security-profiles-operator", info)
 	cfg, err := ctrl.GetConfig()
 	if err != nil {
-		return errors.Wrap(err, "get config")
+		return fmt.Errorf("get config: %w", err)
 	}
 
 	sigHandler := ctrl.SetupSignalHandler()
@@ -281,26 +281,26 @@ func runManager(ctx *cli.Context, info *version.Info) error {
 
 	mgr, err := ctrl.NewManager(cfg, ctrlOpts)
 	if err != nil {
-		return errors.Wrap(err, "create cluster manager")
+		return fmt.Errorf("create cluster manager: %w", err)
 	}
 
 	if err := configv1.AddToScheme(mgr.GetScheme()); err != nil {
-		return errors.Wrap(err, "add OpenShift config API to scheme")
+		return fmt.Errorf("add OpenShift config API to scheme: %w", err)
 	}
 	if err := certmanagerv1.AddToScheme(mgr.GetScheme()); err != nil {
-		return errors.Wrap(err, "add certmanager API to scheme")
+		return fmt.Errorf("add certmanager API to scheme: %w", err)
 	}
 	if err := profilebindingv1alpha1.AddToScheme(mgr.GetScheme()); err != nil {
-		return errors.Wrap(err, "add profilebinding API to scheme")
+		return fmt.Errorf("add profilebinding API to scheme: %w", err)
 	}
 	if err := seccompprofileapi.AddToScheme(mgr.GetScheme()); err != nil {
-		return errors.Wrap(err, "add seccompprofile API to scheme")
+		return fmt.Errorf("add seccompprofile API to scheme: %w", err)
 	}
 	if err := selxv1alpha2.AddToScheme(mgr.GetScheme()); err != nil {
-		return errors.Wrap(err, "add selinuxprofile API to scheme")
+		return fmt.Errorf("add selinuxprofile API to scheme: %w", err)
 	}
 	if err := monitoringv1.AddToScheme(mgr.GetScheme()); err != nil {
-		return errors.Wrap(err, "add ServiceMonitor API to scheme")
+		return fmt.Errorf("add ServiceMonitor API to scheme: %w", err)
 	}
 
 	if err := setupEnabledControllers(ctx.Context, []controller.Controller{
@@ -308,12 +308,12 @@ func runManager(ctx *cli.Context, info *version.Info) error {
 		spod.NewController(),
 		workloadannotator.NewController(),
 	}, mgr, nil); err != nil {
-		return errors.Wrap(err, "enable controllers")
+		return fmt.Errorf("enable controllers: %w", err)
 	}
 
 	setupLog.Info("starting manager")
 	if err := mgr.Start(sigHandler); err != nil {
-		return errors.Wrap(err, "controller manager error")
+		return fmt.Errorf("controller manager error: %w", err)
 	}
 
 	setupLog.Info("ending manager")
@@ -378,7 +378,7 @@ func runDaemon(ctx *cli.Context, info *version.Info) error {
 
 	cfg, err := ctrl.GetConfig()
 	if err != nil {
-		return errors.Wrap(err, "get config")
+		return fmt.Errorf("get config: %w", err)
 	}
 
 	sigHandler := ctrl.SetupSignalHandler()
@@ -392,37 +392,37 @@ func runDaemon(ctx *cli.Context, info *version.Info) error {
 
 	mgr, err := ctrl.NewManager(cfg, ctrlOpts)
 	if err != nil {
-		return errors.Wrap(err, "create manager")
+		return fmt.Errorf("create manager: %w", err)
 	}
 
 	// Setup metrics
 	met := metrics.New()
 	if err := met.Register(); err != nil {
-		return errors.Wrap(err, "register metrics")
+		return fmt.Errorf("register metrics: %w", err)
 	}
 	if err := met.ServeGRPC(); err != nil {
-		return errors.Wrap(err, "start metrics grpc server")
+		return fmt.Errorf("start metrics grpc server: %w", err)
 	}
 
 	if err := mgr.AddMetricsExtraHandler(metrics.HandlerPath, met.Handler()); err != nil {
-		return errors.Wrap(err, "add metrics extra handler")
+		return fmt.Errorf("add metrics extra handler: %w", err)
 	}
 
 	// This API provides status which is used by both seccomp and selinux
 	if err := secprofnodestatusv1alpha1.AddToScheme(mgr.GetScheme()); err != nil {
-		return errors.Wrap(err, "add per-node Status API to scheme")
+		return fmt.Errorf("add per-node Status API to scheme: %w", err)
 	}
 	if err := spodv1alpha1.AddToScheme(mgr.GetScheme()); err != nil {
-		return errors.Wrap(err, "add SPOD config API to scheme")
+		return fmt.Errorf("add SPOD config API to scheme: %w", err)
 	}
 
 	if err := setupEnabledControllers(ctx.Context, enabledControllers, mgr, met); err != nil {
-		return errors.Wrap(err, "enable controllers")
+		return fmt.Errorf("enable controllers: %w", err)
 	}
 
 	setupLog.Info("starting daemon")
 	if err := mgr.Start(sigHandler); err != nil {
-		return errors.Wrap(err, "SPOd error")
+		return fmt.Errorf("SPOd error: %w", err)
 	}
 
 	setupLog.Info("ending daemon")
@@ -451,7 +451,7 @@ func runWebhook(ctx *cli.Context, info *version.Info) error {
 	printInfo("security-profiles-operator-webhook", info)
 	cfg, err := ctrl.GetConfig()
 	if err != nil {
-		return errors.Wrap(err, "get config")
+		return fmt.Errorf("get config: %w", err)
 	}
 
 	port := ctx.Int("port")
@@ -464,17 +464,17 @@ func runWebhook(ctx *cli.Context, info *version.Info) error {
 
 	mgr, err := ctrl.NewManager(cfg, ctrlOpts)
 	if err != nil {
-		return errors.Wrap(err, "create cluster webhook")
+		return fmt.Errorf("create cluster webhook: %w", err)
 	}
 
 	if err := profilebindingv1alpha1.AddToScheme(mgr.GetScheme()); err != nil {
-		return errors.Wrap(err, "add profilebinding API to scheme")
+		return fmt.Errorf("add profilebinding API to scheme: %w", err)
 	}
 	if err := seccompprofileapi.AddToScheme(mgr.GetScheme()); err != nil {
-		return errors.Wrap(err, "add seccompprofile API to scheme")
+		return fmt.Errorf("add seccompprofile API to scheme: %w", err)
 	}
 	if err := profilerecording1alpha1.AddToScheme(mgr.GetScheme()); err != nil {
-		return errors.Wrap(err, "add profilerecording API to scheme")
+		return fmt.Errorf("add profilerecording API to scheme: %w", err)
 	}
 
 	setupLog.Info("registering webhooks")
@@ -485,7 +485,7 @@ func runWebhook(ctx *cli.Context, info *version.Info) error {
 	sigHandler := ctrl.SetupSignalHandler()
 	setupLog.Info("starting webhook")
 	if err := mgr.Start(sigHandler); err != nil {
-		return errors.Wrap(err, "controller manager error")
+		return fmt.Errorf("controller manager error: %w", err)
 	}
 	return nil
 }
@@ -499,17 +499,17 @@ func setupEnabledControllers(
 	for _, enableCtrl := range enabledControllers {
 		if enableCtrl.SchemeBuilder() != nil {
 			if err := enableCtrl.SchemeBuilder().AddToScheme(mgr.GetScheme()); err != nil {
-				return errors.Wrap(err, "add core operator APIs to scheme")
+				return fmt.Errorf("add core operator APIs to scheme: %w", err)
 			}
 		}
 
 		if err := enableCtrl.Setup(ctx, mgr, met); err != nil {
-			return errors.Wrapf(err, "setup %s controller", enableCtrl.Name())
+			return fmt.Errorf("setup %s controller: %w", enableCtrl.Name(), err)
 		}
 
 		if met != nil {
 			if err := mgr.AddHealthzCheck(enableCtrl.Name(), enableCtrl.Healthz); err != nil {
-				return errors.Wrap(err, "add readiness check to controller")
+				return fmt.Errorf("add readiness check to controller: %w", err)
 			}
 		}
 	}
diff --git a/go.mod b/go.mod
index 85035f8cf..1e517922b 100644
--- a/go.mod
+++ b/go.mod
@@ -14,7 +14,6 @@ require (
 	github.com/nxadm/tail v1.4.8
 	github.com/openshift/api v0.0.0-20220209124712-b632c5fc10c0
 	github.com/pjbgf/go-apparmor v0.0.7
-	github.com/pkg/errors v0.9.1
 	github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.55.1
 	github.com/prometheus/client_golang v1.12.1
 	github.com/prometheus/client_model v0.2.0
@@ -81,6 +80,7 @@ require (
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/common v0.32.1 // indirect
 	github.com/prometheus/procfs v0.7.3 // indirect
diff --git a/internal/pkg/daemon/apparmorprofile/apparmor_supported.go b/internal/pkg/daemon/apparmorprofile/apparmor_supported.go
index 389cb7b3b..c81f218e6 100644
--- a/internal/pkg/daemon/apparmorprofile/apparmor_supported.go
+++ b/internal/pkg/daemon/apparmorprofile/apparmor_supported.go
@@ -20,6 +20,7 @@ limitations under the License.
 package apparmorprofile
 
 import (
+	"errors"
 	"os"
 	"path/filepath"
 	"sync"
@@ -27,7 +28,6 @@ import (
 	"github.com/go-logr/logr"
 	aa "github.com/pjbgf/go-apparmor/pkg/apparmor"
 	"github.com/pjbgf/go-apparmor/pkg/hostop"
-	"github.com/pkg/errors"
 
 	"sigs.k8s.io/security-profiles-operator/api/apparmorprofile/v1alpha1"
 	profilebasev1alpha1 "sigs.k8s.io/security-profiles-operator/api/profilebase/v1alpha1"
diff --git a/internal/pkg/daemon/apparmorprofile/apparmor_unsupported.go b/internal/pkg/daemon/apparmorprofile/apparmor_unsupported.go
index d5284b0e9..bb29f9d2a 100644
--- a/internal/pkg/daemon/apparmorprofile/apparmor_unsupported.go
+++ b/internal/pkg/daemon/apparmorprofile/apparmor_unsupported.go
@@ -20,8 +20,9 @@ limitations under the License.
 package apparmorprofile
 
 import (
+	"errors"
+
 	"github.com/go-logr/logr"
-	"github.com/pkg/errors"
 
 	profilebasev1alpha1 "sigs.k8s.io/security-profiles-operator/api/profilebase/v1alpha1"
 )
diff --git a/internal/pkg/daemon/apparmorprofile/apparmorprofile.go b/internal/pkg/daemon/apparmorprofile/apparmorprofile.go
index 4895562b4..0cc561b05 100644
--- a/internal/pkg/daemon/apparmorprofile/apparmorprofile.go
+++ b/internal/pkg/daemon/apparmorprofile/apparmorprofile.go
@@ -18,6 +18,7 @@ package apparmorprofile
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net/http"
 	"os"
@@ -25,7 +26,6 @@ import (
 
 	"github.com/crossplane/crossplane-runtime/pkg/event"
 	"github.com/go-logr/logr"
-	"github.com/pkg/errors"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
@@ -141,7 +141,10 @@ func (r *Reconciler) Reconcile(_ context.Context, req reconcile.Request) (reconc
 	appArmorProfile := &v1alpha1.AppArmorProfile{}
 	if err := r.client.Get(ctx, req.NamespacedName, appArmorProfile); err != nil {
 		// Expected to find an AppArmorProfile, return an error and requeue
-		return reconcile.Result{}, errors.Wrap(util.IgnoreNotFound(err), errGetProfile)
+		if util.IgnoreNotFound(err) == nil {
+			return reconcile.Result{}, nil
+		}
+		return reconcile.Result{}, fmt.Errorf("%s: %w", errGetProfile, err)
 	}
 
 	return r.reconcileAppArmorProfile(ctx, appArmorProfile, logger)
@@ -156,7 +159,7 @@ func (r *Reconciler) reconcileAppArmorProfile(
 
 	nodeStatus, err := nodestatus.NewForProfile(sp, r.client)
 	if err != nil {
-		return reconcile.Result{}, errors.Wrap(err, "cannot create nodeStatus")
+		return reconcile.Result{}, fmt.Errorf("cannot create nodeStatus: %w", err)
 	}
 
 	if !sp.GetDeletionTimestamp().IsZero() { // object is being deleted
@@ -167,12 +170,12 @@ func (r *Reconciler) reconcileAppArmorProfile(
 	exists, existErr := nodeStatus.Exists(ctx)
 
 	if existErr != nil {
-		return reconcile.Result{}, errors.Wrap(existErr, "checking if node status exists")
+		return reconcile.Result{}, fmt.Errorf("checking if node status exists: %w", existErr)
 	}
 
 	if !exists {
 		if err := nodeStatus.Create(ctx); err != nil {
-			return reconcile.Result{}, errors.Wrap(err, "cannot ensure node status")
+			return reconcile.Result{}, fmt.Errorf("cannot ensure node status: %w", err)
 		}
 		l.Info("Created an initial status for this node")
 		return reconcile.Result{RequeueAfter: wait}, nil
@@ -184,13 +187,13 @@ func (r *Reconciler) reconcileAppArmorProfile(
 		l.Error(err, "cannot load profile into node")
 		r.metrics.IncAppArmorProfileError(reasonCannotLoadProfile)
 		r.record.Event(sp, event.Warning(reasonCannotLoadProfile, err))
-		return reconcile.Result{}, errors.Wrap(err, "cannot load profile into node")
+		return reconcile.Result{}, fmt.Errorf("cannot load profile into node: %w", err)
 	}
 
 	isAlreadyInstalled, getErr := nodeStatus.Matches(ctx, statusv1alpha1.ProfileStateInstalled)
 	if getErr != nil {
-		l.Error(err, "couldn't get current status")
-		return reconcile.Result{}, errors.Wrap(err, "getting status for installed AppArmorProfile")
+		l.Error(getErr, "couldn't get current status")
+		return reconcile.Result{}, fmt.Errorf("getting status for installed AppArmorProfile: %w", getErr)
 	}
 
 	if isAlreadyInstalled {
@@ -202,7 +205,7 @@ func (r *Reconciler) reconcileAppArmorProfile(
 		l.Error(err, "cannot update node status")
 		r.metrics.IncAppArmorProfileError(reasonCannotUpdateStatus)
 		r.record.Event(sp, event.Warning(reasonCannotUpdateStatus, err))
-		return reconcile.Result{}, errors.Wrap(err, "updating status in AppArmorProfile reconciler")
+		return reconcile.Result{}, fmt.Errorf("updating status in AppArmorProfile reconciler: %w", err)
 	}
 
 	l.Info(
@@ -225,15 +228,15 @@ func (r *Reconciler) reconcileDeletion(
 ) (reconcile.Result, error) {
 	hasStatus, err := nsc.Exists(ctx)
 	if err != nil {
-		return ctrl.Result{}, errors.Wrap(err, "checking if node status exists")
+		return ctrl.Result{}, fmt.Errorf("checking if node status exists: %w", err)
 	}
 
 	// Set the status if it hasn't been deleted already
 	if hasStatus {
 		isTerminating, getErr := nsc.Matches(ctx, statusv1alpha1.ProfileStateTerminating)
 		if getErr != nil {
-			r.log.Error(err, "couldn't get current status")
-			return reconcile.Result{}, errors.Wrap(err, "getting status for deleted AppArmorProfile")
+			r.log.Error(getErr, "couldn't get current status")
+			return reconcile.Result{}, fmt.Errorf("getting status for deleted AppArmorProfile: %w", getErr)
 		}
 
 		if !isTerminating {
@@ -242,7 +245,7 @@ func (r *Reconciler) reconcileDeletion(
 				r.log.Error(err, "cannot update AppArmorProfile status")
 				r.metrics.IncAppArmorProfileError(reasonCannotUpdateProfile)
 				r.record.Event(sp, event.Warning(reasonCannotUpdateProfile, err))
-				return reconcile.Result{}, errors.Wrap(err, "updating status for deleted AppArmorProfile")
+				return reconcile.Result{}, fmt.Errorf("updating status for deleted AppArmorProfile: %w", err)
 			}
 			return reconcile.Result{Requeue: true, RequeueAfter: wait}, nil
 		}
@@ -257,22 +260,21 @@ func (r *Reconciler) reconcileDeletion(
 		r.log.Error(err, "cannot delete profile")
 		r.metrics.IncAppArmorProfileError(reasonCannotUnloadProfile)
 		r.record.Event(sp, event.Warning(reasonCannotUnloadProfile, err))
-		return ctrl.Result{}, errors.Wrap(err, "handling file deletion for deleted AppArmorProfile")
+		return ctrl.Result{}, fmt.Errorf("handling file deletion for deleted AppArmorProfile: %w", err)
 	}
 
 	if err := nsc.Remove(ctx, r.client); err != nil {
 		r.log.Error(err, "cannot remove node status/finalizer from apparmor profile")
 		r.metrics.IncAppArmorProfileError(reasonCannotUpdateStatus)
 		r.record.Event(sp, event.Warning(reasonCannotUpdateStatus, err))
-		return ctrl.Result{}, errors.Wrap(err, "deleting node status/finalizer for deleted AppArmorProfile")
+		return ctrl.Result{}, fmt.Errorf("deleting node status/finalizer for deleted AppArmorProfile: %w", err)
 	}
 	return ctrl.Result{}, nil
 }
 
 func (r *Reconciler) handleDeletion(sp *v1alpha1.AppArmorProfile) error {
-	err := r.manager.RemoveProfile(sp)
-	if err != nil {
-		return errors.Wrap(err, "unloading profile from host")
+	if err := r.manager.RemoveProfile(sp); err != nil {
+		return fmt.Errorf("unloading profile from host: %w", err)
 	}
 	r.log.Info(fmt.Sprintf("removed profile %s", sp.GetProfileName()))
 	r.metrics.IncAppArmorProfileDelete()
diff --git a/internal/pkg/daemon/bpfrecorder/bpfrecorder.go b/internal/pkg/daemon/bpfrecorder/bpfrecorder.go
index 0e293883a..ab72c8486 100644
--- a/internal/pkg/daemon/bpfrecorder/bpfrecorder.go
+++ b/internal/pkg/daemon/bpfrecorder/bpfrecorder.go
@@ -22,6 +22,7 @@ package bpfrecorder
 import (
 	"context"
 	"encoding/binary"
+	"errors"
 	"fmt"
 	"os"
 	"runtime"
@@ -36,7 +37,6 @@ import (
 	"github.com/ReneKroon/ttlcache/v2"
 	bpf "github.com/aquasecurity/libbpfgo"
 	"github.com/go-logr/logr"
-	"github.com/pkg/errors"
 	seccomp "github.com/seccomp/libseccomp-golang"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
@@ -107,7 +107,7 @@ func (b *BpfRecorder) Run() error {
 		b.containerIDCache, b.syscallNamesForIDCache,
 	} {
 		if err := b.SetTTL(cache, defaultCacheTimeout); err != nil {
-			return errors.Wrap(err, "set cache timeout")
+			return fmt.Errorf("set cache timeout: %w", err)
 		}
 		cache.SetCacheSizeLimit(maxCacheItems)
 		defer cache.Close() // nolint:gocritic // this is intentional
@@ -115,7 +115,7 @@ func (b *BpfRecorder) Run() error {
 
 	b.nodeName = b.Getenv(config.NodeNameEnvKey)
 	if b.nodeName == "" {
-		err := errors.Errorf("%s environment variable not set", config.NodeNameEnvKey)
+		err := fmt.Errorf("%s environment variable not set", config.NodeNameEnvKey)
 		b.logger.Error(err, "unable to run recorder")
 		return err
 	}
@@ -123,23 +123,23 @@ func (b *BpfRecorder) Run() error {
 
 	clusterConfig, err := b.InClusterConfig()
 	if err != nil {
-		return errors.Wrap(err, "get in-cluster config")
+		return fmt.Errorf("get in-cluster config: %w", err)
 	}
 
 	b.clientset, err = b.NewForConfig(clusterConfig)
 	if err != nil {
-		return errors.Wrap(err, "load in-cluster client")
+		return fmt.Errorf("load in-cluster client: %w", err)
 	}
 
 	if _, err := b.Stat(config.GRPCServerSocketBpfRecorder); err == nil {
 		if err := b.RemoveAll(config.GRPCServerSocketBpfRecorder); err != nil {
-			return errors.Wrap(err, "remove GRPC socket file")
+			return fmt.Errorf("remove GRPC socket file: %w", err)
 		}
 	}
 
 	listener, err := b.Listen("unix", config.GRPCServerSocketBpfRecorder)
 	if err != nil {
-		return errors.Wrap(err, "create listener")
+		return fmt.Errorf("create listener: %w", err)
 	}
 
 	if err := b.Chown(
@@ -147,13 +147,13 @@ func (b *BpfRecorder) Run() error {
 		config.UserRootless,
 		config.UserRootless,
 	); err != nil {
-		return errors.Wrap(err, "change GRPC socket owner to rootless")
+		return fmt.Errorf("change GRPC socket owner to rootless: %w", err)
 	}
 
 	b.logger.Info("Connecting to metrics server")
 	conn, cancel, err := b.connectMetrics()
 	if err != nil {
-		return errors.Wrap(err, "connect to metrics server")
+		return fmt.Errorf("connect to metrics server: %w", err)
 	}
 	if cancel != nil {
 		defer cancel()
@@ -168,13 +168,13 @@ func (b *BpfRecorder) Run() error {
 
 	b.systemMountNamespace, err = b.findSystemMountNamespace()
 	if err != nil {
-		return errors.Wrap(err, "retrieve current mount namespace")
+		return fmt.Errorf("retrieve current mount namespace: %w", err)
 	}
 	b.logger.Info("Got system mount namespace: " + fmt.Sprint(b.systemMountNamespace))
 
 	b.logger.Info("Doing BPF load/unload self-test")
 	if err := b.load(false); err != nil {
-		return errors.Wrap(err, "load self-test")
+		return fmt.Errorf("load self-test: %w", err)
 	}
 	b.unload()
 
