diff --git a/.golangci.yml b/.golangci.yml
index 0cd68aa0ae3d8..c4413d7f1d57a 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -94,6 +94,7 @@ linters:
         - G203
         - G303
         - G307
+        - G402
         - G403
         - G502
         - G503
diff --git a/central/auth/m2m/tls.go b/central/auth/m2m/tls.go
index 536afc8510474..0ac3a9580be10 100644
--- a/central/auth/m2m/tls.go
+++ b/central/auth/m2m/tls.go
@@ -23,7 +23,7 @@ func tlsConfigWithCustomCertPool() (*tls.Config, error) {
 	if err != nil {
 		return nil, err
 	}
-	return &tls.Config{RootCAs: certPool}, nil
+	return &tls.Config{RootCAs: certPool, MinVersion: tls.VersionTLS12}, nil
 }
 
 func systemCertPoolWithInjectedCAs() (*x509.CertPool, error) {
diff --git a/central/credentialexpiry/service/service_impl_test.go b/central/credentialexpiry/service/service_impl_test.go
index 6550d63bbfdcc..642a70cf959d9 100644
--- a/central/credentialexpiry/service/service_impl_test.go
+++ b/central/credentialexpiry/service/service_impl_test.go
@@ -87,8 +87,8 @@ func TestGetScannerV4CertExpiry(t *testing.T) {
 	errorExpiryFunc := genGetExpiryFunc(nil)
 
 	allScannerConfigs := map[mtls.Subject]*tls.Config{
-		mtls.ScannerV4IndexerSubject: {},
-		mtls.ScannerV4MatcherSubject: {},
+		mtls.ScannerV4IndexerSubject: {MinVersion: tls.VersionTLS12},
+		mtls.ScannerV4MatcherSubject: {MinVersion: tls.VersionTLS12},
 	}
 
 	noScannerConfigs := map[mtls.Subject]*tls.Config{}
diff --git a/central/internal/server.go b/central/internal/server.go
index 6a39e8d772376..d91e294e5fdbc 100644
--- a/central/internal/server.go
+++ b/central/internal/server.go
@@ -47,7 +47,7 @@ func (s *HTTPServer) RunForever() {
 	httpServer := &http.Server{
 		Addr:    s.Address,
 		Handler: s.mux,
-		TLSConfig: &tls.Config{
+		TLSConfig: &tls.Config{ //nolint:gosec // G402: MinVersion governed by TLS profile configuration
 			MinVersion:   tlsprofile.MinVersion(),
 			CipherSuites: tlsprofile.CipherSuites(),
 		},
diff --git a/central/notifiers/acscsemail/client_impl.go b/central/notifiers/acscsemail/client_impl.go
index efcaa6ea9f370..2d9685d5ee0fe 100644
--- a/central/notifiers/acscsemail/client_impl.go
+++ b/central/notifiers/acscsemail/client_impl.go
@@ -75,7 +75,8 @@ func transportWithAdditionalCA(caFile string) *http.Transport {
 
 	return &http.Transport{
 		TLSClientConfig: &tls.Config{
-			RootCAs: rootCAs,
+			RootCAs:    rootCAs,
+			MinVersion: tls.VersionTLS12,
 		},
 		Proxy: proxy.FromConfig(),
 	}
diff --git a/central/notifiers/acscsemail/client_impl_test.go b/central/notifiers/acscsemail/client_impl_test.go
index e2e83451d02b0..920fab0092f9d 100644
--- a/central/notifiers/acscsemail/client_impl_test.go
+++ b/central/notifiers/acscsemail/client_impl_test.go
@@ -154,6 +154,7 @@ func TestTransportWithAdditonalCA(t *testing.T) {
 
 	tlsServ.TLS = &tls.Config{
 		Certificates: []tls.Certificate{generateTestServerCert(t, ca)},
+		MinVersion:   tls.VersionTLS12,
 	}
 
 	tlsServ.StartTLS()
diff --git a/central/notifiers/email/email.go b/central/notifiers/email/email.go
index 2b7e84885381c..2adb597eaa6f1 100644
--- a/central/notifiers/email/email.go
+++ b/central/notifiers/email/email.go
@@ -518,7 +518,7 @@ func (e *email) startTLSConn(dialCtx context.Context) (conn net.Conn, auth smtp.
 }
 
 func (e *email) tlsConfig() *tls.Config {
-	return &tls.Config{
+	return &tls.Config{ //nolint:gosec // G402: InsecureSkipVerify is user-configurable for email notifier
 		ServerName:         e.smtpServer.host,
 		InsecureSkipVerify: e.config.GetSkipTLSVerify(),
 	}
diff --git a/central/notifiers/generic/generic.go b/central/notifiers/generic/generic.go
index f7a88ec5a2b4e..4a977082430fe 100644
--- a/central/notifiers/generic/generic.go
+++ b/central/notifiers/generic/generic.go
@@ -144,7 +144,7 @@ func newGeneric(notifier *storage.Notifier, cryptoCodec cryptocodec.CryptoCodec,
 		client: &http.Client{
 			Timeout: timeout,
 			Transport: &http.Transport{
-				TLSClientConfig: &tls.Config{
+				TLSClientConfig: &tls.Config{ //nolint:gosec // G402: InsecureSkipVerify is user-configurable for generic webhook
 					InsecureSkipVerify: conf.GetSkipTLSVerify(),
 					RootCAs:            rootCAs,
 				},
diff --git a/central/notifiers/splunk/splunk.go b/central/notifiers/splunk/splunk.go
index 17482a522ce4e..dca03f4518508 100644
--- a/central/notifiers/splunk/splunk.go
+++ b/central/notifiers/splunk/splunk.go
@@ -248,7 +248,7 @@ func newSplunk(notifier *storage.Notifier, cryptoCodec cryptocodec.CryptoCodec,
 		healthEndpoint = url + splunkHECHealthEndpoint
 	}
 
