diff --git a/cli_access.go b/cli_access.go
index d63e5b1..dc54bc1 100644
--- a/cli_access.go
+++ b/cli_access.go
@@ -87,7 +87,7 @@ func runAccessGetIP(ntw *network.Network, protocol string) net.IP {
 		},
 	}
 
-	resp, err := client.Get("https://ifconfig.co")
+	resp, err := client.Get("https://ifconfig.co") // nolint: bodyclose, noctx
 	if err != nil {
 		return nil
 	}
diff --git a/cli_generate_secret.go b/cli_generate_secret.go
index b88d36f..1c8af9a 100644
--- a/cli_generate_secret.go
+++ b/cli_generate_secret.go
@@ -10,8 +10,8 @@ func runGenerateSecret(cli *CLI) {
 	secret := mtglib.GenerateSecret(cli.GenerateSecret.HostName)
 
 	if cli.GenerateSecret.Hex {
-		fmt.Println(secret.Hex())
+		fmt.Println(secret.Hex()) // nolint: forbidigo
 	} else {
-		fmt.Println(secret.Base64())
+		fmt.Println(secret.Base64()) // nolint: forbidigo
 	}
 }
diff --git a/config.go b/config.go
index 4a11b50..e0c8442 100644
--- a/config.go
+++ b/config.go
@@ -43,7 +43,7 @@ func (c *configTypeHostPort) UnmarshalText(data []byte) error {
 	return nil
 }
 
-func (c configTypeHostPort) MarshalText() ([]byte, error) {
+func (c configTypeHostPort) MarshalText() ([]byte, error) { // nolint: unparam
 	return []byte(c.String()), nil
 }
 
@@ -118,7 +118,7 @@ func (c *configTypeBytes) UnmarshalText(data []byte) error {
 	return nil
 }
 
-func (c configTypeBytes) MarshalText() ([]byte, error) {
+func (c configTypeBytes) MarshalText() ([]byte, error) { // nolint: unparam
 	return []byte(c.String()), nil
 }
 
@@ -155,7 +155,7 @@ func (c *configTypePreferIP) UnmarshalText(data []byte) error {
 	return nil
 }
 
-func (c configTypePreferIP) MarshalText() ([]byte, error) {
+func (c configTypePreferIP) MarshalText() ([]byte, error) { // nolint: unparam
 	return []byte(c.value), nil
 }
 
@@ -194,7 +194,7 @@ func (c *configTypeDuration) UnmarshalText(data []byte) error {
 	return nil
 }
 
-func (c configTypeDuration) MarshalText() ([]byte, error) {
+func (c configTypeDuration) MarshalText() ([]byte, error) { // nolint: unparam
 	return []byte(c.value.String()), nil
 }
 
@@ -229,7 +229,7 @@ func (c *configTypeFloat) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func (c *configTypeFloat) MarshalText() ([]byte, error) {
+func (c *configTypeFloat) MarshalText() ([]byte, error) { // nolint: unparam
 	return []byte(c.String()), nil
 }
 
@@ -264,7 +264,7 @@ func (c *configTypeIP) UnmarshalText(data []byte) error {
 	return nil
 }
 
-func (c *configTypeIP) MarshalText() ([]byte, error) {
+func (c *configTypeIP) MarshalText() ([]byte, error) { // nolint: unparam
 	return []byte(c.String()), nil
 }
 
@@ -303,7 +303,7 @@ func (c *configTypeURL) UnmarshalText(data []byte) error {
 	return nil
 }
 
-func (c *configTypeURL) MarshalText() ([]byte, error) {
+func (c *configTypeURL) MarshalText() ([]byte, error) { // nolint: unparam
 	return []byte(c.String()), nil
 }
 
@@ -343,7 +343,7 @@ func (c *configTypeMetricPrefix) UnmarshalText(data []byte) error {
 	return nil
 }
 
-func (c configTypeMetricPrefix) MarshalText() ([]byte, error) {
+func (c configTypeMetricPrefix) MarshalText() ([]byte, error) { // nolint: unparam
 	return []byte(c.String()), nil
 }
 
@@ -371,7 +371,7 @@ func (c *configTypeHTTPPath) UnmarshalText(data []byte) error { // nolint: unpar
 	return nil
 }
 
