diff --git a/orbit/pkg/kdialog/kdialog.go b/orbit/pkg/kdialog/kdialog.go
index 5f7578a3f63..f796e90bf13 100644
--- a/orbit/pkg/kdialog/kdialog.go
+++ b/orbit/pkg/kdialog/kdialog.go
@@ -95,7 +95,7 @@ func execCmdWithOutput(timeout time.Duration, args ...string) ([]byte, int, erro
 
 	output, exitCode, err := execuser.RunWithOutput(kdialogProcessName, opts...)
 	if err != nil {
-		return nil, exitCode, err
+		return nil, exitCode, fmt.Errorf("run kdialog via execuser: %w", err)
 	}
 
 	return output, exitCode, nil
diff --git a/tools/mdm/migration/kandji/main.go b/tools/mdm/migration/kandji/main.go
index 7e46384d41c..d974acdce23 100644
--- a/tools/mdm/migration/kandji/main.go
+++ b/tools/mdm/migration/kandji/main.go
@@ -86,25 +86,25 @@ func unenroll(serialNumber string) error {
 	client := fleethttp.NewClient()
 	req, err := http.NewRequest("GET", fmt.Sprintf("https://%s.api.kandji.io/api/v1/devices?serial_number=%s", *subdomainFlag, serialNumber), nil)
 	if err != nil {
-		return err
+		return fmt.Errorf("creating get device request: %w", err)
 	}
 	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", *apiTokenFlag))
 	req.Header.Set("Content-Type", "application/json")
 	resp, err := client.Do(req)
 	if err != nil {
-		return err
+		return fmt.Errorf("performing get device request: %w", err)
 	}
 	defer resp.Body.Close()
 	bodyText, err := io.ReadAll(resp.Body)
 	if err != nil {
-		return err
+		return fmt.Errorf("reading get device response body: %w", err)
 	}
 
 	var deviceInfo []struct {
 		DeviceID string `json:"device_id"`
 	}
 	if err = json.Unmarshal(bodyText, &deviceInfo); err != nil {
-		return err
+		return fmt.Errorf("unmarshalling get device response body: %w", err)
 	}
 	if len(deviceInfo) == 0 {
 		return fmt.Errorf("empty deviceInfo response, serial: %s", serialNumber)
@@ -114,12 +114,12 @@ func unenroll(serialNumber string) error {
 	// https://api-docs.kandji.io/#97deb582-d86c-444a-aa3b-3528b9a8478f
 	req, err = http.NewRequest("DELETE", fmt.Sprintf("https://%s.api.kandji.io/api/v1/devices/%s", *subdomainFlag, deviceInfo[0].DeviceID), nil)
 	if err != nil {
-		return err
+		return fmt.Errorf("creating delete device request: %w", err)
 	}
 	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", *apiTokenFlag))
 	resp, err = client.Do(req)
 	if err != nil {
-		return err
+		return fmt.Errorf("performing delete device request: %w", err)
 	}
 	fmt.Println("resp.StatusCode, serialNumber, device", resp.StatusCode, serialNumber, deviceInfo[0].DeviceID)
 
diff --git a/tools/software/vulnerabilities/performance_test/tester/performance_tester.go b/tools/software/vulnerabilities/performance_test/tester/performance_tester.go
index a7274ecac66..b271e4cfec3 100644
--- a/tools/software/vulnerabilities/performance_test/tester/performance_tester.go
+++ b/tools/software/vulnerabilities/performance_test/tester/performance_tester.go
@@ -19,12 +19,19 @@ import (
 
 var (
 	// MySQL config
-	mysqlAddr = "localhost:3306"
-	mysqlUser = "fleet"
-	mysqlPass = "insecure"
-	mysqlDB   = "fleet"
+	mysqlAddr = getEnvOrDefault("PERF_TEST_MYSQL_ADDR", "localhost:3306")
+	mysqlUser = getEnvOrDefault("PERF_TEST_MYSQL_USER", "fleet")
+	mysqlPass = getEnvOrDefault("PERF_TEST_MYSQL_PASS", "insecure")
+	mysqlDB   = getEnvOrDefault("PERF_TEST_MYSQL_DB", "fleet")
 )
 
+func getEnvOrDefault(envVar, defaultValue string) string {
+	if v := os.Getenv(envVar); v != "" {
+		return v
+	}
+	return defaultValue
+}
+
 // TestFunction represents a datastore method to test
 type TestFunction func(context.Context, *mysql.Datastore) error
 
@@ -221,7 +228,7 @@ func main() {
 		Database: mysqlDB,
 	}, clock.C)
 	if err != nil {
-		log.Fatal(err)
+		log.Fatalf("connect to mysql datastore: %v", err)
 	}
 	defer func() { _ = ds.Close() }()
 
diff --git a/tools/tuf/download-artifacts/download-artifacts.go b/tools/tuf/download-artifacts/download-artifacts.go
index 5b3c70a0cf9..9d8f6f2bea6 100644
--- a/tools/tuf/download-artifacts/download-artifacts.go
+++ b/tools/tuf/download-artifacts/download-artifacts.go
@@ -265,11 +265,11 @@ func downloadComponents(workflowName string, headBranch string, artifactNames ma
 	for {
 		workflow, _, err := gc.Actions.GetWorkflowByFileName(ctx, "fleetdm", "fleet", workflowName)
 		if err != nil {
-			return err
+			return fmt.Errorf("get workflow %s: %w", workflowName, err)
 		}
 		workflowRuns, _, err := gc.Actions.ListWorkflowRunsByID(ctx, "fleetdm", "fleet", *workflow.ID, nil)
 		if err != nil {
-			return err
+			return fmt.Errorf("list workflow runs for %s: %w", workflowName, err)
 		}
 		for _, wr := range workflowRuns.WorkflowRuns {
 			if headBranch == *wr.HeadBranch {
@@ -306,7 +306,7 @@ func downloadComponents(workflowName string, headBranch string, artifactNames ma
 	for {
 		artifactList, _, err := gc.Actions.ListWorkflowRunArtifacts(ctx, "fleetdm", "fleet", *workflowRun.ID, nil)
 		if err != nil {
-			return err
+			return fmt.Errorf("list workflow run artifacts for run %d: %w", *workflowRun.ID, err)
 		}
 		urls = make(map[string]string)
 		for _, artifact := range artifactList.Artifacts {
diff --git a/website/api/controllers/android-proxy/modify-android-policies.js b/website/api/controllers/android-proxy/modify-android-policies.js
index 34fc4656a1c..92f62821fa0 100644
--- a/website/api/controllers/android-proxy/modify-android-policies.js
+++ b/website/api/controllers/android-proxy/modify-android-policies.js
@@ -106,3 +106,4 @@ module.exports = {
 
 
 };
+