diff --git a/client/tailscale/localclient.go b/client/tailscale/localclient.go
index 34c094a63..4e452f894 100644
--- a/client/tailscale/localclient.go
+++ b/client/tailscale/localclient.go
@@ -1,7 +1,7 @@
 // Copyright (c) Tailscale Inc & AUTHORS
 // SPDX-License-Identifier: BSD-3-Clause
 
-//go:build go1.19
+//go:build go1.22
 
 package tailscale
 
diff --git a/version-embed.go b/version-embed.go
index 2d517339d..17bf578dd 100644
--- a/version-embed.go
+++ b/version-embed.go
@@ -26,6 +26,7 @@
 //go:embed go.toolchain.rev
 var GoToolchainRev string
 
+//lint:ignore U1000 used by tests + assert_ts_toolchain_match.go w/ right build tags
 func tailscaleToolchainRev() (gitHash string, ok bool) {
 	bi, ok := debug.ReadBuildInfo()
 	if !ok {
diff --git a/wgengine/filter/filter_test.go b/wgengine/filter/filter_test.go
index 7ffdd5c7b..e7f71e6a4 100644
--- a/wgengine/filter/filter_test.go
+++ b/wgengine/filter/filter_test.go
@@ -768,7 +768,7 @@ func ports(s string) PortRange {
 	if err != nil {
 		panic(fmt.Sprintf("invalid NetPortRange %q", s))
 	}
-	return PortRange{uint16(first), uint16(last)}
+	return PortRange{First: uint16(first), Last: uint16(last)}
 }
 
 func netports(netPorts ...string) (ret []NetPortRange) {
@@ -814,11 +814,11 @@ func TestMatchesFromFilterRules(t *testing.T) {
 					Dsts: []NetPortRange{
 						{
 							Net:   netip.MustParsePrefix("0.0.0.0/0"),
-							Ports: PortRange{22, 22},
+							Ports: PortRange{First: 22, Last: 22},
 						},
 						{
 							Net:   netip.MustParsePrefix("::0/0"),
-							Ports: PortRange{22, 22},
+							Ports: PortRange{First: 22, Last: 22},
 						},
 					},
 					Srcs: []netip.Prefix{
@@ -848,7 +848,7 @@ func TestMatchesFromFilterRules(t *testing.T) {
 					Dsts: []NetPortRange{
 						{
 							Net:   netip.MustParsePrefix("1.2.0.0/16"),
-							Ports: PortRange{22, 22},
+							Ports: PortRange{First: 22, Last: 22},
 						},
 					},
 					Srcs: []netip.Prefix{
diff --git a/wgengine/netstack/gro/gro.go b/wgengine/netstack/gro/gro.go
index b268534eb..654d17056 100644
--- a/wgengine/netstack/gro/gro.go
+++ b/wgengine/netstack/gro/gro.go
@@ -6,6 +6,7 @@
 
 import (
 	"bytes"
+
 	"github.com/tailscale/wireguard-go/tun"
 	"gvisor.dev/gvisor/pkg/buffer"
 	"gvisor.dev/gvisor/pkg/tcpip"