-func (c configTypeHTTPPath) MarshalText() ([]byte, error) {
+func (c configTypeHTTPPath) MarshalText() ([]byte, error) { // nolint: unparam
 	return []byte(c.String()), nil
 }
 
diff --git a/main.go b/main.go
index 184b198..0b78ac4 100644
--- a/main.go
+++ b/main.go
@@ -10,17 +10,18 @@ import (
 var version = "dev" // has to be set by ldflags
 
 type CLI struct {
-	GenerateSecret struct {
-		HostName string `arg optional help:"Hostname to use for domain fronting. Default is '${domain_front}'." name:"hostname" default:"${domain_front}"`
+	GenerateSecret struct { // nolint: govet
+		HostName string `arg optional help:"Hostname to use for domain fronting. Default is '${domain_front}'." name:"hostname" default:"${domain_front}"` // nolint: lll, govet
 		Hex      bool   `help:"Print secret in hex encoding."`
 	} `cmd help:"Generate new proxy secret."`
-	Access struct {
-		ConfigPath string `arg required type:"existingfile" help:"Path to the configuration file." name:"config-path"`
+	Access struct { // nolint: govet
+		ConfigPath string `arg required type:"existingfile" help:"Path to the configuration file." name:"config-path"` // nolint: lll, govet
 		Hex        bool   `help:"Print secret in hex encoding."`
 	} `cmd help:"Print access information."`
-	Run struct {
-		ConfigPath string `arg required type:"existingfile" help:"Path to the configuration file." name:"config-path"`
+	Run struct { // nolint: govet
+		ConfigPath string `arg required type:"existingfile" help:"Path to the configuration file." name:"config-path"` // nolint: lll, govet
 	} `cmd help:"Run proxy."`
+	Version kong.VersionFlag `help:"Print version."`
 }
 
 func main() {
@@ -30,6 +31,7 @@ func main() {
 	ctx := kong.Parse(cli, kong.Vars{
 		"domain_front": "amazonaws.com",
 		"config_path":  "/etc/mtg.toml",
+		"version":      version,
 	})
 
 	switch ctx.Command() {
diff --git a/mtglib/secret.go b/mtglib/secret.go
index bc0aed8..b35fc7a 100644
--- a/mtglib/secret.go
+++ b/mtglib/secret.go
@@ -15,8 +15,8 @@ type Secret struct {
 	Host string
 }
 
-func (s *Secret) MarshalText() ([]byte, error) {
-	if s == nil {
+func (s Secret) MarshalText() ([]byte, error) {
+	if s.Key == nil {
 		return nil, nil
 	}
 
diff --git a/utils.go b/utils.go
index 7299518..c2a11ae 100644
--- a/utils.go
+++ b/utils.go
@@ -28,7 +28,7 @@ func makeNetwork(conf *config) (*network.Network, error) {
 		return nil, fmt.Errorf("cannot build a default dialer: %w", err)
 	}
 
-	proxyURLs := make([]*url.URL, len(conf.Network.Proxies))
+	proxyURLs := make([]*url.URL, 0, len(conf.Network.Proxies))
 
 	for _, v := range conf.Network.Proxies {
 		if value := v.Value(nil); value != nil {
@@ -41,7 +41,6 @@ func makeNetwork(conf *config) (*network.Network, error) {
 		return network.NewNetwork(baseDialer, dohIP, httpTimeout)
 	case 1:
 		socksDialer, err := network.NewSocks5Dialer(baseDialer, proxyURLs[0])
-
 		if err != nil {
 			return nil, fmt.Errorf("cannot build socks5 dialer: %w", err)
 		}
@@ -51,7 +50,6 @@ func makeNetwork(conf *config) (*network.Network, error) {
 
 	socksDialer, err := network.NewLoadBalancedSocks5Dialer(baseDialer, proxyURLs)
 	if err != nil {
-
 		return nil, fmt.Errorf("cannot build socks5 dialer: %w", err)
 	}
 
@@ -59,6 +57,6 @@ func makeNetwork(conf *config) (*network.Network, error) {
 }
 
 func exhaustResponse(response *http.Response) {
-	io.Copy(ioutil.Discard, response.Body)
+	io.Copy(ioutil.Discard, response.Body) // nolint: errcheck
 	response.Body.Close()
 }