@@ -192,7 +192,7 @@ func (b *BpfRecorder) connectMetrics() (conn *grpc.ClientConn, cancel context.Ca
 	if err := util.Retry(func() (err error) {
 		conn, cancel, err = b.DialMetrics()
 		if err != nil {
-			return errors.Wrap(err, "connecting to local metrics GRPC server")
+			return fmt.Errorf("connecting to local metrics GRPC server: %w", err)
 		}
 		client := apimetrics.NewMetricsClient(conn)
 
@@ -202,12 +202,12 @@ func (b *BpfRecorder) connectMetrics() (conn *grpc.ClientConn, cancel context.Ca
 			if err := b.CloseGRPC(conn); err != nil {
 				b.logger.Error(err, "Unable to close GRPC connection")
 			}
-			return errors.Wrap(err, "create metrics bpf client")
+			return fmt.Errorf("create metrics bpf client: %w", err)
 		}
 
 		return nil
 	}, func(err error) bool { return true }); err != nil {
-		return nil, nil, errors.Wrap(err, "connect to local GRPC server")
+		return nil, nil, fmt.Errorf("connect to local GRPC server: %w", err)
 	}
 
 	return conn, cancel, nil
@@ -224,7 +224,7 @@ func Dial() (*grpc.ClientConn, context.CancelFunc, error) {
 	)
 	if err != nil {
 		cancel()
-		return nil, nil, errors.Wrap(err, "GRPC dial")
+		return nil, nil, fmt.Errorf("GRPC dial: %w", err)
 	}
 	return conn, cancel, nil
 }
@@ -235,7 +235,7 @@ func (b *BpfRecorder) Start(
 	if b.startRequests == 0 {
 		b.logger.Info("Starting bpf recorder")
 		if err := b.load(true); err != nil {
-			return nil, errors.Wrap(err, "load bpf")
+			return nil, fmt.Errorf("load bpf: %w", err)
 		}
 	} else {
 		b.logger.Info("bpf recorder already running")
@@ -310,7 +310,7 @@ func (b *BpfRecorder) SyscallsForProfile(
 	}
 	b.logger.Info(fmt.Sprintf("Got PIDs for the profile: %+v", pids))
 	if len(pids) == 0 {
-		return nil, errors.Errorf("PID slice is empty")
+		return nil, fmt.Errorf("PID slice is empty")
 	}
 
 	result := []string{}
@@ -374,12 +374,12 @@ func (b *BpfRecorder) load(startEventProcessor bool) (err error) {
 	b.logger.Info("Loading bpf module")
 	b.btfPath, err = b.findBtfPath()
 	if err != nil {
-		return errors.Wrap(err, "find btf")
+		return fmt.Errorf("find btf: %w", err)
 	}
 
 	bpfObject, ok := bpfObjects[b.GoArch()]
 	if !ok {
-		return errors.Errorf("architecture %s is currently unsupported", runtime.GOARCH)
+		return fmt.Errorf("architecture %s is currently unsupported", runtime.GOARCH)
 	}
 
 	module, err := b.NewModuleFromBufferArgs(&bpf.NewModuleArgs{
@@ -388,42 +388,42 @@ func (b *BpfRecorder) load(startEventProcessor bool) (err error) {
 		BTFObjPath: b.btfPath,
 	})
 	if err != nil {
-		return errors.Wrap(err, "load bpf module")
+		return fmt.Errorf("load bpf module: %w", err)
 	}
 
 	b.logger.Info("Loading bpf object from module")
 	if err := b.BPFLoadObject(module); err != nil {
-		return errors.Wrap(err, "load bpf object")
+		return fmt.Errorf("load bpf object: %w", err)
 	}
 
 	const programName = "sys_enter"
 	b.logger.Info("Getting bpf program " + programName)
 	program, err := b.GetProgram(module, programName)
 	if err != nil {
-		return errors.Wrapf(err, "get %s program", programName)
+		return fmt.Errorf("get %s program: %w", programName, err)
 	}
 
 	b.logger.Info("Attaching bpf tracepoint")
 	if _, err := b.AttachTracepoint(program, "raw_syscalls", programName); err != nil {
-		return errors.Wrap(err, "attach tracepoint")
+		return fmt.Errorf("attach tracepoint: %w", err)
 	}
 
 	b.logger.Info("Getting syscalls map")
 	syscalls, err := b.GetMap(module, "syscalls")
 	if err != nil {
-		return errors.Wrap(err, "get syscalls map")
+		return fmt.Errorf("get syscalls map: %w", err)
 	}
 
 	b.logger.Info("Getting comms map")
 	comms, err := b.GetMap(module, "comms")
 	if err != nil {
-		return errors.Wrap(err, "get comms map")
+		return fmt.Errorf("get comms map: %w", err)
 	}
 
 	events := make(chan []byte)
 	ringbuffer, err := b.InitRingBuf(module, "events", events)
 	if err != nil {
-		return errors.Wrap(err, "init events ringbuffer")
+		return fmt.Errorf("init events ringbuffer: %w", err)
 	}
 	b.StartRingBuffer(ringbuffer)
 
@@ -448,12 +448,12 @@ func (b *BpfRecorder) findBtfPath() (string, error) {
 
 	btf := types.Btf{}
 	if err := b.Unmarshal([]byte(btfJSON), &btf); err != nil {
-		return "", errors.Wrap(err, "unmarshal btf JSON")
+		return "", fmt.Errorf("unmarshal btf JSON: %w", err)
 	}
 
 	res, err := b.ReadOSRelease()
 	if err != nil {
-		return "", errors.Wrap(err, "read os-release file")
+		return "", fmt.Errorf("read os-release file: %w", err)
 	}
 
 	osID := types.Os(res["ID"])
@@ -474,7 +474,7 @@ func (b *BpfRecorder) findBtfPath() (string, error) {
 
 	uname := syscall.Utsname{}
 	if err := b.Uname(&uname); err != nil {
-		return "", errors.Wrap(err, "uname syscall failed")
+		return "", fmt.Errorf("uname syscall failed: %w", err)
 	}
 
 	arch := types.Arch(toStringInt8(uname.Machine))
@@ -498,12 +498,12 @@ func (b *BpfRecorder) findBtfPath() (string, error) {
 		fmt.Sprintf("spo-btf-%s-%s-%s-%s", osID, osVersion, arch, kernel),
 	)
 	if err != nil {
-		return "", errors.Wrap(err, "create temp file")
+		return "", fmt.Errorf("create temp file: %w", err)
 	}
 	defer file.Close()
 
 	if _, err := b.Write(file, btfBytes); err != nil {
-		return "", errors.Wrap(err, "write BTF")
+		return "", fmt.Errorf("write BTF: %w", err)
 	}
 
 	b.logger.Info(fmt.Sprintf("Wrote BTF to file: %s", file.Name()))
@@ -598,14 +598,14 @@ func (b *BpfRecorder) findSystemMountNamespace() (uint64, error) {
 	// the namespace from the container.
 	res, err := b.Readlink("/proc/1/ns/mnt")
 	if err != nil {
-		return 0, errors.Wrap(err, "read mount namespace link")
+		return 0, fmt.Errorf("read mount namespace link: %w", err)
 	}
 	stripped := strings.TrimPrefix(res, "mnt:[")
 	stripped = strings.TrimSuffix(stripped, "]")
 
 	ns, err := b.Atoi(stripped)
 	if err != nil {
-		return 0, errors.Wrap(err, "convert namespace to integer")
+		return 0, fmt.Errorf("convert namespace to integer: %w", err)
 	}
 
 	return uint64(ns), nil
@@ -666,7 +666,7 @@ func (b *BpfRecorder) findContainerID(id string) error {
 			b.logger.Info("Looking up in-cluster container ID", "id", id, "try", try)
 			pods, err := b.ListPods(ctx, b.clientset, b.nodeName)
 			if err != nil {
-				return errors.Wrapf(err, "list node pods")
+				return fmt.Errorf("list node pods: %w", err)
 			}
 
 			for p := range pods.Items {
@@ -724,7 +724,7 @@ func (b *BpfRecorder) findContainerID(id string) error {
 		},
 		func(error) bool { return true },
 	); err != nil {
-		return errors.Wrap(err, "find container ID")
+		return fmt.Errorf("find container ID: %w", err)
 	}
 
 	return nil
@@ -755,11 +755,11 @@ func (b *BpfRecorder) syscallNameForID(id int) (string, error) {
 
 	name, err := b.GetName(seccomp.ScmpSyscall(id))
 	if err != nil {
-		return "", errors.Wrapf(err, "get syscall name for ID %d", id)
+		return "", fmt.Errorf("get syscall name for ID %d: %w", id, err)
 	}
 
 	if err := b.syscallNamesForIDCache.Set(key, name); err != nil {
-		return "", errors.Wrap(err, "update cache")
+		return "", fmt.Errorf("update cache: %w", err)
 	}
 	return name, nil
 }
diff --git a/internal/pkg/daemon/bpfrecorder/generate/main.go b/internal/pkg/daemon/bpfrecorder/generate/main.go
index c41c86705..40dc84b7d 100644
--- a/internal/pkg/daemon/bpfrecorder/generate/main.go
+++ b/internal/pkg/daemon/bpfrecorder/generate/main.go
@@ -26,8 +26,6 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/pkg/errors"
-
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/daemon/bpfrecorder/types"
 )
 
@@ -75,11 +73,11 @@ func run() error {
 	builder := &strings.Builder{}
 
 	if err := generateBpfObj(builder); err != nil {
-		return errors.Wrap(err, "generate bpf object")
+		return fmt.Errorf("generate bpf object: %w", err)
 	}
 
 	if err := generateBtf(builder); err != nil {
-		return errors.Wrap(err, "generate btf")
+		return fmt.Errorf("generate btf: %w", err)
 	}
 
 	// nolint:gosec // permissions are fine
@@ -87,10 +85,10 @@ func run() error {
 		// nolint:gomnd // filemode is fine
 		generatedGo, []byte(builder.String()), 0o644,
 	); err != nil {
-		return errors.Wrap(err, "writing generated object")
+		return fmt.Errorf("writing generated object: %w", err)
 	}
 	if err := exec.Command("go", "fmt", generatedGo).Run(); err != nil {
-		return errors.Wrap(err, "format go code")
+		return fmt.Errorf("format go code: %w", err)
 	}
 	return nil
 }
@@ -104,7 +102,7 @@ func generateBpfObj(builder *strings.Builder) error {
 
 		file, err := os.ReadFile(filepath.Join(buildDir, bpfObj+"."+arch))
 		if err != nil {
-			return errors.Wrap(err, "read bpf object path")
+			return fmt.Errorf("read bpf object path: %w", err)
 		}
 
 		size := len(file)
@@ -149,12 +147,12 @@ func generateBtf(builder *strings.Builder) error {
 		pathSplit := strings.Split(path, string(os.PathSeparator))
 		const expectedBPFPathLen = 9
 		if len(pathSplit) != expectedBPFPathLen {
-			return errors.Errorf("invalid btf path: %s (len = %d)", path, len(pathSplit))
+			return fmt.Errorf("invalid btf path: %s (len = %d)", path, len(pathSplit))
 		}
 
 		btfBytes, err := os.ReadFile(path)
 		if err != nil {
-			return errors.Wrap(err, "read btf file")
+			return fmt.Errorf("read btf file: %w", err)
 		}
 
 		os := types.Os(pathSplit[5])
@@ -181,11 +179,11 @@ func generateBtf(builder *strings.Builder) error {
 
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "walk btf files")
+		return fmt.Errorf("walk btf files: %w", err)
 	}
 	jsonBytes, err := json.MarshalIndent(btfs, "", "  ")
 	if err != nil {
-		return errors.Wrap(err, "marshal btf JSON")
+		return fmt.Errorf("marshal btf JSON: %w", err)
 	}
 	builder.Write(jsonBytes)
 	builder.WriteString("`\n")
@@ -194,7 +192,7 @@ func generateBtf(builder *strings.Builder) error {
 	if err := os.WriteFile(
 		docsFile, docs.Bytes(), fs.FileMode(0o644), // nolint:gomnd // filemode is fine
 	); err != nil {
-		return errors.Wrap(err, "write docs file")
+		return fmt.Errorf("write docs file: %w", err)
 	}
 
 	return nil
diff --git a/internal/pkg/daemon/bpfrecorder/impl.go b/internal/pkg/daemon/bpfrecorder/impl.go
index 45df062f6..36578a7b3 100644
--- a/internal/pkg/daemon/bpfrecorder/impl.go
+++ b/internal/pkg/daemon/bpfrecorder/impl.go
@@ -22,6 +22,7 @@ package bpfrecorder
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"net"
 	"os"
 	"runtime"
@@ -33,7 +34,6 @@ import (
 	"github.com/ReneKroon/ttlcache/v2"
 	"github.com/acobaugh/osrelease"
 	bpf "github.com/aquasecurity/libbpfgo"
-	"github.com/pkg/errors"
 	seccomp "github.com/seccomp/libseccomp-golang"
 	"google.golang.org/grpc"
 	v1 "k8s.io/api/core/v1"
diff --git a/internal/pkg/daemon/enricher/audit.go b/internal/pkg/daemon/enricher/audit.go
index d4334555c..5f6406cd1 100644
--- a/internal/pkg/daemon/enricher/audit.go
+++ b/internal/pkg/daemon/enricher/audit.go
@@ -17,10 +17,9 @@ limitations under the License.
 package enricher
 
 import (
+	"fmt"
 	"regexp"
 	"strconv"
-
-	"github.com/pkg/errors"
 )
 
 // type IDs are defined at https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/audit.h
@@ -59,7 +58,7 @@ func extractAuditLine(logLine string) (*auditLine, error) {
 		return selinux, nil
 	}
 
-	return nil, errors.Errorf("unsupported log line: %s", logLine)
+	return nil, fmt.Errorf("unsupported log line: %s", logLine)
 }
 
 func extractSeccompLine(logLine string) *auditLine {
diff --git a/internal/pkg/daemon/enricher/container.go b/internal/pkg/daemon/enricher/container.go
index 3314ba87d..f2d7128e0 100644
--- a/internal/pkg/daemon/enricher/container.go
+++ b/internal/pkg/daemon/enricher/container.go
@@ -17,10 +17,11 @@ limitations under the License.
 package enricher
 
 import (
+	"errors"
+	"fmt"
 	"time"
 
 	"github.com/ReneKroon/ttlcache/v2"
-	"github.com/pkg/errors"
 	"k8s.io/apimachinery/pkg/util/wait"
 
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/config"
@@ -54,12 +55,12 @@ func (e *Enricher) getContainerInfo(
 
 	clusterConfig, err := e.impl.InClusterConfig()
 	if err != nil {
-		return nil, errors.Wrap(err, "get in-cluster config")
+		return nil, fmt.Errorf("get in-cluster config: %w", err)
 	}
 
 	clientset, err := e.impl.NewForConfig(clusterConfig)
 	if err != nil {
-		return nil, errors.Wrap(err, "load in-cluster config")
+		return nil, fmt.Errorf("load in-cluster config: %w", err)
 	}
 
 	containerRetryBackoff := wait.Backoff{
@@ -74,7 +75,7 @@ func (e *Enricher) getContainerInfo(
 		func() (retryErr error) {
 			pods, err := e.impl.ListPods(clientset, nodeName)
 			if err != nil {
-				return errors.Wrapf(err, "list node %s's pods", nodeName)
+				return fmt.Errorf("list node %s's pods: %w", nodeName, err)
 			}
 
 			for p := range pods.Items {
@@ -96,7 +97,7 @@ func (e *Enricher) getContainerInfo(
 							return errContainerIDEmpty
 						}
 
-						return errors.Errorf(
+						return fmt.Errorf(
 							"container ID not found with container state: %v",
 							containerStatus.State,
 						)
@@ -126,7 +127,7 @@ func (e *Enricher) getContainerInfo(
 
 					// Update the cache
 					if err := e.infoCache.Set(rawContainerID, info); err != nil {
-						return errors.Wrap(err, "update cache")
+						return fmt.Errorf("update cache: %w", err)
 					}
 				}
 			}
@@ -136,7 +137,7 @@ func (e *Enricher) getContainerInfo(
 			return errors.Is(inErr, errContainerIDEmpty)
 		},
 	); err != nil {
-		return nil, errors.Wrap(err, "get container info for pods")
+		return nil, fmt.Errorf("get container info for pods: %w", err)
 	}
 
 	if info, err := e.infoCache.Get(
diff --git a/internal/pkg/daemon/enricher/enricher.go b/internal/pkg/daemon/enricher/enricher.go
index e664129db..6b4edfb97 100644
--- a/internal/pkg/daemon/enricher/enricher.go
+++ b/internal/pkg/daemon/enricher/enricher.go
@@ -18,6 +18,7 @@ package enricher
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"os"
 	"strconv"
@@ -27,7 +28,6 @@ import (
 	"github.com/ReneKroon/ttlcache/v2"
 	"github.com/go-logr/logr"
 	"github.com/nxadm/tail"
-	"github.com/pkg/errors"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/protobuf/encoding/protojson"
@@ -86,7 +86,7 @@ func (e *Enricher) Run() error {
 		e.auditLineCache,
 	} {
 		if err := e.impl.SetTTL(cache, defaultCacheTimeout); err != nil {
-			return errors.Wrap(err, "set cache timeout")
+			return fmt.Errorf("set cache timeout: %w", err)
 		}
 		cache.SetCacheSizeLimit(maxCacheItems)
 		defer cache.Close() // nolint:gocritic // this is intentional
@@ -99,7 +99,7 @@ func (e *Enricher) Run() error {
 
 	nodeName := e.impl.Getenv(config.NodeNameEnvKey)
 	if nodeName == "" {
-		err := errors.Errorf("%s environment variable not set", config.NodeNameEnvKey)
+		err := fmt.Errorf("%s environment variable not set", config.NodeNameEnvKey)
 		e.logger.Error(err, "unable to run enricher")
 		return err
 	}
@@ -116,7 +116,7 @@ func (e *Enricher) Run() error {
 	if err := util.Retry(func() (err error) {
 		conn, cancel, err = e.impl.Dial()
 		if err != nil {
-			return errors.Wrap(err, "connecting to local GRPC server")
+			return fmt.Errorf("connecting to local GRPC server: %w", err)
 		}
 		client := apimetrics.NewMetricsClient(conn)
 
@@ -124,18 +124,18 @@ func (e *Enricher) Run() error {
 		if err != nil {
 			cancel()
 			e.impl.Close(conn)
-			return errors.Wrap(err, "create metrics audit client")
+			return fmt.Errorf("create metrics audit client: %w", err)
 		}
 
 		return nil
 	}, func(err error) bool { return true }); err != nil {
-		return errors.Wrap(err, "connect to local GRPC server")
+		return fmt.Errorf("connect to local GRPC server: %w", err)
 	}
 	defer cancel()
 	defer e.impl.Close(conn)
 
 	if err := e.startGrpcServer(); err != nil {
-		return errors.Wrap(err, "start GRPC server")
+		return fmt.Errorf("start GRPC server: %w", err)
 	}
 
 	// Use auditd logs as main source or syslog as fallback.
@@ -154,7 +154,7 @@ func (e *Enricher) Run() error {
 		},
 	)
 	if err != nil {
-		return errors.Wrap(err, "tailing file")
+		return fmt.Errorf("tailing file: %w", err)
 	}
 
 	e.logger.Info("Reading from file " + filePath)
@@ -227,7 +227,7 @@ func (e *Enricher) Run() error {
 		}
 	}
 
-	return errors.Wrap(e.impl.Reason(tailFile), "enricher failed")
+	return fmt.Errorf("enricher failed: %w", e.impl.Reason(tailFile))
 }
 
 func (e *Enricher) startGrpcServer() error {
@@ -235,13 +235,13 @@ func (e *Enricher) startGrpcServer() error {
 
 	if _, err := e.impl.Stat(config.GRPCServerSocketEnricher); err == nil {
 		if err := e.impl.RemoveAll(config.GRPCServerSocketEnricher); err != nil {
-			return errors.Wrap(err, "remove GRPC socket file")
+			return fmt.Errorf("remove GRPC socket file: %w", err)
 		}
 	}
 
 	listener, err := e.impl.Listen("unix", config.GRPCServerSocketEnricher)
 	if err != nil {
-		return errors.Wrap(err, "create listener")
+		return fmt.Errorf("create listener: %w", err)
 	}
 
 	if err := e.impl.Chown(
@@ -249,7 +249,7 @@ func (e *Enricher) startGrpcServer() error {
 		config.UserRootless,
 		config.UserRootless,
 	); err != nil {
-		return errors.Wrap(err, "change GRPC socket owner to rootless")
+		return fmt.Errorf("change GRPC socket owner to rootless: %w", err)
 	}
 
 	grpcServer := grpc.NewServer(
@@ -278,7 +278,7 @@ func Dial() (*grpc.ClientConn, context.CancelFunc, error) {
 	)
 	if err != nil {
 		cancel()
-		return nil, nil, errors.Wrap(err, "GRPC dial")
+		return nil, nil, fmt.Errorf("GRPC dial: %w", err)
 	}
 	return conn, cancel, nil
 }
@@ -289,11 +289,11 @@ func (e *Enricher) addToBacklog(line *auditLine) error {
 	backlog, err := e.auditLineCache.Get(strPid)
 	if errors.Is(err, ttlcache.ErrNotFound) {
 		if setErr := e.impl.AddToBacklog(e.auditLineCache, strPid, []*auditLine{line}); setErr != nil {
-			return errors.Wrap(setErr, "adding the first line to the backlog")
+			return fmt.Errorf("adding the first line to the backlog: %w", setErr)
 		}
 		return nil
 	} else if err != nil {
-		return errors.Wrap(err, "retrieving an item from the cache")
+		return fmt.Errorf("retrieving an item from the cache: %w", err)
 	}
 
 	auditBacklog, ok := backlog.([]*auditLine)
@@ -315,7 +315,7 @@ func (e *Enricher) addToBacklog(line *auditLine) error {
 	}
 
 	if setErr := e.impl.AddToBacklog(e.auditLineCache, strPid, append(auditBacklog, line)); setErr != nil {
-		return errors.Wrap(setErr, "adding a line to the backlog")
+		return fmt.Errorf("adding a line to the backlog: %w", setErr)
 	}
 
 	return nil
@@ -334,7 +334,7 @@ func (e *Enricher) dispatchBacklog(
 		// nothing in the cache
 		return nil
 	} else if err != nil {
-		return errors.Wrap(err, "retrieving backlog")
+		return fmt.Errorf("retrieving backlog: %w", err)
 	}
 
 	auditBacklog, ok := backlog.([]*auditLine)
@@ -352,7 +352,7 @@ func (e *Enricher) dispatchBacklog(
 	}
 
 	if err := e.impl.FlushBacklog(e.auditLineCache, strPid); err != nil {
-		return errors.Wrap(err, "flushing backlog")
+		return fmt.Errorf("flushing backlog: %w", err)
 	}
 
 	return nil
@@ -370,7 +370,7 @@ func (e *Enricher) dispatchAuditLine(
 	case auditTypeSeccomp:
 		e.dispatchSeccompLine(metricsClient, nodeName, auditLine, info)
 	default:
-		return errors.Errorf("unknown audit line type %s", auditLine.auditType)
+		return fmt.Errorf("unknown audit line type %s", auditLine.auditType)
 	}
 
 	return nil
diff --git a/internal/pkg/daemon/enricher/grpc.go b/internal/pkg/daemon/enricher/grpc.go
index 05275d9c2..699f596a5 100644
--- a/internal/pkg/daemon/enricher/grpc.go
+++ b/internal/pkg/daemon/enricher/grpc.go
@@ -18,9 +18,10 @@ package enricher
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"runtime"
 
-	"github.com/pkg/errors"
 	"google.golang.org/protobuf/encoding/protojson"
 	"k8s.io/apimachinery/pkg/util/sets"
 
@@ -33,7 +34,7 @@ func (e *Enricher) Syscalls(
 ) (*api.SyscallsResponse, error) {
 	syscalls, ok := e.syscalls.Load(r.GetProfile())
 	if !ok {
-		return nil, errors.Errorf(
+		return nil, fmt.Errorf(
 			"no syscalls recorded for profile: %v", r.GetProfile(),
 		)
 	}
@@ -61,7 +62,7 @@ func (e *Enricher) Avcs(
 ) (*api.AvcResponse, error) {
 	avcs, ok := e.avcs.Load(r.GetProfile())
 	if !ok {
-		return nil, errors.Errorf(
+		return nil, fmt.Errorf(
 			"no avcs recorded for profile: %v", r.GetProfile(),
 		)
 	}
@@ -76,7 +77,7 @@ func (e *Enricher) Avcs(
 		avc := &api.AvcResponse_SelinuxAvc{}
 		err := protojson.Unmarshal([]byte(jsonList[i]), avc)
 		if err != nil {
-			return nil, errors.Wrap(err, "unmarshall JSON")
+			return nil, fmt.Errorf("unmarshall JSON: %w", err)
 		}
 		avcList = append(avcList, avc)
 	}
diff --git a/internal/pkg/daemon/metrics/grpc.go b/internal/pkg/daemon/metrics/grpc.go
index 0db441f33..258d6d08c 100644
--- a/internal/pkg/daemon/metrics/grpc.go
+++ b/internal/pkg/daemon/metrics/grpc.go
@@ -18,12 +18,13 @@ package metrics
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"io"
 	"net"
 	"os"
 	"time"
 
-	"github.com/pkg/errors"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 
@@ -40,13 +41,13 @@ const (
 func (m *Metrics) ServeGRPC() error {
 	if _, err := os.Stat(config.GRPCServerSocketMetrics); err == nil {
 		if err := os.RemoveAll(config.GRPCServerSocketMetrics); err != nil {
-			return errors.Wrap(err, "remove GRPC socket file")
+			return fmt.Errorf("remove GRPC socket file: %w", err)
 		}
 	}
 
 	listener, err := net.Listen("unix", config.GRPCServerSocketMetrics)
 	if err != nil {
-		return errors.Wrap(err, "create listener")
+		return fmt.Errorf("create listener: %w", err)
 	}
 
 	grpcServer := grpc.NewServer(
@@ -76,7 +77,7 @@ func Dial() (*grpc.ClientConn, context.CancelFunc, error) {
 	)
 	if err != nil {
 		cancel()
-		return nil, nil, errors.Wrap(err, "GRPC dial")
+		return nil, nil, fmt.Errorf("GRPC dial: %w", err)
 	}
 	return conn, cancel, nil
 }
@@ -91,7 +92,7 @@ func (m *Metrics) AuditInc(
 			return stream.SendAndClose(&api.EmptyResponse{})
 		}
 		if err != nil {
-			return errors.Wrap(err, "record syscalls")
+			return fmt.Errorf("record syscalls: %w", err)
 		}
 
 		switch r.GetType() {
@@ -125,7 +126,7 @@ func (m *Metrics) BpfInc(stream api.Metrics_BpfIncServer) error {
 			return stream.SendAndClose(&api.EmptyResponse{})
 		}
 		if err != nil {
-			return errors.Wrap(err, "record bpf metrics")
+			return fmt.Errorf("record bpf metrics: %w", err)
 		}
 
 		m.IncSeccompProfileBpf(
diff --git a/internal/pkg/daemon/metrics/metrics.go b/internal/pkg/daemon/metrics/metrics.go
index a376282f4..cce08ac31 100644
--- a/internal/pkg/daemon/metrics/metrics.go
+++ b/internal/pkg/daemon/metrics/metrics.go
@@ -22,7 +22,6 @@ import (
 
 	"github.com/crossplane/crossplane-runtime/pkg/event"
 	"github.com/go-logr/logr"
-	"github.com/pkg/errors"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -215,7 +214,7 @@ func (m *Metrics) Register() error {
 	} {
 		m.log.Info(fmt.Sprintf("Registering metric: %s", name))
 		if err := m.impl.Register(collector); err != nil {
-			return errors.Wrapf(err, "register collector for %s metric", name)
+			return fmt.Errorf("register collector for %s metric: %w", name, err)
 		}
 	}
 	return nil
diff --git a/internal/pkg/daemon/profilerecorder/profilerecorder.go b/internal/pkg/daemon/profilerecorder/profilerecorder.go
index 42674e6d3..adcfd117c 100644
--- a/internal/pkg/daemon/profilerecorder/profilerecorder.go
+++ b/internal/pkg/daemon/profilerecorder/profilerecorder.go
@@ -19,6 +19,8 @@ package profilerecorder
 import (
 	"context"
 	"encoding/json"
+	"errors"
+	"fmt"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -30,7 +32,6 @@ import (
 	"github.com/containers/common/pkg/seccomp"
 	"github.com/crossplane/crossplane-runtime/pkg/event"
 	"github.com/go-logr/logr"
-	"github.com/pkg/errors"
 	"google.golang.org/grpc/status"
 	corev1 "k8s.io/api/core/v1"
 	kerrors "k8s.io/apimachinery/pkg/api/errors"
@@ -119,14 +120,14 @@ func (r *RecorderReconciler) Setup(
 	const name = "profilerecorder"
 	c, err := r.NewClient(mgr)
 	if err != nil {
-		return errors.Wrap(err, "cannot get client connection")
+		return fmt.Errorf("cannot get client connection: %w", err)
 	}
 
 	node := &corev1.Node{}
 	if err := r.ClientGet(
 		c, client.ObjectKey{Name: os.Getenv(config.NodeNameEnvKey)}, node,
 	); err != nil {
-		return errors.Wrap(err, "cannot get node object")
+		return fmt.Errorf("cannot get node object: %w", err)
 	}
 
 	r.log = ctrl.Log.WithName(r.Name())
@@ -140,7 +141,7 @@ func (r *RecorderReconciler) Setup(
 	}
 
 	if len(nodeAddresses) == 0 {
-		return errors.New("Unable to get node's internal Address")
+		return errors.New("unable to get node's internal Address")
 	}
 
 	r.client = r.ManagerGetClient(mgr)
@@ -208,13 +209,15 @@ func (r *RecorderReconciler) Reconcile(_ context.Context, req reconcile.Request)
 	pod, err := r.GetPod(ctx, r.client, req.NamespacedName)
 	if err != nil {
 		if kerrors.IsNotFound(err) {
-			err = r.collectProfile(ctx, req.NamespacedName)
-			return reconcile.Result{}, errors.Wrap(err, "collect profile for removed pod")
+			if err := r.collectProfile(ctx, req.NamespacedName); err != nil {
+				return reconcile.Result{}, fmt.Errorf("collect profile for removed pod: %w", err)
+			}
+			return reconcile.Result{}, nil
 		}
 
 		// Returning an error means we will be requeued implicitly.
 		logger.Error(err, "Error reading pod")
-		return reconcile.Result{}, errors.Wrap(err, "cannot get pod")
+		return reconcile.Result{}, fmt.Errorf("cannot get pod: %w", err)
 	}
 
 	if pod.Status.Phase == corev1.PodPending {
@@ -283,7 +286,7 @@ func (r *RecorderReconciler) Reconcile(_ context.Context, req reconcile.Request)
 
 	if pod.Status.Phase == corev1.PodSucceeded {
 		if err := r.collectProfile(ctx, req.NamespacedName); err != nil {
-			return reconcile.Result{}, errors.Wrap(err, "collect profile for succeeded pod")
+			return reconcile.Result{}, fmt.Errorf("collect profile for succeeded pod: %w", err)
 		}
 	}
 
@@ -295,7 +298,7 @@ func (r *RecorderReconciler) getBpfRecorderClient() (bpfrecorderapi.BpfRecorderC
 
 	spod, err := r.getSPOD()
 	if err != nil {
-		return nil, nil, errors.Wrap(err, "getting SPOD config")
+		return nil, nil, fmt.Errorf("getting SPOD config: %w", err)
 	}
 
 	if !spod.Spec.EnableBpfRecorder {
@@ -305,7 +308,7 @@ func (r *RecorderReconciler) getBpfRecorderClient() (bpfrecorderapi.BpfRecorderC
 	r.log.Info("Connecting to local GRPC bpf recorder server")
 	conn, cancel, err := r.DialBpfRecorder()
 	if err != nil {
-		return nil, nil, errors.Wrap(err, "connect to bpf recorder GRPC server")
+		return nil, nil, fmt.Errorf("connect to bpf recorder GRPC server: %w", err)
 	}
 	bpfRecorderClient := bpfrecorderapi.NewBpfRecorderClient(conn)
 
@@ -315,7 +318,7 @@ func (r *RecorderReconciler) getBpfRecorderClient() (bpfrecorderapi.BpfRecorderC
 func (r *RecorderReconciler) startBpfRecorder() error {
 	recorderClient, cancel, err := r.getBpfRecorderClient()
 	if err != nil {
-		return errors.Wrap(err, "get bpf recorder client")
+		return fmt.Errorf("get bpf recorder client: %w", err)
 	}
 	defer cancel()
 
@@ -328,7 +331,7 @@ func (r *RecorderReconciler) startBpfRecorder() error {
 func (r *RecorderReconciler) stopBpfRecorder() error {
 	recorderClient, cancel, err := r.getBpfRecorderClient()
 	if err != nil {
-		return errors.Wrap(err, "get bpf recorder client")
+		return fmt.Errorf("get bpf recorder client: %w", err)
 	}
 	defer cancel()
 
@@ -357,7 +360,7 @@ func (r *RecorderReconciler) collectProfile(
 		if err := r.collectLocalProfiles(
 			ctx, name, podToWatch.profiles,
 		); err != nil {
-			return errors.Wrap(err, "collect local profile")
+			return fmt.Errorf("collect local profile: %w", err)
 		}
 	}
 
@@ -365,7 +368,7 @@ func (r *RecorderReconciler) collectProfile(
 		if err := r.collectLogProfiles(
 			ctx, name, podToWatch.profiles,
 		); err != nil {
-			return errors.Wrap(err, "collect log profile")
+			return fmt.Errorf("collect log profile: %w", err)
 		}
 	}
 
@@ -373,7 +376,7 @@ func (r *RecorderReconciler) collectProfile(
 		if err := r.collectBpfProfiles(
 			ctx, name, podToWatch.profiles,
 		); err != nil {
-			return errors.Wrap(err, "collect bpf profile")
+			return fmt.Errorf("collect bpf profile: %w", err)
 		}
 	}
 
@@ -397,13 +400,13 @@ func (r *RecorderReconciler) collectLocalProfiles(
 		data, err := r.ReadFile(profilePath)
 		if err != nil {
 			r.log.Error(err, "Failed to read profile")
-			return errors.Wrap(err, "read profile")
+			return fmt.Errorf("read profile: %w", err)
 		}
 
 		// Remove the file extension and timestamp
 		profileName, err := extractProfileName(filepath.Base(profilePath))
 		if err != nil {
-			return errors.Wrap(err, "extract profile name")
+			return fmt.Errorf("extract profile name: %w", err)
 		}
 
 		profile := &seccompprofileapi.SeccompProfile{
@@ -414,16 +417,16 @@ func (r *RecorderReconciler) collectLocalProfiles(
 		}
 		res, err := r.CreateOrUpdate(ctx, r.client, profile,
 			func() error {
-				return errors.Wrap(
-					json.Unmarshal(data, &profile.Spec),
-					"unmarshal profile spec JSON",
-				)
+				if err := json.Unmarshal(data, &profile.Spec); err != nil {
+					return fmt.Errorf("unmarshal profile spec JSON: %w", err)
+				}
+				return nil
 			},
 		)
 		if err != nil {
 			r.log.Error(err, "Cannot create seccompprofile resource")
 			r.record.Event(profile, event.Warning(reasonProfileCreationFailed, err))
-			return errors.Wrap(err, "create seccompProfile resource")
+			return fmt.Errorf("create seccompProfile resource: %w", err)
 		}
 		r.log.Info("Created/updated profile", "action", res, "name", profileName)
 		r.record.Event(
@@ -444,7 +447,7 @@ func (r *RecorderReconciler) collectLogProfiles(
 
 	spod, err := r.getSPOD()
 	if err != nil {
-		return errors.Wrap(err, "getting SPOD config")
+		return fmt.Errorf("getting SPOD config: %w", err)
 	}
 
 	if !spod.Spec.EnableLogEnricher {
@@ -454,7 +457,7 @@ func (r *RecorderReconciler) collectLogProfiles(
 	r.log.Info("Connecting to local GRPC enricher server")
 	conn, cancel, err := r.DialEnricher()
 	if err != nil {
-		return errors.Wrap(err, "connecting to local GRPC server")
+		return fmt.Errorf("connecting to local GRPC server: %w", err)
 	}
 	defer cancel()
 	enricherClient := enricherapi.NewEnricherClient(conn)
@@ -463,7 +466,7 @@ func (r *RecorderReconciler) collectLogProfiles(
 		// Remove the timestamp
 		profileName, err := extractProfileName(prf.name)
 		if err != nil {
-			return errors.Wrap(err, "extract profile name")
+			return fmt.Errorf("extract profile name: %w", err)
 		}
 
 		r.log.Info("Collecting profile", "name", profileName, "kind", prf.kind)
@@ -474,7 +477,7 @@ func (r *RecorderReconciler) collectLogProfiles(
 		case profilerecording1alpha1.ProfileRecordingKindSelinuxProfile:
 			err = r.collectLogSelinuxProfile(ctx, enricherClient, profileName, name.Namespace, prf.name)
 		default:
-			err = errors.Errorf("unrecognized kind %s", prf.kind)
+			err = fmt.Errorf("unrecognized kind %s", prf.kind)
 		}
 
 		if err != nil {
@@ -496,14 +499,12 @@ func (r *RecorderReconciler) collectLogSeccompProfile(
 	request := &enricherapi.SyscallsRequest{Profile: profileID}
 	response, err := r.Syscalls(ctx, enricherClient, request)
 	if err != nil {
-		return errors.Wrapf(
-			err, "retrieve syscalls for profile %s", profileID,
-		)
+		return fmt.Errorf("retrieve syscalls for profile %s: %w", profileID, err)
 	}
 
 	arch, err := r.goArchToSeccompArch(response.GoArch)
 	if err != nil {
-		return errors.Wrap(err, "get seccomp arch")
+		return fmt.Errorf("get seccomp arch: %w", err)
 	}
 
 	profileSpec := seccompprofileapi.SeccompProfileSpec{
@@ -532,7 +533,7 @@ func (r *RecorderReconciler) collectLogSeccompProfile(
 	if err != nil {
 		r.log.Error(err, "Cannot create seccompprofile resource")
 		r.record.Event(profile, event.Warning(reasonProfileCreationFailed, err))
-		return errors.Wrap(err, "create seccompProfile resource")
+		return fmt.Errorf("create seccompProfile resource: %w", err)
 	}
 
 	r.log.Info("Created/updated profile", "action", res, "name", profileName)
@@ -543,9 +544,7 @@ func (r *RecorderReconciler) collectLogSeccompProfile(
 
 	// Reset the syscalls for further recordings
 	if err := r.ResetSyscalls(ctx, enricherClient, request); err != nil {
-		return errors.Wrapf(
-			err, "reset syscalls for profile %s", profileID,
-		)
+		return fmt.Errorf("reset syscalls for profile %s: %w", profileID, err)
 	}
 
 	return nil
@@ -562,9 +561,7 @@ func (r *RecorderReconciler) collectLogSelinuxProfile(
 	request := &enricherapi.AvcRequest{Profile: profileID}
 	response, err := r.Avcs(ctx, enricherClient, request)
 	if err != nil {
-		return errors.Wrapf(
-			err, "retrieve avcs for profile %s", profileID,
-		)
+		return fmt.Errorf("retrieve avcs for profile %s: %w", profileID, err)
 	}
 
 	selinuxProfileSpec := selxv1alpha2.SelinuxProfileSpec{
@@ -588,7 +585,7 @@ func (r *RecorderReconciler) collectLogSelinuxProfile(
 	if err != nil {
 		r.log.Error(err, "Cannot format selinuxprofile")
 		r.record.Event(profile, event.Warning(reasonProfileCreationFailed, err))
-		return errors.Wrap(err, "format selinuxprofile resource")
+		return fmt.Errorf("format selinuxprofile resource: %w", err)
 	}
 	r.log.Info("Created", "profile", profile)
 
@@ -601,7 +598,7 @@ func (r *RecorderReconciler) collectLogSelinuxProfile(
 	if err != nil {
 		r.log.Error(err, "Cannot create selinuxprofile resource")
 		r.record.Event(profile, event.Warning(reasonProfileCreationFailed, err))
-		return errors.Wrap(err, "create selinuxprofile resource")
+		return fmt.Errorf("create selinuxprofile resource: %w", err)
 	}
 	r.log.Info("Created/updated selinux profile", "action", res, "name", profileName)
 	r.record.Event(
@@ -611,9 +608,7 @@ func (r *RecorderReconciler) collectLogSelinuxProfile(
 
 	// Reset the selinuxprofile for further recordings
 	if err := r.ResetAvcs(ctx, enricherClient, request); err != nil {
-		return errors.Wrapf(
-			err, "reset selinuxprofile for profile %s", profileName,
-		)
+		return fmt.Errorf("reset selinuxprofile for profile %s: %w", profileName, err)
 	}
 
 	return nil
@@ -626,12 +621,12 @@ func (r *RecorderReconciler) formatSelinuxProfile(
 	seBuilder := newSeProfileBuilder(selinuxprofile.GetPolicyUsage(), r.log)
 
 	if err := seBuilder.AddAvcList(avcResponse.GetAvc()); err != nil {
-		return nil, errors.Wrap(err, "consuming AVCs")
+		return nil, fmt.Errorf("consuming AVCs: %w", err)
 	}
 
 	sePol, err := seBuilder.Format()
 	if err != nil {
-		return nil, errors.Wrap(err, "building policy")
+		return nil, fmt.Errorf("building policy: %w", err)
 	}
 
 	return sePol, nil
@@ -644,7 +639,7 @@ func (r *RecorderReconciler) collectBpfProfiles(
 ) error {
 	recorderClient, cancel, err := r.getBpfRecorderClient()
 	if err != nil {
-		return errors.Wrap(err, "get bpf recorder client")
+		return fmt.Errorf("get bpf recorder client: %w", err)
 	}
 	defer cancel()
 
@@ -661,13 +656,13 @@ func (r *RecorderReconciler) collectBpfProfiles(
 				r.log.Error(err, "Recorded profile not found", profile.name)
 				continue
 			} else {
-				return errors.Wrap(err, "get syscalls for profile")
+				return fmt.Errorf("get syscalls for profile: %w", err)
 			}
 		}
 
 		arch, err := r.goArchToSeccompArch(response.GoArch)
 		if err != nil {
-			return errors.Wrap(err, "get seccomp arch")
+			return fmt.Errorf("get seccomp arch: %w", err)
 		}
 
 		profileSpec := seccompprofileapi.SeccompProfileSpec{
@@ -682,7 +677,7 @@ func (r *RecorderReconciler) collectBpfProfiles(
 		// Remove the timestamp
 		profileName, err := extractProfileName(profile.name)
 		if err != nil {
-			return errors.Wrap(err, "extract profile name")
+			return fmt.Errorf("extract profile name: %w", err)
 		}
 
 		profile := &seccompprofileapi.SeccompProfile{
@@ -702,7 +697,7 @@ func (r *RecorderReconciler) collectBpfProfiles(
 		if err != nil {
 			r.log.Error(err, "Cannot create seccompprofile resource")
 			r.record.Event(profile, event.Warning(reasonProfileCreationFailed, err))
-			return errors.Wrap(err, "create seccompProfile resource")
+			return fmt.Errorf("create seccompProfile resource: %w", err)
 		}
 
 		r.log.Info("Created/updated profile", "action", res, "name", profileName)
@@ -714,7 +709,7 @@ func (r *RecorderReconciler) collectBpfProfiles(
 
 	if err := r.stopBpfRecorder(); err != nil {
 		r.log.Error(err, "Unable to stop bpf recorder")
-		return errors.Wrap(err, "stop bpf recorder")
+		return fmt.Errorf("stop bpf recorder: %w", err)
 	}
 	return nil
 }
@@ -722,7 +717,7 @@ func (r *RecorderReconciler) collectBpfProfiles(
 func extractProfileName(s string) (string, error) {
 	lastIndex := strings.LastIndex(s, "-")
 	if lastIndex == -1 {
-		return "", errors.Errorf("malformed profile path: %s", s)
+		return "", fmt.Errorf("malformed profile path: %s", s)
 	}
 	return s[:lastIndex], nil
 }
@@ -738,14 +733,17 @@ func parseHookAnnotations(annotations map[string]string) (res []profileToCollect
 		}
 
 		if !strings.HasPrefix(value, prefix) {
-			return nil, errors.Wrapf(errors.New(errInvalidAnnotation),
-				"must start with %q prefix", prefix)
+			return nil, fmt.Errorf(
+				"%s: must start with %q prefix", errInvalidAnnotation, prefix,
+			)
 		}
 
 		outputFile := strings.TrimSpace(strings.TrimPrefix(value, prefix))
 		if !filepath.IsAbs(outputFile) {
-			return nil, errors.Wrapf(errors.New(errInvalidAnnotation),
-				"output file path must be absolute: %q", outputFile)
+			return nil, fmt.Errorf(
+				"%s: output file path must be absolute: %q",
+				errInvalidAnnotation, outputFile,
+			)
 		}
 
 		if !strings.HasPrefix(outputFile, config.ProfileRecordingOutputPath) {
@@ -779,8 +777,10 @@ func parseLogAnnotations(annotations map[string]string) (res []profileToCollect,
 		}
 
 		if profile == "" {
-			return nil, errors.Wrap(errors.New(errInvalidAnnotation),
-				"providing output profile is mandatory")
+			return nil, fmt.Errorf(
+				"%s: providing output profile is mandatory",
+				errInvalidAnnotation,
+			)
 		}
 		collectProfile.name = profile
 
@@ -803,8 +803,10 @@ func parseBpfAnnotations(annotations map[string]string) (res []profileToCollect,
 		}
 
 		if profile == "" {
-			return nil, errors.Wrap(errors.New(errInvalidAnnotation),
-				"providing output profile is mandatory")
+			return nil, fmt.Errorf(
+				"%s: providing output profile is mandatory",
+				errInvalidAnnotation,
+			)
 		}
 		collectProfile.name = profile
 
@@ -841,7 +843,7 @@ func (sb *seProfileBuilder) AddAvcList(avcs []*enricherapi.AvcResponse_SelinuxAv
 			"tcontext", avc.Tcontext)
 
 		if err := sb.addAvc(avc); err != nil {
-			return errors.Wrap(err, "adding AVC")
+			return fmt.Errorf("adding AVC: %w", err)
 		}
 	}
 
@@ -851,7 +853,7 @@ func (sb *seProfileBuilder) AddAvcList(avcs []*enricherapi.AvcResponse_SelinuxAv
 func (sb *seProfileBuilder) addAvc(avc *enricherapi.AvcResponse_SelinuxAvc) error {
 	ctxType, err := ctxt2type(avc.Tcontext)
 	if err != nil {
-		return errors.Wrap(err, "converting context to type")
+		return fmt.Errorf("converting context to type: %w", err)
 	}
 
 	key := avc.Tclass + " " + ctxType
@@ -871,7 +873,7 @@ func (sb *seProfileBuilder) Format() (selxv1alpha2.Allow, error) {
 	for _, key := range sb.keys {
 		val := sb.permMap[key]
 		if err := sb.writeLineFromKeyVal(key, val); err != nil {
-			return nil, errors.Wrap(err, "writing policy line from key-value pair")
+			return nil, fmt.Errorf("writing policy line from key-value pair: %w", err)
 		}
 	}
 
@@ -912,7 +914,7 @@ func (sb *seProfileBuilder) targetClassCtx(key string) (tclass, tcontext string)
 func ctxt2type(ctx string) (string, error) {
 	elems := strings.Split(ctx, ":")
 	if len(elems) < seContextRequiredParts {
-		return "", errors.New("Malformed SELinux context")
+		return "", errors.New("malformed SELinux context")
 	}
 	return elems[2], nil
 }
@@ -920,7 +922,7 @@ func ctxt2type(ctx string) (string, error) {
 func (r *RecorderReconciler) goArchToSeccompArch(goarch string) (seccompprofileapi.Arch, error) {
 	seccompArch, err := r.GoArchToSeccompArch(goarch)
 	if err != nil {
-		return "", errors.Wrap(err, "convert golang to seccomp arch")
+		return "", fmt.Errorf("convert golang to seccomp arch: %w", err)
 	}
 	return seccompprofileapi.Arch(seccompArch), nil
 }
diff --git a/internal/pkg/daemon/seccompprofile/seccompprofile.go b/internal/pkg/daemon/seccompprofile/seccompprofile.go
index 36baeff38..7d9428299 100644
--- a/internal/pkg/daemon/seccompprofile/seccompprofile.go
+++ b/internal/pkg/daemon/seccompprofile/seccompprofile.go
@@ -20,6 +20,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"os"
@@ -29,7 +30,6 @@ import (
 	"github.com/containers/common/pkg/seccomp"
 	"github.com/crossplane/crossplane-runtime/pkg/event"
 	"github.com/go-logr/logr"
-	"github.com/pkg/errors"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
@@ -171,7 +171,10 @@ func (r *Reconciler) Reconcile(_ context.Context, req reconcile.Request) (reconc
 	seccompProfile := &seccompprofileapi.SeccompProfile{}
 	if err := r.client.Get(ctx, req.NamespacedName, seccompProfile); err != nil {
 		// Expected to find a SeccompProfile, return an error and requeue
-		return reconcile.Result{}, errors.Wrap(util.IgnoreNotFound(err), errGetProfile)
+		if util.IgnoreNotFound(err) == nil {
+			return reconcile.Result{}, nil
+		}
+		return reconcile.Result{}, fmt.Errorf("%s: %w", errGetProfile, err)
 	}
 
 	return r.reconcileSeccompProfile(ctx, seccompProfile, logger)
@@ -235,7 +238,7 @@ func (r *Reconciler) mergeBaseProfile(
 		l.Error(err, "cannot retrieve base profile "+baseProfileName)
 		r.metrics.IncSeccompProfileError(reasonInvalidSeccompProfile)
 		r.record.Event(sp, event.Warning(reasonInvalidSeccompProfile, err))
-		return op, errors.Wrap(err, "merging base profile")
+		return op, fmt.Errorf("merging base profile: %w", err)
 	}
 	op.Syscalls = unionSyscalls(baseProfile.Spec.Syscalls, sp.Spec.Syscalls)
 	return op, nil
@@ -251,7 +254,7 @@ func (r *Reconciler) reconcileSeccompProfile(
 
 	nodeStatus, err := nodestatus.NewForProfile(sp, r.client)
 	if err != nil {
-		return reconcile.Result{}, errors.Wrap(err, "cannot create nodeStatus")
+		return reconcile.Result{}, fmt.Errorf("cannot create nodeStatus: %w", err)
 	}
 
 	if !sp.GetDeletionTimestamp().IsZero() { // object is being deleted
@@ -268,7 +271,7 @@ func (r *Reconciler) reconcileSeccompProfile(
 		l.Error(err, "cannot validate profile "+profileName)
 		r.metrics.IncSeccompProfileError(reasonInvalidSeccompProfile)
 		r.record.Event(sp, event.Warning(reasonInvalidSeccompProfile, err))
-		return reconcile.Result{}, errors.Wrap(err, "cannot validate profile")
+		return reconcile.Result{}, fmt.Errorf("cannot validate profile: %w", err)
 	}
 
 	profilePath := sp.GetProfilePath()
@@ -277,12 +280,12 @@ func (r *Reconciler) reconcileSeccompProfile(
 	exists, existErr := nodeStatus.Exists(ctx)
 
 	if existErr != nil {
-		return reconcile.Result{}, errors.Wrap(existErr, "checking if node status exists")
+		return reconcile.Result{}, fmt.Errorf("checking if node status exists: %w", existErr)
 	}
 
 	if !exists {
 		if err := nodeStatus.Create(ctx); err != nil {
-			return reconcile.Result{}, errors.Wrap(err, "cannot ensure node status")
+			return reconcile.Result{}, fmt.Errorf("cannot ensure node status: %w", err)
 		}
 		l.Info("Created an initial status for this node")
 		return reconcile.Result{RequeueAfter: wait}, nil
@@ -293,13 +296,13 @@ func (r *Reconciler) reconcileSeccompProfile(
 		l.Error(err, "cannot save profile into disk")
 		r.metrics.IncSeccompProfileError(reasonCannotSaveProfile)
 		r.record.Event(sp, event.Warning(reasonCannotSaveProfile, err))
-		return reconcile.Result{}, errors.Wrap(err, "cannot save profile into disk")
+		return reconcile.Result{}, fmt.Errorf("cannot save profile into disk: %w", err)
 	}
 
 	isAlreadyInstalled, getErr := nodeStatus.Matches(ctx, statusv1alpha1.ProfileStateInstalled)
 	if getErr != nil {
-		l.Error(err, "couldn't get current status")
-		return reconcile.Result{}, errors.Wrap(err, "getting status for installed SeccompProfile")
+		l.Error(getErr, "couldn't get current status")
+		return reconcile.Result{}, fmt.Errorf("getting status for installed SeccompProfile: %w", getErr)
 	}
 
 	if isAlreadyInstalled {
@@ -311,7 +314,7 @@ func (r *Reconciler) reconcileSeccompProfile(
 		l.Error(err, "cannot update node status")
 		r.metrics.IncSeccompProfileError(reasonCannotUpdateStatus)
 		r.record.Event(sp, event.Warning(reasonCannotUpdateStatus, err))
-		return reconcile.Result{}, errors.Wrap(err, "updating status in SeccompProfile reconciler")
+		return reconcile.Result{}, fmt.Errorf("updating status in SeccompProfile reconciler: %w", err)
 	}
 
 	l.Info(
@@ -334,15 +337,15 @@ func (r *Reconciler) reconcileDeletion(
 ) (reconcile.Result, error) {
 	hasStatus, err := nsc.Exists(ctx)
 	if err != nil {
-		return ctrl.Result{}, errors.Wrap(err, "checking if node status exists")
+		return ctrl.Result{}, fmt.Errorf("checking if node status exists: %w", err)
 	}
 
 	// Set the status if it hasn't been deleted already
 	if hasStatus {
 		isTerminating, getErr := nsc.Matches(ctx, statusv1alpha1.ProfileStateTerminating)
 		if getErr != nil {
-			r.log.Error(err, "couldn't get current status")
-			return reconcile.Result{}, errors.Wrap(err, "getting status for deleted SeccompProfile")
+			r.log.Error(getErr, "couldn't get current status")
+			return reconcile.Result{}, fmt.Errorf("getting status for deleted SeccompProfile: %w", getErr)
 		}
 
 		if !isTerminating {
@@ -351,7 +354,7 @@ func (r *Reconciler) reconcileDeletion(
 				r.log.Error(err, "cannot update SeccompProfile status")
 				r.metrics.IncSeccompProfileError(reasonCannotUpdateProfile)
 				r.record.Event(sp, event.Warning(reasonCannotUpdateProfile, err))
-				return reconcile.Result{}, errors.Wrap(err, "updating status for deleted SeccompProfile")
+				return reconcile.Result{}, fmt.Errorf("updating status for deleted SeccompProfile: %w", err)
 			}
 			return reconcile.Result{Requeue: true, RequeueAfter: wait}, nil
 		}
@@ -366,14 +369,14 @@ func (r *Reconciler) reconcileDeletion(
 		r.log.Error(err, "cannot delete profile")
 		r.metrics.IncSeccompProfileError(reasonCannotRemoveProfile)
 		r.record.Event(sp, event.Warning(reasonCannotRemoveProfile, err))
-		return ctrl.Result{}, errors.Wrap(err, "handling file deletion for deleted SeccompProfile")
+		return ctrl.Result{}, fmt.Errorf("handling file deletion for deleted SeccompProfile: %w", err)
 	}
 
 	if err := nsc.Remove(ctx, r.client); err != nil {
 		r.log.Error(err, "cannot remove node status/finalizer from seccomp profile")
 		r.metrics.IncSeccompProfileError(reasonCannotUpdateStatus)
 		r.record.Event(sp, event.Warning(reasonCannotUpdateStatus, err))
-		return ctrl.Result{}, errors.Wrap(err, "deleting node status/finalizer for deleted SeccompProfile")
+		return ctrl.Result{}, fmt.Errorf("deleting node status/finalizer for deleted SeccompProfile: %w", err)
 	}
 	return ctrl.Result{}, nil
 }
@@ -385,7 +388,7 @@ func (r *Reconciler) handleDeletion(sp *seccompprofileapi.SeccompProfile) error
 		return nil
 	}
 	if err != nil {
-		return errors.Wrap(err, "removing profile from host")
+		return fmt.Errorf("removing profile from host: %w", err)
 	}
 	r.log.Info(fmt.Sprintf("removed profile %s", profilePath))
 	r.metrics.IncSeccompProfileDelete()
@@ -394,7 +397,7 @@ func (r *Reconciler) handleDeletion(sp *seccompprofileapi.SeccompProfile) error
 
 func saveProfileOnDisk(fileName string, content []byte) (updated bool, err error) {
 	if err := os.MkdirAll(path.Dir(fileName), dirPermissionMode); err != nil {
-		return false, errors.Wrap(err, errCreatingOperatorDir)
+		return false, fmt.Errorf("%s: %w", errCreatingOperatorDir, err)
 	}
 
 	existingContent, err := os.ReadFile(fileName)
@@ -403,7 +406,7 @@ func saveProfileOnDisk(fileName string, content []byte) (updated bool, err error
 	}
 
 	if err := os.WriteFile(fileName, content, filePermissionMode); err != nil {
-		return false, errors.Wrap(err, errSavingProfile)
+		return false, fmt.Errorf("%s: %w", errSavingProfile, err)
 	}
 
 	return true, nil
diff --git a/internal/pkg/daemon/selinuxprofile/common_controller.go b/internal/pkg/daemon/selinuxprofile/common_controller.go
index 4de93fa8b..54b02926c 100644
--- a/internal/pkg/daemon/selinuxprofile/common_controller.go
+++ b/internal/pkg/daemon/selinuxprofile/common_controller.go
@@ -20,6 +20,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net"
@@ -30,7 +31,6 @@ import (
 
 	"github.com/crossplane/crossplane-runtime/pkg/event"
 	"github.com/go-logr/logr"
-	"github.com/pkg/errors"
 	kerrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -128,7 +128,7 @@ func (r *ReconcileSelinux) SchemeBuilder() *scheme.Builder {
 func (r *ReconcileSelinux) Healthz(*http.Request) error {
 	ready, err := isSelinuxdReady()
 	if err != nil {
-		return errors.Wrapf(err, "getting health status")
+		return fmt.Errorf("getting health status: %w", err)
 	}
 	if !ready {
 		return errors.New("not ready")
@@ -161,7 +161,7 @@ func (r *ReconcileSelinux) Reconcile(ctx context.Context, request reconcile.Requ
 
 	nodeStatus, err := nodestatus.NewForProfile(instance, r.client)
 	if err != nil {
-		return reconcile.Result{}, errors.Wrap(err, "cannot create nodeStatus instance")
+		return reconcile.Result{}, fmt.Errorf("cannot create nodeStatus instance: %w", err)
 	}
 
 	if instance.GetDeletionTimestamp().IsZero() {
@@ -170,12 +170,12 @@ func (r *ReconcileSelinux) Reconcile(ctx context.Context, request reconcile.Requ
 		exists, existErr := nodeStatus.Exists(ctx)
 
 		if existErr != nil {
-			return reconcile.Result{}, errors.Wrap(existErr, "checking if node status exists")
+			return reconcile.Result{}, fmt.Errorf("checking if node status exists: %w", existErr)
 		}
 
 		if !exists {
 			if err := nodeStatus.Create(ctx); err != nil {
-				return reconcile.Result{}, errors.Wrap(err, "cannot ensure node status")
+				return reconcile.Result{}, fmt.Errorf("cannot ensure node status: %w", err)
 			}
 		}
 
@@ -186,15 +186,18 @@ func (r *ReconcileSelinux) Reconcile(ctx context.Context, request reconcile.Requ
 		reqLogger.Error(err, "cannot update SELinux profile status")
 		r.metrics.IncSelinuxProfileError(reasonCannotUpdatePolicyStatus)
 		r.record.Event(instance, event.Warning(reasonCannotUpdatePolicyStatus, err))
-		return reconcile.Result{}, errors.Wrap(err, "updating status for deleted SELinux profile")
+		return reconcile.Result{}, fmt.Errorf("updating status for deleted SELinux profile: %w", err)
 	}
 
 	// since the nodeStatus API always removes both the node status and the node's finalizer in sync,
 	// this condition will only be true after both are gone and therefore when the profile is really
 	// gone from the node
 	hasStatus, err := nodeStatus.Exists(context.TODO())
-	if err != nil || !hasStatus {
-		return reconcile.Result{}, errors.Wrap(err, "asserting if node status exists")
+	if err != nil {
+		return reconcile.Result{}, fmt.Errorf("asserting if node status exists: %w", err)
+	}
+	if !hasStatus {
+		return reconcile.Result{}, nil
 	}
 
 	res, err := r.reconcileDeletePolicy(instance, nodeStatus, reqLogger)
@@ -212,7 +215,7 @@ func (r *ReconcileSelinux) Reconcile(ctx context.Context, request reconcile.Requ
 		reqLogger.Error(err, "cannot remove finalizer from SELinux profile")
 		r.metrics.IncSelinuxProfileError(reasonCannotUpdatePolicyStatus)
 		r.record.Event(instance, event.Warning(reasonCannotUpdatePolicyStatus, err))
-		return ctrl.Result{}, errors.Wrap(err, "deleting finalizer for deleted SELinux profile")
+		return ctrl.Result{}, fmt.Errorf("deleting finalizer for deleted SELinux profile: %w", err)
 	}
 
 	return reconcile.Result{}, nil
@@ -228,7 +231,7 @@ func (r *ReconcileSelinux) reconcilePolicy(
 	if err != nil {
 		r.metrics.IncSelinuxProfileError(reasonCannotContactSelinuxd)
 		r.record.Event(sp, event.Warning(reasonCannotContactSelinuxd, err))
-		return reconcile.Result{}, errors.Wrap(err, "contacting selinuxd")
+		return reconcile.Result{}, fmt.Errorf("contacting selinuxd: %w", err)
 	}
 	if !selinuxdReady {
 		l.Info("selinuxd not yet up, requeue")
@@ -240,7 +243,7 @@ func (r *ReconcileSelinux) reconcilePolicy(
 		if err := nodeStatus.SetNodeStatus(context.TODO(), statusv1alpha1.ProfileStateError); err != nil {
 			r.metrics.IncSelinuxProfileError(reasonCannotUpdatePolicyStatus)
 			r.record.Event(sp, event.Warning(reasonCannotUpdatePolicyStatus, err))
-			return reconcile.Result{}, errors.Wrap(err, "setting node status to error")
+			return reconcile.Result{}, fmt.Errorf("setting node status to error: %w", err)
 		}
 		evstr := fmt.Sprintf("Profile failed validation on %s: %s", os.Getenv(config.NodeNameEnvKey), valErr.Error())
 		r.metrics.IncSelinuxProfileError(reasonCannotInstallPolicy)
@@ -252,7 +255,7 @@ func (r *ReconcileSelinux) reconcilePolicy(
 	if err != nil {
 		r.metrics.IncSelinuxProfileError(reasonCannotWritePolicyFile)
 		r.record.Event(sp, event.Warning(reasonCannotWritePolicyFile, err))
-		return reconcile.Result{}, errors.Wrap(err, "Creating policy file")
+		return reconcile.Result{}, fmt.Errorf("creating policy file: %w", err)
 	}
 
 	l.Info("Checking if policy deployed", "policyName", sp.GetName())
@@ -262,7 +265,7 @@ func (r *ReconcileSelinux) reconcilePolicy(
 		if err := nodeStatus.SetNodeStatus(context.TODO(), statusv1alpha1.ProfileStateInProgress); err != nil {
 			r.metrics.IncSelinuxProfileError(reasonCannotUpdatePolicyStatus)
 			r.record.Event(sp, event.Warning(reasonCannotUpdatePolicyStatus, err))
-			return reconcile.Result{}, errors.Wrap(err, "setting node status to in progress")
+			return reconcile.Result{}, fmt.Errorf("setting node status to in progress: %w", err)
 		}
 		return reconcile.Result{Requeue: true}, nil
 	}
@@ -270,7 +273,7 @@ func (r *ReconcileSelinux) reconcilePolicy(
 	if err != nil {
 		r.metrics.IncSelinuxProfileError(reasonCannotGetPolicyStatus)
 		r.record.Event(sp, event.Warning(reasonCannotGetPolicyStatus, err))
-		return reconcile.Result{}, errors.Wrap(err, "Looking up policy status")
+		return reconcile.Result{}, fmt.Errorf("looking up policy status: %w", err)
 	}
 
 	var polState statusv1alpha1.ProfileState
@@ -293,7 +296,7 @@ func (r *ReconcileSelinux) reconcilePolicy(
 	if err := nodeStatus.SetNodeStatus(context.TODO(), polState); err != nil {
 		r.metrics.IncSelinuxProfileError(reasonCannotUpdatePolicyStatus)
 		r.record.Event(sp, event.Warning(reasonCannotUpdatePolicyStatus, err))
-		return reconcile.Result{}, errors.Wrap(err, "setting profile status")
+		return reconcile.Result{}, fmt.Errorf("setting profile status: %w", err)
 	}
 
 	return reconcile.Result{}, nil
@@ -307,14 +310,14 @@ func (r *ReconcileSelinux) reconcilePolicyFile(
 	policyPath := path.Join(bindata.SelinuxDropDirectory, sp.GetPolicyName()+".cil")
 	cil, parseErr := oh.GetCILPolicy()
 	if parseErr != nil {
-		return errors.Wrap(parseErr, "Generating CIL")
+		return fmt.Errorf("generating CIL: %w", parseErr)
 	}
 	policyContent := []byte(cil)
 
 	l.Info("Writing to policy file", "policyPath", policyPath)
-	err := writeFileIfDiffers(policyPath, policyContent)
-	if err != nil {
-		return errors.Wrap(err, "Writing policy file")
+
+	if err := writeFileIfDiffers(policyPath, policyContent); err != nil {
+		return fmt.Errorf("writing policy file: %w", err)
 	}
 
 	return nil
@@ -325,7 +328,7 @@ func (r *ReconcileSelinux) reconcileDeletePolicy(
 ) (reconcile.Result, error) {
 	selinuxdReady, err := isSelinuxdReady()
 	if err != nil {
-		return reconcile.Result{}, errors.Wrap(err, "contacting selinuxd")
+		return reconcile.Result{}, fmt.Errorf("contacting selinuxd: %w", err)
 	}
 	if !selinuxdReady {
 		l.Info("selinuxd not yet up, requeue")
@@ -346,7 +349,7 @@ func (r *ReconcileSelinux) reconcileDeletePolicy(
 
 	if err != nil {
 		r.metrics.IncSelinuxProfileError(reasonCannotGetPolicyStatus)
-		return reconcile.Result{}, errors.Wrap(err, "looking up policy status")
+		return reconcile.Result{}, fmt.Errorf("looking up policy status: %w", err)
 	}
 
 	switch polStatus.Status {
@@ -356,7 +359,7 @@ func (r *ReconcileSelinux) reconcileDeletePolicy(
 	case failedStatus:
 		if err := nodeStatus.SetNodeStatus(context.TODO(), statusv1alpha1.ProfileStateError); err != nil {
 			r.metrics.IncSelinuxProfileError(reasonCannotRemovePolicy)
-			return reconcile.Result{}, errors.Wrap(err, "Updating SELinux policy with installation")
+			return reconcile.Result{}, fmt.Errorf("updating SELinux policy with installation: %w", err)
 		}
 
 		evstr := fmt.Sprintf("Failed to save profile to disk on %s: %s", os.Getenv(config.NodeNameEnvKey), polStatus.Msg)
@@ -390,14 +393,14 @@ func (r *ReconcileSelinux) reconcileDeletePolicyFile(sp selxv1alpha2.SelinuxProf
 	}
 
 	// Retry on a generic error
-	return reconcile.Result{Requeue: true}, errors.Wrap(err, "error removing policy file")
+	return reconcile.Result{Requeue: true}, fmt.Errorf("error removing policy file: %w", err)
 }
 
 func getPolicyStatus(sp selxv1alpha2.SelinuxProfileObject) (*sePolStatus, error) {
 	polURL := selinuxdPoliciesBaseURL + sp.GetPolicyName()
 	response, err := selinuxdGetRequest(polURL)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to send a request to selinuxd")
+		return nil, fmt.Errorf("failed to send a request to selinuxd: %w", err)
 	}
 	defer response.Body.Close()
 
@@ -410,7 +413,7 @@ func getPolicyStatus(sp selxv1alpha2.SelinuxProfileObject) (*sePolStatus, error)
 	var status sePolStatus
 	err = json.NewDecoder(response.Body).Decode(&status)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to decode response from selinuxd")
+		return nil, fmt.Errorf("failed to decode response from selinuxd: %w", err)
 	}
 
 	switch status.Status {
@@ -424,14 +427,14 @@ func getPolicyStatus(sp selxv1alpha2.SelinuxProfileObject) (*sePolStatus, error)
 func isSelinuxdReady() (bool, error) {
 	response, err := selinuxdGetRequest(selinuxdReadyURL)
 	if err != nil {
-		return false, errors.Wrap(err, "failed to send a request to selinuxd")
+		return false, fmt.Errorf("failed to send a request to selinuxd: %w", err)
 	}
 	defer response.Body.Close()
 
 	var status map[string]bool
 	err = json.NewDecoder(response.Body).Decode(&status)
 	if err != nil {
-		return false, errors.Wrap(err, "failed to decode response from selinuxd")
+		return false, fmt.Errorf("failed to decode response from selinuxd: %w", err)
 	}
 
 	return status[selinuxdReadyKey], nil
@@ -451,7 +454,7 @@ func selinuxdGetRequest(url string) (*http.Response, error) {
 
 	req, err := http.NewRequestWithContext(ctx, "GET", url, http.NoBody)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to create a request to selinuxd")
+		return nil, fmt.Errorf("failed to create a request to selinuxd: %w", err)
 	}
 
 	return httpc.Do(req)
@@ -470,13 +473,13 @@ func writeFileIfDiffers(filePath string, contents []byte) error {
 		file.Close()
 		return os.WriteFile(filePath, contents, filePermissions)
 	} else if err != nil {
-		return errors.Wrap(err, "could not open for reading"+filePath)
+		return fmt.Errorf("could not open for reading: %w"+filePath, err)
 	}
 	defer file.Close()
 
 	existing, err := io.ReadAll(file)
 	if err != nil {
-		return errors.Wrap(err, "reading file "+filePath)
+		return fmt.Errorf("reading file : %w"+filePath, err)
 	}
 
 	if bytes.Equal(existing, contents) {
diff --git a/internal/pkg/daemon/selinuxprofile/rawselinuxprofile.go b/internal/pkg/daemon/selinuxprofile/rawselinuxprofile.go
index 4861f96a0..ce09f8a66 100644
--- a/internal/pkg/daemon/selinuxprofile/rawselinuxprofile.go
+++ b/internal/pkg/daemon/selinuxprofile/rawselinuxprofile.go
@@ -19,10 +19,10 @@ package selinuxprofile
 import (
 	"bytes"
 	"context"
+	"fmt"
 	"html/template"
 	"strings"
 
-	"github.com/pkg/errors"
 	"k8s.io/apimachinery/pkg/types"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -98,7 +98,7 @@ func (sph *rawSelinuxProfileHandler) wrapPolicy() (string, error) {
 	}
 	var result bytes.Buffer
 	if err := sph.policyTemplate.Execute(&result, data); err != nil {
-		return "", errors.Wrapf(err, "couldn't render policy")
+		return "", fmt.Errorf("couldn't render policy: %w", err)
 	}
 	return result.String(), nil
 }
diff --git a/internal/pkg/daemon/selinuxprofile/selinuxprofile.go b/internal/pkg/daemon/selinuxprofile/selinuxprofile.go
index d2c131ed1..81a137a25 100644
--- a/internal/pkg/daemon/selinuxprofile/selinuxprofile.go
+++ b/internal/pkg/daemon/selinuxprofile/selinuxprofile.go
@@ -18,9 +18,10 @@ package selinuxprofile
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"regexp"
 
-	"github.com/pkg/errors"
 	kerrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/types"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -136,14 +137,14 @@ func (sph *selinuxProfileHandler) validateAndTrackInherit(
 	case "SelinuxPolicy":
 		return sph.handleInheritSPOPolicy(ancestorRef, namespace)
 	}
-	return errors.Wrapf(ErrUnknownKindForEntry, "%s/%s", ancestorRef.Kind, ancestorRef.Name)
+	return fmt.Errorf("%s/%s: %w", ancestorRef.Kind, ancestorRef.Name, ErrUnknownKindForEntry)
 }
 
 func (sph *selinuxProfileHandler) validateLabelKey(
 	key selxv1alpha2.LabelKey,
 ) error {
 	if !sph.labelRegex.MatchString(string(key)) {
-		return errors.Wrapf(ErrInvalidLabelKey, "'%s' didn't match expected characters", key)
+		return fmt.Errorf("'%s' didn't match expected characters: %w", key, ErrInvalidLabelKey)
 	}
 	return nil
 }
@@ -152,7 +153,7 @@ func (sph *selinuxProfileHandler) validateObjClass(
 	key selxv1alpha2.ObjectClassKey,
 ) error {
 	if !sph.objClassPermRegex.MatchString(string(key)) {
-		return errors.Wrapf(ErrInvalidObjClass, "'%s' didn't match expected characters", key)
+		return fmt.Errorf("'%s' didn't match expected characters: %w", key, ErrInvalidObjClass)
 	}
 	return nil
 }
@@ -161,7 +162,7 @@ func (sph *selinuxProfileHandler) validatePermission(
 	perm string,
 ) error {
 	if !sph.objClassPermRegex.MatchString(perm) {
-		return errors.Wrapf(ErrInvalidPermission, "'%s' didn't match expected characters", perm)
+		return fmt.Errorf("'%s' didn't match expected characters: %w", perm, ErrInvalidPermission)
 	}
 	return nil
 }
@@ -174,8 +175,8 @@ func (sph *selinuxProfileHandler) handleInheritSPOPolicy(
 	key := types.NamespacedName{Name: ancestorRef.Name, Namespace: namespace}
 	err := sph.cli.Get(context.Background(), key, ancestor)
 	if err != nil && kerrors.IsNotFound(err) {
-		return errors.Wrapf(err, "couldn't find inherit reference %s/%s",
-			ancestorRef.Kind, ancestorRef.Name)
+		return fmt.Errorf("couldn't find inherit reference %s/%s: %w",
+			ancestorRef.Kind, ancestorRef.Name, err)
 	}
 
 	// TODO(jaosorior): Handle dependencies... we could force a waiting period
@@ -189,7 +190,7 @@ func (sph *selinuxProfileHandler) handleInheritSystemPolicy(
 ) error {
 	spod, err := common.GetSPOD(context.Background(), sph.cli)
 	if err != nil {
-		return errors.Wrapf(err, "couldn't get spod to verify system inheritance")
+		return fmt.Errorf("couldn't get spod to verify system inheritance: %w", err)
 	}
 
 	for idx := range spod.Spec.SelinuxOpts.AllowedSystemProfiles {
@@ -199,8 +200,10 @@ func (sph *selinuxProfileHandler) handleInheritSystemPolicy(
 			return nil
 		}
 	}
-	return errors.Wrapf(ErrSystemInheritNotAllowed, "system profile %s not in SecurityProfilesOperatorDaemon's allow list",
-		ancestorRef.Name)
+	return fmt.Errorf(
+		"system profile %s not in SecurityProfilesOperatorDaemon's allow list: %w",
+		ancestorRef.Name, ErrSystemInheritNotAllowed,
+	)
 }
 
 func (sph *selinuxProfileHandler) GetCILPolicy() (string, error) {
diff --git a/internal/pkg/manager/nodestatus/nodestatus.go b/internal/pkg/manager/nodestatus/nodestatus.go
index 5303fb63b..12b43b961 100644
--- a/internal/pkg/manager/nodestatus/nodestatus.go
+++ b/internal/pkg/manager/nodestatus/nodestatus.go
@@ -18,13 +18,14 @@ package nodestatus
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"net/http"
 	"time"
 
 	rcommonv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
 	"github.com/crossplane/crossplane-runtime/pkg/event"
 	"github.com/go-logr/logr"
-	"github.com/pkg/errors"
 	appsv1 "k8s.io/api/apps/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
@@ -49,7 +50,7 @@ const (
 )
 
 var (
-	ErrNoOwnerProfile  = errors.New("No owner profile defined for this status")
+	ErrNoOwnerProfile  = errors.New("no owner profile defined for this status")
 	ErrUnkownOwnerKind = errors.New("the node status owner is of an unknown kind")
 )
 
@@ -147,7 +148,7 @@ func (r *StatusReconciler) Reconcile(_ context.Context, req reconcile.Request) (
 	// get all the other statuses
 	profLabel := instance.Labels[statusv1alpha1.StatusToProfLabel]
 	if profLabel == "" {
-		return reconcile.Result{}, errors.New("Unlabeled node status")
+		return reconcile.Result{}, errors.New("unlabeled node status")
 	}
 
 	if util.KindBasedDNSLengthName(prof) != instance.Labels[statusv1alpha1.StatusToProfLabel] {
@@ -156,13 +157,13 @@ func (r *StatusReconciler) Reconcile(_ context.Context, req reconcile.Request) (
 
 	nodeStatusList, err := listStatusesForProfile(ctx, r.client, profLabel)
 	if err != nil {
-		return reconcile.Result{}, errors.Wrap(err, "cannot list the node statuses")
+		return reconcile.Result{}, fmt.Errorf("cannot list the node statuses: %w", err)
 	}
 
 	// get the DS
 	spodDS, err := r.getDS(ctx, config.GetOperatorNamespace(), lprof)
 	if err != nil {
-		return reconcile.Result{}, errors.Wrap(err, "cannot get the DS")
+		return reconcile.Result{}, fmt.Errorf("cannot get the DS: %w", err)
 	}
 
 	if !daemonSetIsReady(spodDS) || daemonSetIsUpdating(spodDS) {
@@ -194,7 +195,7 @@ func (r *StatusReconciler) getDS(ctx context.Context, namespace string, l logr.L
 	dsSelect := labels.NewSelector()
 	spodDSFilter, err := labels.NewRequirement("spod", selection.Exists, []string{})
 	if err != nil {
-		return nil, errors.Wrap(err, "cannot create DS list label")
+		return nil, fmt.Errorf("cannot create DS list label: %w", err)
 	}
 	dsSelect.Add(*spodDSFilter)
 	dsListOpts := client.ListOptions{
@@ -204,13 +205,13 @@ func (r *StatusReconciler) getDS(ctx context.Context, namespace string, l logr.L
 
 	spodDSList := appsv1.DaemonSetList{}
 	if err := r.client.List(ctx, &spodDSList, &dsListOpts); err != nil {
-		return nil, errors.Wrap(err, "cannot list DS")
+		return nil, fmt.Errorf("cannot list DS: %w", err)
 	}
 
 	if len(spodDSList.Items) != 1 {
-		retErr := errors.New("Did not find exactly one DS")
+		retErr := errors.New("did not find exactly one DS")
 		l.Error(retErr, "Expected to find 1 DS", "len(dsList.Items)", len(spodDSList.Items))
-		return nil, errors.Wrap(retErr, "listing DS")
+		return nil, fmt.Errorf("listing DS: %w", retErr)
 	}
 
 	return &spodDSList.Items[0], nil
@@ -222,7 +223,7 @@ func (r *StatusReconciler) getProfileFromStatus(
 ) (pbv1alpha1.StatusBaseUser, error) {
 	ctrl := metav1.GetControllerOf(s)
 	if ctrl == nil {
-		return nil, errors.Wrapf(ErrNoOwnerProfile, "getting owner profile")
+		return nil, fmt.Errorf("getting owner profile: %w", ErrNoOwnerProfile)
 	}
 
 	key := types.NamespacedName{
@@ -236,10 +237,10 @@ func (r *StatusReconciler) getProfileFromStatus(
 	case "SelinuxProfile":
 		prof = &selxv1alpha2.SelinuxProfile{}
 	default:
-		return nil, errors.Wrapf(ErrUnkownOwnerKind, "getting owner profile")
+		return nil, fmt.Errorf("getting owner profile: %w", ErrUnkownOwnerKind)
 	}
 	if err := r.client.Get(ctx, key, prof); err != nil {
-		return nil, errors.Wrapf(err, "getting owner profile: %s/%s", s.GetNamespace(), ctrl.Name)
+		return nil, fmt.Errorf("getting owner profile: %s/%s: %w", s.GetNamespace(), ctrl.Name, err)
 	}
 	return prof, nil
 }
@@ -276,7 +277,7 @@ func (r *StatusReconciler) reconcileStatus(
 
 	l.Info("Updating status")
 	if updateErr := r.client.Status().Update(ctx, pCopy); updateErr != nil {
-		return reconcile.Result{}, errors.Wrapf(updateErr, "Updating policy status")
+		return reconcile.Result{}, fmt.Errorf("updating policy status: %w", updateErr)
 	}
 
 	return reconcile.Result{}, nil
@@ -300,7 +301,7 @@ func listStatusesForProfile(
 	}
 
 	if err := c.List(ctx, &statusList, allStatusesForProf); err != nil {
-		return nil, errors.Wrap(err, "listing statuses")
+		return nil, fmt.Errorf("listing statuses: %w", err)
 	}
 
 	return &statusList, nil
diff --git a/internal/pkg/manager/spod/bindata/ca.go b/internal/pkg/manager/spod/bindata/ca.go
index 8e2f85ae1..2748638fb 100644
--- a/internal/pkg/manager/spod/bindata/ca.go
+++ b/internal/pkg/manager/spod/bindata/ca.go
@@ -18,14 +18,14 @@ package bindata
 
 import (
 	"context"
+	"fmt"
 	"strings"
 
 	"github.com/go-logr/logr"
 	certmanagerv1 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1"
 	certmanagermetav1 "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
 	configv1 "github.com/openshift/api/config/v1"
-	"github.com/pkg/errors"
-	kerrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
@@ -63,7 +63,7 @@ func GetCAInjectType(
 		return CAInjectTypeCertManager, nil
 	}
 
-	return res, errors.Wrap(err, "unable to determine certificate provider")
+	return res, fmt.Errorf("unable to determine certificate provider: %w", err)
 }
 
 const (
@@ -96,10 +96,10 @@ func GetCertManagerResources(namespace string) *CertManagerResources {
 func (c *CertManagerResources) Create(ctx context.Context, cl client.Client) error {
 	for k, o := range c.objectMap() {
 		if err := cl.Create(ctx, o); err != nil {
-			if kerrors.IsAlreadyExists(err) {
+			if errors.IsAlreadyExists(err) {
 				continue
 			}
-			return errors.Wrapf(err, "creating %s", k)
+			return fmt.Errorf("creating %s: %w", k, err)
 		}
 	}
 	return nil
@@ -108,7 +108,7 @@ func (c *CertManagerResources) Create(ctx context.Context, cl client.Client) err
 func (c *CertManagerResources) Update(ctx context.Context, cl client.Client) error {
 	for k, o := range c.objectMap() {
 		if err := cl.Patch(ctx, o, client.Merge); err != nil {
-			return errors.Wrapf(err, "updating %s", k)
+			return fmt.Errorf("updating %s: %w", k, err)
 		}
 	}
 	return nil
diff --git a/internal/pkg/manager/spod/bindata/webhook.go b/internal/pkg/manager/spod/bindata/webhook.go
index d7136c735..57979c047 100644
--- a/internal/pkg/manager/spod/bindata/webhook.go
+++ b/internal/pkg/manager/spod/bindata/webhook.go
@@ -18,13 +18,13 @@ package bindata
 
 import (
 	"context"
+	"fmt"
 
 	"github.com/go-logr/logr"
-	"github.com/pkg/errors"
 	admissionregv1 "k8s.io/api/admissionregistration/v1"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
-	kerrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
@@ -128,16 +128,16 @@ func GetWebhook(
 func (w *Webhook) Create(ctx context.Context, c client.Client) error {
 	for k, o := range w.objectMap() {
 		if err := c.Create(ctx, o); err != nil {
-			if kerrors.IsAlreadyExists(err) {
+			if errors.IsAlreadyExists(err) {
 				if k == "config" {
 					// The config already exists because it's a global resource we have to remove later on
 					if err := c.Patch(ctx, o, client.Merge); err != nil {
-						return errors.Wrapf(err, "updating %s", k)
+						return fmt.Errorf("updating %s: %w", k, err)
 					}
 				}
 				continue
 			} else {
-				return errors.Wrapf(err, "creating %s", k)
+				return fmt.Errorf("creating %s: %w", k, err)
 			}
 		}
 	}
@@ -148,7 +148,7 @@ func (w *Webhook) Create(ctx context.Context, c client.Client) error {
 func (w *Webhook) Update(ctx context.Context, c client.Client) error {
 	for k, o := range w.objectMap() {
 		if err := c.Patch(ctx, o, client.Merge); err != nil {
-			return errors.Wrapf(err, "updating %s", k)
+			return fmt.Errorf("updating %s: %w", k, err)
 		}
 	}
 	return nil
diff --git a/internal/pkg/manager/spod/setup.go b/internal/pkg/manager/spod/setup.go
index 7fb5abd93..48e8df01a 100644
--- a/internal/pkg/manager/spod/setup.go
+++ b/internal/pkg/manager/spod/setup.go
@@ -18,11 +18,12 @@ package spod
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"os"
 
 	"github.com/crossplane/crossplane-runtime/pkg/event"
 	"github.com/crossplane/crossplane-runtime/pkg/resource"
-	"github.com/pkg/errors"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	k8serrors "k8s.io/apimachinery/pkg/api/errors"
@@ -59,13 +60,13 @@ func (r *ReconcileSPOd) Setup(
 
 	dt, err := getTunables()
 	if err != nil {
-		return errors.Wrap(err, "get tunables")
+		return fmt.Errorf("get tunables: %w", err)
 	}
 
 	r.baseSPOd = getEffectiveSPOd(dt)
 
 	if err := r.createConfigIfNotExist(ctx); err != nil {
-		return errors.Wrap(err, "create config if not existing")
+		return fmt.Errorf("create config if not existing: %w", err)
 	}
 
 	r.scheme = mgr.GetScheme()
@@ -84,8 +85,8 @@ func (r *ReconcileSPOd) createConfigIfNotExist(ctx context.Context) error {
 	obj := bindata.DefaultSPOD.DeepCopy()
 	obj.Namespace = config.GetOperatorNamespace()
 
-	if err := r.client.Create(ctx, obj); !k8serrors.IsAlreadyExists(err) {
-		return errors.Wrap(err, "create SecurityProfilesOperatorDaemon object")
+	if err := r.client.Create(ctx, obj); err != nil && !k8serrors.IsAlreadyExists(err) {
+		return fmt.Errorf("create SecurityProfilesOperatorDaemon object: %w", err)
 	}
 
 	return nil
diff --git a/internal/pkg/manager/spod/spod_controller.go b/internal/pkg/manager/spod/spod_controller.go
index 6707e2f3d..96a8710e4 100644
--- a/internal/pkg/manager/spod/spod_controller.go
+++ b/internal/pkg/manager/spod/spod_controller.go
@@ -23,11 +23,10 @@ import (
 
 	"github.com/crossplane/crossplane-runtime/pkg/event"
 	"github.com/go-logr/logr"
-	"github.com/pkg/errors"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	apiequality "k8s.io/apimachinery/pkg/api/equality"
-	kerrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/meta"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
@@ -121,10 +120,10 @@ func (r *ReconcileSPOd) Reconcile(_ context.Context, req reconcile.Request) (rec
 	// Fetch the ConfigMap instance
 	spod := &spodv1alpha1.SecurityProfilesOperatorDaemon{}
 	if err := r.client.Get(ctx, req.NamespacedName, spod); err != nil {
-		if kerrors.IsNotFound(err) {
+		if errors.IsNotFound(err) {
 			return reconcile.Result{}, nil
 		}
-		return reconcile.Result{}, errors.Wrap(err, "getting spod configuration")
+		return reconcile.Result{}, fmt.Errorf("getting spod configuration: %w", err)
 	}
 
 	if spod.Status.State == "" {
@@ -137,10 +136,10 @@ func (r *ReconcileSPOd) Reconcile(_ context.Context, req reconcile.Request) (rec
 	}
 	foundDeployment := &appsv1.Deployment{}
 	if err := r.client.Get(ctx, deploymentKey, foundDeployment); err != nil {
-		if kerrors.IsNotFound(err) {
+		if errors.IsNotFound(err) {
 			return reconcile.Result{}, nil
 		}
-		return reconcile.Result{}, errors.Wrap(err, "get operator deployment")
+		return reconcile.Result{}, fmt.Errorf("get operator deployment: %w", err)
 	}
 	// We use the same target image for the deamonset as which we have right
 	// now running.
@@ -154,7 +153,7 @@ func (r *ReconcileSPOd) Reconcile(_ context.Context, req reconcile.Request) (rec
 
 	caInjectType, err := bindata.GetCAInjectType(ctx, r.log, r.namespace, r.client)
 	if err != nil {
-		return reconcile.Result{}, errors.Wrap(err, "get ca inject type")
+		return reconcile.Result{}, fmt.Errorf("get ca inject type: %w", err)
 	}
 	configuredSPOd := r.getConfiguredSPOd(spod, image, pullPolicy, caInjectType)
 
@@ -168,7 +167,7 @@ func (r *ReconcileSPOd) Reconcile(_ context.Context, req reconcile.Request) (rec
 
 	foundSPOd := &appsv1.DaemonSet{}
 	if err := r.client.Get(ctx, spodKey, foundSPOd); err != nil {
-		if kerrors.IsNotFound(err) {
+		if errors.IsNotFound(err) {
 			createErr := r.handleCreate(
 				ctx, spod, configuredSPOd, webhook, metricsService, certManagerResources,
 			)
@@ -178,7 +177,7 @@ func (r *ReconcileSPOd) Reconcile(_ context.Context, req reconcile.Request) (rec
 			}
 			return r.handleCreatingStatus(ctx, spod, logger)
 		}
-		return reconcile.Result{}, errors.Wrap(err, "getting spod DaemonSet")
+		return reconcile.Result{}, fmt.Errorf("getting spod DaemonSet: %w", err)
 	}
 
 	if spodNeedsUpdate(configuredSPOd, foundSPOd) {
@@ -214,7 +213,7 @@ func (r *ReconcileSPOd) handleInitialStatus(
 	sCopy.Status.StatePending()
 	updateErr := r.client.Status().Update(ctx, sCopy)
 	if updateErr != nil {
-		return reconcile.Result{}, errors.Wrap(updateErr, "updating spod initial status")
+		return reconcile.Result{}, fmt.Errorf("updating spod initial status: %w", updateErr)
 	}
 	return reconcile.Result{}, nil
 }
@@ -229,7 +228,7 @@ func (r *ReconcileSPOd) handleCreatingStatus(
 	sCopy.Status.StateCreating()
 	updateErr := r.client.Status().Update(ctx, sCopy)
 	if updateErr != nil {
-		return reconcile.Result{}, errors.Wrap(updateErr, "updating spod status to creating")
+		return reconcile.Result{}, fmt.Errorf("updating spod status to creating: %w", updateErr)
 	}
 	return reconcile.Result{}, nil
 }
@@ -244,7 +243,7 @@ func (r *ReconcileSPOd) handleUpdatingStatus(
 	sCopy.Status.StateUpdating()
 	updateErr := r.client.Status().Update(ctx, sCopy)
 	if updateErr != nil {
-		return reconcile.Result{}, errors.Wrap(updateErr, "updating spod status to 'updating'")
+		return reconcile.Result{}, fmt.Errorf("updating spod status to 'updating': %w", updateErr)
 	}
 	return reconcile.Result{}, nil
 }
@@ -259,7 +258,7 @@ func (r *ReconcileSPOd) handleRunningStatus(
 	sCopy.Status.StateRunning()
 	updateErr := r.client.Status().Update(ctx, sCopy)
 	if updateErr != nil {
-		return reconcile.Result{}, errors.Wrap(updateErr, "updating spod status to running")
+		return reconcile.Result{}, fmt.Errorf("updating spod status to running: %w", updateErr)
 	}
 	return reconcile.Result{}, nil
 }
@@ -275,26 +274,26 @@ func (r *ReconcileSPOd) handleCreate(
 	if certManagerResources != nil {
 		r.log.Info("Deploying cert manager resources")
 		if err := certManagerResources.Create(ctx, r.client); err != nil {
-			return errors.Wrap(err, "creating cert manager resources")
+			return fmt.Errorf("creating cert manager resources: %w", err)
 		}
 	}
 
 	r.log.Info("Deploying operator webhook")
 	if err := webhook.Create(ctx, r.client); err != nil {
-		return errors.Wrap(err, "creating webhook")
+		return fmt.Errorf("creating webhook: %w", err)
 	}
 
 	r.log.Info("Creating operator resources")
 	if err := controllerutil.SetControllerReference(cfg, newSPOd, r.scheme); err != nil {
-		return errors.Wrap(err, "setting spod controller reference")
+		return fmt.Errorf("setting spod controller reference: %w", err)
 	}
 
 	r.log.Info("Deploying operator daemonset")
 	if err := r.client.Create(ctx, newSPOd); err != nil {
-		if kerrors.IsAlreadyExists(err) {
+		if errors.IsAlreadyExists(err) {
 			return nil
 		}
-		return errors.Wrap(err, "creating operator DaemonSet")
+		return fmt.Errorf("creating operator DaemonSet: %w", err)
 	}
 
 	r.log.Info("Deploying operator default profiles")
@@ -305,21 +304,19 @@ func (r *ReconcileSPOd) handleCreate(
 		}
 
 		if err := r.client.Create(ctx, profile); err != nil {
-			if kerrors.IsAlreadyExists(err) {
+			if errors.IsAlreadyExists(err) {
 				continue
 			}
-			return errors.Wrapf(
-				err, "creating operator default profile %s", profile.Name,
-			)
+			return fmt.Errorf("creating operator default profile %s: %w", profile.Name, err)
 		}
 	}
 
 	r.log.Info("Deploying metrics service")
 	if err := r.client.Create(ctx, metricsService); err != nil {
-		if kerrors.IsAlreadyExists(err) {
+		if errors.IsAlreadyExists(err) {
 			return nil
 		}
-		return errors.Wrap(err, "creating metrics service")
+		return fmt.Errorf("creating metrics service: %w", err)
 	}
 
 	r.log.Info("Deploying operator service monitor")
@@ -329,10 +326,10 @@ func (r *ReconcileSPOd) handleCreate(
 		// nolint:gocritic
 		if runtime.IsNotRegisteredError(err) || meta.IsNoMatchError(err) {
 			r.log.Info("Service monitor resource does not seem to exist, ignoring")
-		} else if kerrors.IsAlreadyExists(err) {
+		} else if errors.IsAlreadyExists(err) {
 			r.log.Info("Service monitor already exist, skipping")
 		} else {
-			return errors.Wrap(err, "creating service monitor")
+			return fmt.Errorf("creating service monitor: %w", err)
 		}
 	}
 
@@ -349,18 +346,18 @@ func (r *ReconcileSPOd) handleUpdate(
 	if certManagerResources != nil {
 		r.log.Info("Updating cert manager resources")
 		if err := certManagerResources.Update(ctx, r.client); err != nil {
-			return errors.Wrap(err, "updating cert manager resources")
+			return fmt.Errorf("updating cert manager resources: %w", err)
 		}
 	}
 
 	r.log.Info("Updating operator webhook")
 	if err := webhook.Update(ctx, r.client); err != nil {
-		return errors.Wrap(err, "updating webhook")
+		return fmt.Errorf("updating webhook: %w", err)
 	}
 
 	r.log.Info("Updating operator daemonset")
 	if err := r.client.Patch(ctx, spodInstance, client.Merge); err != nil {
-		return errors.Wrap(err, "updating operator DaemonSet")
+		return fmt.Errorf("updating operator DaemonSet: %w", err)
 	}
 
 	r.log.Info("Updating operator default profiles")
@@ -380,34 +377,28 @@ func (r *ReconcileSPOd) handleUpdate(
 			updatedProfile := foundProfile.DeepCopy()
 			updatedProfile.Spec = *profile.Spec.DeepCopy()
 			if updateErr := r.client.Update(ctx, updatedProfile); updateErr != nil {
-				return errors.Wrapf(
-					updateErr, "updating operator default profile %s", profile.Name,
-				)
+				return fmt.Errorf("updating operator default profile %s: %w", profile.Name, updateErr)
 			}
 			continue
 		}
 
-		if kerrors.IsNotFound(err) {
+		if errors.IsNotFound(err) {
 			// Handle new default profile
 			if createErr := r.client.Create(ctx, profile); err != nil {
-				if kerrors.IsAlreadyExists(createErr) {
+				if errors.IsAlreadyExists(createErr) {
 					return nil
 				}
-				return errors.Wrapf(
-					createErr, "creating operator default profile %s", profile.Name,
-				)
+				return fmt.Errorf("creating operator default profile %s: %w", profile.Name, createErr)
 			}
 			continue
 		}
 
-		return errors.Wrapf(
-			err, "getting operator default profile %s", profile.Name,
-		)
+		return fmt.Errorf("getting operator default profile %s: %w", profile.Name, err)
 	}
 
 	r.log.Info("Updating metrics service")
 	if err := r.client.Patch(ctx, metricsService, client.Merge); err != nil {
-		return errors.Wrap(err, "updating metrics service")
+		return fmt.Errorf("updating metrics service: %w", err)
 	}
 
 	r.log.Info("Updating operator service monitor")
@@ -417,7 +408,7 @@ func (r *ReconcileSPOd) handleUpdate(
 		if runtime.IsNotRegisteredError(err) || meta.IsNoMatchError(err) {
 			r.log.Info("Service monitor resource does not seem to exist, ignoring")
 		} else {
-			return errors.Wrap(err, "updating service monitor")
+			return fmt.Errorf("updating service monitor: %w", err)
 		}
 	}
 
diff --git a/internal/pkg/manager/workloadannotator/setup.go b/internal/pkg/manager/workloadannotator/setup.go
index 6155f3515..25a63500d 100644
--- a/internal/pkg/manager/workloadannotator/setup.go
+++ b/internal/pkg/manager/workloadannotator/setup.go
@@ -18,10 +18,10 @@ package workloadannotator
 
 import (
 	"context"
+	"fmt"
 
 	"github.com/crossplane/crossplane-runtime/pkg/event"
 	"github.com/crossplane/crossplane-runtime/pkg/resource"
-	"github.com/pkg/errors"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -50,7 +50,7 @@ func (r *PodReconciler) Setup(
 		}
 		return getSeccompProfilesFromPod(pod)
 	}); err != nil {
-		return errors.Wrap(err, "creating pod index")
+		return fmt.Errorf("creating pod index: %w", err)
 	}
 
 	// Index SeccompProfiles with active pods
@@ -62,7 +62,7 @@ func (r *PodReconciler) Setup(
 			}
 			return sp.Status.ActiveWorkloads
 		}); err != nil {
-		return errors.Wrap(err, "creating seccomp profile index")
+		return fmt.Errorf("creating seccomp profile index: %w", err)
 	}
 
 	// Register a special reconciler for pod events
diff --git a/internal/pkg/manager/workloadannotator/workloadannotator.go b/internal/pkg/manager/workloadannotator/workloadannotator.go
index ec00dc19e..02747d427 100644
--- a/internal/pkg/manager/workloadannotator/workloadannotator.go
+++ b/internal/pkg/manager/workloadannotator/workloadannotator.go
@@ -25,9 +25,8 @@ import (
 
 	"github.com/crossplane/crossplane-runtime/pkg/event"
 	"github.com/go-logr/logr"
-	"github.com/pkg/errors"
 	corev1 "k8s.io/api/core/v1"
-	kerrors "k8s.io/apimachinery/pkg/api/errors"
+	errors "k8s.io/apimachinery/pkg/api/errors"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	"sigs.k8s.io/controller-runtime/pkg/scheme"
@@ -86,16 +85,16 @@ func (r *PodReconciler) Reconcile(_ context.Context, req reconcile.Request) (rec
 	var err error
 	if err = r.client.Get(ctx, req.NamespacedName, pod); util.IgnoreNotFound(err) != nil {
 		logger.Error(err, "could not get pod")
-		return reconcile.Result{}, errors.Wrap(err, "looking up pod in pod reconciler")
+		return reconcile.Result{}, fmt.Errorf("looking up pod in pod reconciler: %w", err)
 	}
-	if kerrors.IsNotFound(err) { // this is a pod deletion, so update all seccomp profiles that were using it
+	if errors.IsNotFound(err) { // this is a pod deletion, so update all seccomp profiles that were using it
 		seccompProfiles := &seccompprofileapi.SeccompProfileList{}
 		if err = r.client.List(ctx, seccompProfiles, client.MatchingFields{linkedPodsKey: podID}); err != nil {
-			return reconcile.Result{}, errors.Wrap(err, "listing SeccompProfiles for deleted pod")
+			return reconcile.Result{}, fmt.Errorf("listing SeccompProfiles for deleted pod: %w", err)
 		}
 		for i := range seccompProfiles.Items {
 			if err = r.updatePodReferences(ctx, &seccompProfiles.Items[i]); err != nil {
-				return reconcile.Result{}, errors.Wrap(err, "updating SeccompProfile for deleted pod")
+				return reconcile.Result{}, fmt.Errorf("updating SeccompProfile for deleted pod: %w", err)
 			}
 		}
 		return reconcile.Result{}, nil
@@ -108,11 +107,11 @@ func (r *PodReconciler) Reconcile(_ context.Context, req reconcile.Request) (rec
 		seccompProfile := &seccompprofileapi.SeccompProfile{}
 		if err := r.client.Get(ctx, util.NamespacedName(profileName, profileNamespace), seccompProfile); err != nil {
 			logger.Error(err, "could not get seccomp profile for pod")
-			return reconcile.Result{}, errors.Wrap(err, "looking up SeccompProfile for new or updated pod")
+			return reconcile.Result{}, fmt.Errorf("looking up SeccompProfile for new or updated pod: %w", err)
 		}
 		if err := r.updatePodReferences(ctx, seccompProfile); err != nil {
 			logger.Error(err, "could not update seccomp profile for pod")
-			return reconcile.Result{}, errors.Wrap(err, "updating SeccompProfile pod references for new or updated pod")
+			return reconcile.Result{}, fmt.Errorf("updating SeccompProfile pod references for new or updated pod: %w", err)
 		}
 	}
 	return reconcile.Result{}, nil
@@ -125,7 +124,7 @@ func (r *PodReconciler) updatePodReferences(ctx context.Context, sp *seccompprof
 	profileReference := fmt.Sprintf("operator/%s/%s.json", sp.GetNamespace(), sp.GetName())
 	err := r.client.List(ctx, linkedPods, client.MatchingFields{spOwnerKey: profileReference})
 	if util.IgnoreNotFound(err) != nil {
-		return errors.Wrap(err, "listing pods to update seccompProfile")
+		return fmt.Errorf("listing pods to update seccompProfile: %w", err)
 	}
 	podList := make([]string, len(linkedPods.Items))
 	for i := range linkedPods.Items {
@@ -138,25 +137,26 @@ func (r *PodReconciler) updatePodReferences(ctx context.Context, sp *seccompprof
 		updateErr := r.client.Status().Update(ctx, sp)
 		if updateErr != nil {
 			if err := r.client.Get(ctx, util.NamespacedName(sp.GetName(), sp.GetNamespace()), sp); err != nil {
-				return errors.Wrap(err, "retrieving profile")
+				return fmt.Errorf("retrieving profile: %w", err)
 			}
+			return fmt.Errorf("updating profile: %w", updateErr)
 		}
 
-		return errors.Wrap(updateErr, "updating profile")
+		return nil
 	}, util.IsNotFoundOrConflict); err != nil {
-		return errors.Wrap(err, "updating SeccompProfile status")
+		return fmt.Errorf("updating SeccompProfile status: %w", err)
 	}
 	if len(linkedPods.Items) > 0 {
 		if err := util.Retry(func() error {
 			return util.AddFinalizer(ctx, r.client, sp, util.HasActivePodsFinalizerString)
 		}, util.IsNotFoundOrConflict); err != nil {
-			return errors.Wrap(err, "adding finalizer")
+			return fmt.Errorf("adding finalizer: %w", err)
 		}
 	} else {
 		if err := util.Retry(func() error {
 			return util.RemoveFinalizer(ctx, r.client, sp, util.HasActivePodsFinalizerString)
 		}, util.IsNotFoundOrConflict); err != nil {
-			return errors.Wrap(err, "removing finalizer")
+			return fmt.Errorf("removing finalizer: %w", err)
 		}
 	}
 	return nil
diff --git a/internal/pkg/nodestatus/nodestatus.go b/internal/pkg/nodestatus/nodestatus.go
index 739a1a72e..66c4827ca 100644
--- a/internal/pkg/nodestatus/nodestatus.go
+++ b/internal/pkg/nodestatus/nodestatus.go
@@ -18,9 +18,10 @@ package nodestatus
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"os"
 
-	"github.com/pkg/errors"
 	kerrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
@@ -62,16 +63,16 @@ func (nsf *StatusClient) perNodeStatusNamespacedName() types.NamespacedName {
 
 func (nsf *StatusClient) Create(ctx context.Context) error {
 	if err := nsf.createFinalizer(ctx); err != nil {
-		return errors.Wrapf(err, "cannot create finalizer for %s", nsf.pol.GetName())
+		return fmt.Errorf("cannot create finalizer for %s: %w", nsf.pol.GetName(), err)
 	}
 
 	if err := nsf.createPolLabel(ctx); err != nil {
-		return errors.Wrapf(err, "cannot create policy name label for %s", nsf.pol.GetName())
+		return fmt.Errorf("cannot create policy name label for %s: %w", nsf.pol.GetName(), err)
 	}
 
 	// if object does not exist, add it
 	if err := nsf.createNodeStatus(ctx); err != nil {
-		return errors.Wrapf(err, "cannot create node status for %s", nsf.pol.GetName())
+		return fmt.Errorf("cannot create node status for %s: %w", nsf.pol.GetName(), err)
 	}
 	return nil
 }
@@ -123,11 +124,11 @@ func (nsf *StatusClient) statusObj(
 func (nsf *StatusClient) createNodeStatus(ctx context.Context) error {
 	s := nsf.statusObj(secprofnodestatusv1alpha1.ProfileStatePending)
 	if setCtrlErr := controllerutil.SetControllerReference(nsf.pol, s, nsf.client.Scheme()); setCtrlErr != nil {
-		return errors.Wrapf(setCtrlErr, "cannot set node status owner reference: %s", nsf.pol.GetName())
+		return fmt.Errorf("cannot set node status owner reference: %s: %w", nsf.pol.GetName(), setCtrlErr)
 	}
 	err := nsf.client.Create(ctx, s)
 	if err != nil && !kerrors.IsAlreadyExists(err) {
-		return errors.Wrap(err, "creating node status")
+		return fmt.Errorf("creating node status: %w", err)
 	}
 
 	return nil
@@ -136,12 +137,12 @@ func (nsf *StatusClient) createNodeStatus(ctx context.Context) error {
 func (nsf *StatusClient) Remove(ctx context.Context, c client.Client) error {
 	// if finalizer exists, remove it
 	if err := nsf.removeFinalizer(ctx); err != nil {
-		return errors.Wrapf(err, "cannot remove finalizer for %s", nsf.pol.GetName())
+		return fmt.Errorf("cannot remove finalizer for %s: %w", nsf.pol.GetName(), err)
 	}
 
 	// if object exists, remove it
 	if err := nsf.removeNodeStatus(ctx, c); err != nil {
-		return errors.Wrapf(err, "cannot remove nodeStatus for %s", nsf.pol.GetName())
+		return fmt.Errorf("cannot remove nodeStatus for %s: %w", nsf.pol.GetName(), err)
 	}
 
 	return nil
@@ -157,7 +158,7 @@ func (nsf *StatusClient) removeNodeStatus(ctx context.Context, c client.Client)
 	// the state here is more or less unused, we just care about the name since we're deleting...
 	err := c.Delete(ctx, nsf.statusObj(secprofnodestatusv1alpha1.ProfileStateTerminating))
 	if err != nil && !kerrors.IsNotFound(err) {
-		return errors.Wrap(err, "deleting node status")
+		return fmt.Errorf("deleting node status: %w", err)
 	}
 
 	return nil
@@ -180,7 +181,7 @@ func (nsf *StatusClient) nodeStatusExists(ctx context.Context) (bool, error) {
 	if kerrors.IsNotFound(err) {
 		return false, nil
 	} else if err != nil {
-		return false, errors.Wrap(err, "fetching node status")
+		return false, fmt.Errorf("fetching node status: %w", err)
 	}
 
 	return true, nil
@@ -195,13 +196,13 @@ func (nsf *StatusClient) SetNodeStatus(
 		// it's OK if we're about to terminate a profile but it was already gone
 		return nil
 	} else if err != nil {
-		return errors.Wrap(err, "retrieving the current status")
+		return fmt.Errorf("retrieving the current status: %w", err)
 	}
 
 	status.Status = polState
 	status.Labels[secprofnodestatusv1alpha1.StatusStateLabel] = string(polState)
 	if err := nsf.client.Update(ctx, &status); err != nil {
-		return errors.Wrap(err, "updating node status")
+		return fmt.Errorf("updating node status: %w", err)
 	}
 
 	return nil
@@ -216,7 +217,7 @@ func (nsf *StatusClient) Matches(
 			// it's OK if we're about to terminate a profile but it was already gone
 			return true, nil
 		}
-		return false, errors.Wrapf(err, "getting node status for matching")
+		return false, fmt.Errorf("getting node status for matching: %w", err)
 	}
 	return status.Status == polState, nil
 }
diff --git a/internal/pkg/nonrootenabler/nonrootenabler.go b/internal/pkg/nonrootenabler/nonrootenabler.go
index d28af8f75..088562f43 100644
--- a/internal/pkg/nonrootenabler/nonrootenabler.go
+++ b/internal/pkg/nonrootenabler/nonrootenabler.go
@@ -17,10 +17,10 @@ limitations under the License.
 package nonrootenabler
 
 import (
+	"fmt"
 	"os"
 
 	"github.com/go-logr/logr"
-	"github.com/pkg/errors"
 	"sigs.k8s.io/release-utils/util"
 
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/config"
@@ -50,8 +50,9 @@ func (n *NonRootEnabler) Run(logger logr.Logger) error {
 	if err := n.impl.MkdirAll(
 		config.KubeletSeccompRootPath, dirPermissions,
 	); err != nil {
-		return errors.Wrapf(
-			err, "create seccomp root path %s", config.KubeletSeccompRootPath,
+		return fmt.Errorf(
+			"create seccomp root path %s: %w",
+			config.KubeletSeccompRootPath, err,
 		)
 	}
 
@@ -59,15 +60,16 @@ func (n *NonRootEnabler) Run(logger logr.Logger) error {
 	if err := n.impl.MkdirAll(
 		config.OperatorRoot, dirPermissions,
 	); err != nil {
-		return errors.Wrapf(
-			err, "create operator root path %s", config.KubeletSeccompRootPath,
+		return fmt.Errorf(
+			"create operator root path %s: %w",
+			config.KubeletSeccompRootPath, err,
 		)
 	}
 
 	// In case the directory already existed
 	logger.Info("Setting operator root permissions")
 	if err := n.impl.Chmod(config.OperatorRoot, dirPermissions); err != nil {
-		return errors.Wrap(err, "change operator root path permissions")
+		return fmt.Errorf("change operator root path permissions: %w", err)
 	}
 
 	if _, err := n.impl.Stat(config.ProfilesRootPath); os.IsNotExist(err) {
@@ -75,7 +77,7 @@ func (n *NonRootEnabler) Run(logger logr.Logger) error {
 		if err := n.impl.Symlink(
 			config.OperatorRoot, config.ProfilesRootPath,
 		); err != nil {
-			return errors.Wrap(err, "link profiles root path")
+			return fmt.Errorf("link profiles root path: %w", err)
 		}
 	}
 
@@ -83,14 +85,14 @@ func (n *NonRootEnabler) Run(logger logr.Logger) error {
 	if err := n.impl.Chown(
 		config.OperatorRoot, config.UserRootless, config.UserRootless,
 	); err != nil {
-		return errors.Wrap(err, "change operator root permissions")
+		return fmt.Errorf("change operator root permissions: %w", err)
 	}
 
 	logger.Info("Copying profiles into root path")
 	if err := n.impl.CopyDirContentsLocal(
 		"/opt/spo-profiles", config.KubeletSeccompRootPath,
 	); err != nil {
-		return errors.Wrap(err, "copy local security profiles")
+		return fmt.Errorf("copy local security profiles: %w", err)
 	}
 
 	return nil
diff --git a/internal/pkg/util/containers.go b/internal/pkg/util/containers.go
index 8a78c3970..f7d767ee5 100644
--- a/internal/pkg/util/containers.go
+++ b/internal/pkg/util/containers.go
@@ -18,6 +18,7 @@ package util
 
 import (
 	"bufio"
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -25,7 +26,6 @@ import (
 	"strconv"
 
 	"github.com/ReneKroon/ttlcache/v2"
-	"github.com/pkg/errors"
 )
 
 var (
@@ -60,7 +60,7 @@ func ContainerIDForPID(cache ttlcache.SimpleCache, pid int) (string, error) {
 
 	file, err := os.Open(filepath.Clean(cgroupPath))
 	if err != nil {
-		return "", errors.Wrap(err, ErrProcessNotFound.Error())
+		return "", fmt.Errorf("%v: %w", ErrProcessNotFound, err)
 	}
 
 	defer func() {
@@ -79,7 +79,7 @@ func ContainerIDForPID(cache ttlcache.SimpleCache, pid int) (string, error) {
 			if err := cache.Set(
 				strconv.Itoa(pid), containerID,
 			); err != nil {
-				return "", errors.Wrap(err, "update cache")
+				return "", fmt.Errorf("update cache: %w", err)
 			}
 
 			return containerID, nil
diff --git a/internal/pkg/util/finalizers.go b/internal/pkg/util/finalizers.go
index 41ea8c4cf..71e30000c 100644
--- a/internal/pkg/util/finalizers.go
+++ b/internal/pkg/util/finalizers.go
@@ -18,8 +18,8 @@ package util
 
 import (
 	"context"
+	"fmt"
 
-	"github.com/pkg/errors"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 )
@@ -27,7 +27,7 @@ import (
 // addFinalizer attempts to add a finalizer to an object if not present and update the object.
 func AddFinalizer(ctx context.Context, c client.Client, pol client.Object, finalizer string) error {
 	if err := c.Get(ctx, NamespacedName(pol.GetName(), pol.GetNamespace()), pol); err != nil {
-		return errors.Wrap(err, ErrGetProfile)
+		return fmt.Errorf("%s: %w", ErrGetProfile, err)
 	}
 	if controllerutil.ContainsFinalizer(pol, finalizer) {
 		return nil
@@ -39,7 +39,7 @@ func AddFinalizer(ctx context.Context, c client.Client, pol client.Object, final
 // removeFinalizer attempts to remove a finalizer from an object if present and update the object.
 func RemoveFinalizer(ctx context.Context, c client.Client, pol client.Object, finalizer string) error {
 	if err := c.Get(ctx, NamespacedName(pol.GetName(), pol.GetNamespace()), pol); err != nil {
-		return errors.Wrap(err, ErrGetProfile)
+		return fmt.Errorf("%s: %w", ErrGetProfile, err)
 	}
 	if !controllerutil.ContainsFinalizer(pol, finalizer) {
 		return nil
diff --git a/internal/pkg/util/names.go b/internal/pkg/util/names.go
index 72595a31f..966edffbf 100644
--- a/internal/pkg/util/names.go
+++ b/internal/pkg/util/names.go
@@ -18,10 +18,10 @@ package util
 
 import (
 	"crypto/sha256"
+	"errors"
 	"fmt"
 	"io"
 
-	"github.com/pkg/errors"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
@@ -53,7 +53,7 @@ func lengthName(maxLen int, hashPrefix, format string, a ...interface{}) (string
 	// If that's too long, just hash the name. It's not very user friendly, but whatever
 	hasher := sha256.New()
 	if _, err := io.WriteString(hasher, friendlyName); err != nil {
-		return "", errors.Wrap(err, "writing string")
+		return "", fmt.Errorf("writing string: %w", err)
 	}
 
 	hashStr := fmt.Sprintf("%x", hasher.Sum(nil))
diff --git a/internal/pkg/util/retries.go b/internal/pkg/util/retries.go
index 96b07b5b2..c73d77977 100644
--- a/internal/pkg/util/retries.go
+++ b/internal/pkg/util/retries.go
@@ -17,10 +17,10 @@ limitations under the License.
 package util
 
 import (
+	"fmt"
 	"time"
 
-	"github.com/pkg/errors"
-	kerrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/util/wait"
 )
 
@@ -31,7 +31,7 @@ const (
 )
 
 func IsNotFoundOrConflict(err error) bool {
-	return kerrors.IsNotFound(err) || kerrors.IsConflict(err)
+	return errors.IsNotFound(err) || errors.IsConflict(err)
 }
 
 // retry attempts to execute fn up to 5 times if its failure meets retryCondition.
@@ -54,11 +54,11 @@ func RetryEx(backoff *wait.Backoff, fn func() error, retryCondition func(error)
 			return false, nil
 		}
 
-		return false, errors.Wrap(err, "retry function")
+		return false, fmt.Errorf("retry function: %w", err)
 	})
 
 	if waitErr != nil {
-		return errors.Wrap(waitErr, "wait on retry")
+		return fmt.Errorf("wait on retry: %w", waitErr)
 	}
 
 	return nil
diff --git a/internal/pkg/version/version.go b/internal/pkg/version/version.go
index 6186a9b33..ead862780 100644
--- a/internal/pkg/version/version.go
+++ b/internal/pkg/version/version.go
@@ -18,14 +18,13 @@ package version
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"reflect"
 	"runtime"
 	"runtime/debug"
 	"strings"
 	"text/tabwriter"
-
-	"github.com/pkg/errors"
 )
 
 var (
@@ -159,7 +158,7 @@ func (i *Info) String() string {
 func (i *Info) JSONString() (string, error) {
 	b, err := json.MarshalIndent(i, "", "  ")
 	if err != nil {
-		return "", errors.Wrap(err, "marshal info as JSON")
+		return "", fmt.Errorf("marshal info as JSON: %w", err)
 	}
 	return string(b), nil
 }
diff --git a/internal/pkg/webhooks/binding/binding.go b/internal/pkg/webhooks/binding/binding.go
index 6d3516b32..628909259 100644
--- a/internal/pkg/webhooks/binding/binding.go
+++ b/internal/pkg/webhooks/binding/binding.go
@@ -19,12 +19,12 @@ package binding
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"sync"
 
 	"github.com/go-logr/logr"
-	"github.com/pkg/errors"
 	corev1 "k8s.io/api/core/v1"
 	kerrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/types"
@@ -180,10 +180,10 @@ func (p *podSeccompBinder) getSeccompProfile(
 		func() (retryErr error) {
 			seccompProfile, retryErr = p.GetSeccompProfile(ctx, key)
 			if retryErr != nil {
-				return errors.Wrapf(retryErr, "getting profile")
+				return fmt.Errorf("getting profile: %w", retryErr)
 			}
 			if seccompProfile.Status.Status == "" {
-				return errors.Wrapf(ErrProfWithoutStatus, "getting profile")
+				return fmt.Errorf("getting profile: %w", ErrProfWithoutStatus)
 			}
 			return nil
 		}, func(inErr error) bool {
@@ -221,7 +221,7 @@ func (p *podSeccompBinder) addPodToBinding(
 ) error {
 	pb.Status.ActiveWorkloads = utils.AppendIfNotExists(pb.Status.ActiveWorkloads, podID)
 	if err := p.impl.UpdateResourceStatus(ctx, p.log, pb, "profilebinding status"); err != nil {
-		return errors.Wrap(err, "add pod to binding")
+		return fmt.Errorf("add pod to binding: %w", err)
 	}
 	if !controllerutil.ContainsFinalizer(pb, finalizer) {
 		controllerutil.AddFinalizer(pb, finalizer)
@@ -236,7 +236,7 @@ func (p *podSeccompBinder) removePodFromBinding(
 ) error {
 	pb.Status.ActiveWorkloads = utils.RemoveIfExists(pb.Status.ActiveWorkloads, podID)
 	if err := p.impl.UpdateResourceStatus(ctx, p.log, pb, "profilebinding status"); err != nil {
-		return errors.Wrap(err, "remove pod from binding")
+		return fmt.Errorf("remove pod from binding: %w", err)
 	}
 	if len(pb.Status.ActiveWorkloads) == 0 &&
 		controllerutil.ContainsFinalizer(pb, finalizer) {
diff --git a/internal/pkg/webhooks/binding/impl.go b/internal/pkg/webhooks/binding/impl.go
index 54decb687..fc169ed33 100644
--- a/internal/pkg/webhooks/binding/impl.go
+++ b/internal/pkg/webhooks/binding/impl.go
@@ -18,9 +18,9 @@ package binding
 
 import (
 	"context"
+	"fmt"
 
 	"github.com/go-logr/logr"
-	"github.com/pkg/errors"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -51,8 +51,10 @@ func (d *defaultImpl) ListProfileBindings(
 	ctx context.Context, opts ...client.ListOption,
 ) (*v1alpha1.ProfileBindingList, error) {
 	profileBindings := &v1alpha1.ProfileBindingList{}
-	err := d.client.List(ctx, profileBindings, opts...)
-	return profileBindings, errors.Wrap(err, "list profile bindings")
+	if err := d.client.List(ctx, profileBindings, opts...); err != nil {
+		return nil, fmt.Errorf("list profile bindings: %w", err)
+	}
+	return profileBindings, nil
 }
 
 func (d *defaultImpl) UpdateResource(
@@ -80,14 +82,18 @@ func (d *defaultImpl) SetDecoder(decoder *admission.Decoder) {
 // nolint:gocritic
 func (d *defaultImpl) DecodePod(req admission.Request) (*corev1.Pod, error) {
 	pod := &corev1.Pod{}
-	err := d.decoder.Decode(req, pod)
-	return pod, errors.Wrap(err, "decode pod")
+	if err := d.decoder.Decode(req, pod); err != nil {
+		return nil, fmt.Errorf("decode pod: %w", err)
+	}
+	return pod, nil
 }
 
 func (d *defaultImpl) GetSeccompProfile(
 	ctx context.Context, key types.NamespacedName,
 ) (*seccompprofileapi.SeccompProfile, error) {
 	seccompProfile := &seccompprofileapi.SeccompProfile{}
-	err := d.client.Get(ctx, key, seccompProfile)
-	return seccompProfile, errors.Wrap(err, "get seccomp profile")
+	if err := d.client.Get(ctx, key, seccompProfile); err != nil {
+		return nil, fmt.Errorf("get seccomp profile: %w", err)
+	}
+	return seccompProfile, nil
 }
diff --git a/internal/pkg/webhooks/recording/impl.go b/internal/pkg/webhooks/recording/impl.go
index 0b779fae4..b6e5ce57d 100644
--- a/internal/pkg/webhooks/recording/impl.go
+++ b/internal/pkg/webhooks/recording/impl.go
@@ -18,9 +18,9 @@ package recording
 
 import (
 	"context"
+	"fmt"
 
 	"github.com/go-logr/logr"
-	"github.com/pkg/errors"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
@@ -52,8 +52,10 @@ func (d *defaultImpl) ListProfileRecordings(
 	ctx context.Context, opts ...client.ListOption,
 ) (*v1alpha1.ProfileRecordingList, error) {
 	profileRecordings := &v1alpha1.ProfileRecordingList{}
-	err := d.client.List(ctx, profileRecordings, opts...)
-	return profileRecordings, errors.Wrap(err, "list profile recordings")
+	if err := d.client.List(ctx, profileRecordings, opts...); err != nil {
+		return nil, fmt.Errorf("list profile recordings: %w", err)
+	}
+	return profileRecordings, nil
 }
 
 func (d *defaultImpl) UpdateResource(
@@ -76,8 +78,10 @@ func (d *defaultImpl) GetOperatorNamespace() string {
 // nolint:gocritic
 func (d *defaultImpl) DecodePod(req admission.Request) (*corev1.Pod, error) {
 	pod := &corev1.Pod{}
-	err := d.decoder.Decode(req, pod)
-	return pod, errors.Wrap(err, "decode pod")
+	if err := d.decoder.Decode(req, pod); err != nil {
+		return nil, fmt.Errorf("decode pod: %w", err)
+	}
+	return pod, nil
 }
 
 func (*defaultImpl) LabelSelectorAsSelector(
diff --git a/internal/pkg/webhooks/recording/recording.go b/internal/pkg/webhooks/recording/recording.go
index 72e7f0dca..72f010b3b 100644
--- a/internal/pkg/webhooks/recording/recording.go
+++ b/internal/pkg/webhooks/recording/recording.go
@@ -19,13 +19,13 @@ package recording
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"strings"
 	"sync"
 
 	"github.com/go-logr/logr"
-	"github.com/pkg/errors"
 	admissionv1 "k8s.io/api/admission/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/labels"
@@ -322,7 +322,7 @@ func (p *podSeccompRecorder) addPod(
 	if err := p.impl.UpdateResource(
 		ctx, p.log, profileRecording, "profilerecording status",
 	); err != nil {
-		return errors.Wrap(err, "update resource on adding pod")
+		return fmt.Errorf("update resource on adding pod: %w", err)
 	}
 
 	if !controllerutil.ContainsFinalizer(profileRecording, finalizer) {
@@ -348,7 +348,7 @@ func (p *podSeccompRecorder) removePod(
 	if err := p.impl.UpdateResource(
 		ctx, p.log, profileRecording, "profilerecording status",
 	); err != nil {
-		return errors.Wrap(err, "update resource on removing pod")
+		return fmt.Errorf("update resource on removing pod: %w", err)
 	}
 
 	if len(profileRecording.Status.ActiveWorkloads) == 0 &&
diff --git a/internal/pkg/webhooks/utils/utils.go b/internal/pkg/webhooks/utils/utils.go
index 0c2dd0ef7..7e31adf87 100644
--- a/internal/pkg/webhooks/utils/utils.go
+++ b/internal/pkg/webhooks/utils/utils.go
@@ -21,7 +21,6 @@ import (
 	"fmt"
 
 	"github.com/go-logr/logr"
-	"github.com/pkg/errors"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
@@ -58,7 +57,7 @@ func UpdateResource(
 	if err := c.Update(ctx, object); err != nil {
 		msg := fmt.Sprintf("failed to update resource %s", name)
 		logger.Error(err, msg)
-		return errors.Wrap(err, msg)
+		return fmt.Errorf("%s: %w", msg, err)
 	}
 	return nil
 }


Test patch:
diff --git a/internal/pkg/daemon/apparmorprofile/apparmor_test.go b/internal/pkg/daemon/apparmorprofile/apparmor_test.go
index f4d224c88..e3942bafa 100644
--- a/internal/pkg/daemon/apparmorprofile/apparmor_test.go
+++ b/internal/pkg/daemon/apparmorprofile/apparmor_test.go
@@ -17,10 +17,10 @@ limitations under the License.
 package apparmorprofile
 
 import (
+	"errors"
 	"testing"
 
 	"github.com/go-logr/logr"
-	"github.com/pkg/errors"
 	"github.com/stretchr/testify/require"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 
diff --git a/internal/pkg/daemon/bpfrecorder/bpfrecorder_test.go b/internal/pkg/daemon/bpfrecorder/bpfrecorder_test.go
index c37937014..13773c0db 100644
--- a/internal/pkg/daemon/bpfrecorder/bpfrecorder_test.go
+++ b/internal/pkg/daemon/bpfrecorder/bpfrecorder_test.go
@@ -23,6 +23,7 @@ import (
 	"context"
 	"encoding/binary"
 	"encoding/json"
+	"errors"
 	"os"
 	"sync"
 	"syscall"
@@ -30,7 +31,6 @@ import (
 	"time"
 
 	"github.com/go-logr/logr"
-	"github.com/pkg/errors"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc"
 	v1 "k8s.io/api/core/v1"
diff --git a/internal/pkg/daemon/seccompprofile/seccompprofile_test.go b/internal/pkg/daemon/seccompprofile/seccompprofile_test.go
index ff16d5617..cff06cccf 100644
--- a/internal/pkg/daemon/seccompprofile/seccompprofile_test.go
+++ b/internal/pkg/daemon/seccompprofile/seccompprofile_test.go
@@ -18,6 +18,8 @@ package seccompprofile
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"os"
 	"path"
 	"sort"
@@ -26,7 +28,6 @@ import (
 	"github.com/containers/common/pkg/seccomp"
 	"github.com/crossplane/crossplane-runtime/pkg/event"
 	"github.com/crossplane/crossplane-runtime/pkg/test"
-	"github.com/pkg/errors"
 	"github.com/stretchr/testify/require"
 	kerrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -45,17 +46,8 @@ func TestReconcile(t *testing.T) {
 
 	name := "cool-profile"
 	namespace := "cool-namespace"
-
 	errOops := errors.New("oops")
 
-	// return error only if seccomp is enabled
-	getErrorIfSeccompEnabled := func(e error) error {
-		if seccomp.IsEnabled() {
-			return e
-		}
-		return nil
-	}
-
 	cases := []struct {
 		name       string
 		rec        *Reconciler
@@ -88,7 +80,12 @@ func TestReconcile(t *testing.T) {
 			},
 			req:        reconcile.Request{NamespacedName: types.NamespacedName{Namespace: namespace, Name: name}},
 			wantResult: reconcile.Result{},
-			wantErr:    errors.Wrap(getErrorIfSeccompEnabled(errOops), errGetProfile),
+			wantErr: func() error {
+				if seccomp.IsEnabled() {
+					return fmt.Errorf("%s: %w", errGetProfile, errOops)
+				}
+				return nil
+			}(),
 		},
 		{
 			name: "GotProfile",
@@ -133,7 +130,7 @@ func TestSaveProfileOnDisk(t *testing.T) {
 	}
 	dir, err := os.MkdirTemp("", config.OperatorName)
 	if err != nil {
-		t.Error(errors.Wrap(err, "error creating temp file for tests"))
+		t.Error(fmt.Errorf("creating temp file for tests: %w", err))
 	}
 	t.Cleanup(func() { os.RemoveAll(dir) })
 
diff --git a/internal/pkg/util/reconcileutils_test.go b/internal/pkg/util/reconcileutils_test.go
index 9c6b7a34c..ba0422da4 100644
--- a/internal/pkg/util/reconcileutils_test.go
+++ b/internal/pkg/util/reconcileutils_test.go
@@ -17,9 +17,9 @@ limitations under the License.
 package util
 
 import (
+	"errors"
 	"testing"
 
-	"github.com/pkg/errors"
 	"github.com/stretchr/testify/require"
 	kerrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -46,6 +46,11 @@ func TestIgnoreNotFound(t *testing.T) {
 			err:  errOops,
 			want: errOops,
 		},
+		{
+			name: "NilError",
+			err:  nil,
+			want: nil,
+		},
 	}
 
 	for _, tc := range cases {
diff --git a/internal/pkg/webhooks/binding/binding_test.go b/internal/pkg/webhooks/binding/binding_test.go
index f6e12a9cf..c5dafa3b6 100644
--- a/internal/pkg/webhooks/binding/binding_test.go
+++ b/internal/pkg/webhooks/binding/binding_test.go
@@ -19,12 +19,12 @@ package binding
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"net/http"
 	"sync"
 	"testing"
 
 	"github.com/go-logr/logr"
-	"github.com/pkg/errors"
 	"github.com/stretchr/testify/require"
 	admissionv1 "k8s.io/api/admission/v1"
 	corev1 "k8s.io/api/core/v1"
diff --git a/internal/pkg/webhooks/utils/utils_test.go b/internal/pkg/webhooks/utils/utils_test.go
index b5af2828b..6d304f144 100644
--- a/internal/pkg/webhooks/utils/utils_test.go
+++ b/internal/pkg/webhooks/utils/utils_test.go
@@ -18,10 +18,10 @@ package utils_test
 
 import (
 	"context"
+	"errors"
 	"testing"
 
 	"github.com/go-logr/logr"
-	"github.com/pkg/errors"
 	"github.com/stretchr/testify/require"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
diff --git a/test/tc_selinux_base_usage_test.go b/test/tc_selinux_base_usage_test.go
index 1d0506478..67f54569c 100644
--- a/test/tc_selinux_base_usage_test.go
+++ b/test/tc_selinux_base_usage_test.go
@@ -145,8 +145,10 @@ func (e *e2e) assertSelinuxPolicyIsInstalled(nodes []string, policy string, node
 
 		if missingPolName != "" {
 			if i == nodeIterations-1 {
-				e.Failf("The SelinuxProfile errorlogger wasn't found in the %s node with the name %s",
-					missingPolName, policy)
+				e.Fail(fmt.Sprintf(
+					"The SelinuxProfile errorlogger wasn't found in the %s node with the name %s",
+					missingPolName, policy,
+				))
 			} else {
 				e.logf("the policy was stil present, trying again")
 				time.Sleep(sleep)
@@ -169,8 +171,10 @@ func (e *e2e) assertSelinuxPolicyIsRemoved(nodes []string, policy string, nodeIt
 
 		if missingPolName != "" {
 			if i == nodeIterations-1 {
-				e.Failf("The SelinuxProfile errorlogger was found in the %s node with the name %s",
-					missingPolName, policy)
+				e.Fail(fmt.Sprintf(
+					"The SelinuxProfile errorlogger was found in the %s node with the name %s",
+					missingPolName, policy,
+				))
 			} else {
 				e.logf("the policy was stil present, trying again")
 				time.Sleep(sleep)