-	tr := proxy.RoundTripper(proxy.WithTLSConfig(&tls.Config{InsecureSkipVerify: conf.GetInsecure()}))
+	tr := proxy.RoundTripper(proxy.WithTLSConfig(&tls.Config{InsecureSkipVerify: conf.GetInsecure()})) //#nosec G402 -- InsecureSkipVerify is user-configurable for Splunk
 	client := &http.Client{Transport: tr}
 
 	return &splunk{
diff --git a/central/notifiers/sumologic/sumologic.go b/central/notifiers/sumologic/sumologic.go
index 2fb79a3005367..6d6a74aa3a4b3 100644
--- a/central/notifiers/sumologic/sumologic.go
+++ b/central/notifiers/sumologic/sumologic.go
@@ -100,7 +100,7 @@ func newSumoLogic(notifier *storage.Notifier) (*sumologic, error) {
 		client: &http.Client{
 			Timeout: timeout,
 			Transport: &http.Transport{
-				TLSClientConfig: &tls.Config{
+				TLSClientConfig: &tls.Config{ //nolint:gosec // G402: InsecureSkipVerify is user-configurable for SumoLogic
 					InsecureSkipVerify: sumoConf.GetSkipTLSVerify(),
 				},
 				Proxy: proxy.FromConfig(),
diff --git a/central/notifiers/syslog/tcp_sender.go b/central/notifiers/syslog/tcp_sender.go
index 7781b7edc7cf6..7d84aeae79d23 100644
--- a/central/notifiers/syslog/tcp_sender.go
+++ b/central/notifiers/syslog/tcp_sender.go
@@ -105,7 +105,7 @@ func (s *tcpSender) dialWithRetry() (net.Conn, error) {
 	tcpDialFunc := proxy.AwareDialContext
 	// If we're using TLS upgrade to a TLS dialFunc
 	if s.useTLS {
-		tlsConfig := &tls.Config{InsecureSkipVerify: s.skipTLSVerify}
+		tlsConfig := &tls.Config{InsecureSkipVerify: s.skipTLSVerify} //#nosec G402 -- InsecureSkipVerify is user-configurable for syslog
 		tcpDialFunc = func(ctx context.Context, addr string) (net.Conn, error) {
 			return proxy.AwareDialContextTLS(ctx, addr, tlsConfig)
 		}
diff --git a/compliance/node/index/indexer.go b/compliance/node/index/indexer.go
index 0ec5bb213dcc7..e790c7803a3a1 100644
--- a/compliance/node/index/indexer.go
+++ b/compliance/node/index/indexer.go
@@ -88,7 +88,7 @@ func getDefaultClient() (*http.Client, error) {
 		}
 		defaultClient = &http.Client{
 			Transport: &http.Transport{
-				TLSClientConfig: &tls.Config{
+				TLSClientConfig: &tls.Config{ //nolint:gosec // G402: in-cluster communication with mTLS certificates
 					// TODO: Should this always be set to true...?
 					InsecureSkipVerify: true,
 					Certificates:       []tls.Certificate{clientCert},
diff --git a/compliance/node/index/indexer_test.go b/compliance/node/index/indexer_test.go
index 0779798f33999..d039bd6746752 100644
--- a/compliance/node/index/indexer_test.go
+++ b/compliance/node/index/indexer_test.go
@@ -72,6 +72,7 @@ func (s *nodeIndexerSuite) createTestServer(tlsEnabled bool) *httptest.Server {
 			Certificates: []tls.Certificate{serverCert},
 			ClientAuth:   tls.RequireAndVerifyClientCert,
 			ClientCAs:    caCertPool,
+			MinVersion:   tls.VersionTLS12,
 		}
 		server.StartTLS()
 	}
diff --git a/pkg/auth/authproviders/idputil/http_clients.go b/pkg/auth/authproviders/idputil/http_clients.go
index c4ba63bd037dc..84a454a6ac5d2 100644
--- a/pkg/auth/authproviders/idputil/http_clients.go
+++ b/pkg/auth/authproviders/idputil/http_clients.go
@@ -30,7 +30,7 @@ func NewHTTPClient() *http.Client {
 func NewInsecureHTTPClient() *http.Client {
 	return &http.Client{
 		Transport: proxy.RoundTripper(
-			proxy.WithTLSConfig(&tls.Config{InsecureSkipVerify: true}),
+			proxy.WithTLSConfig(&tls.Config{InsecureSkipVerify: true}), //#nosec G402 -- intentional for IdP URLs with +insecure scheme suffix
 		),
 		Timeout: defaultTimeout,
 	}
diff --git a/pkg/auth/authproviders/openshift/internal/dexconnector/openshift.go b/pkg/auth/authproviders/openshift/internal/dexconnector/openshift.go
index 65f3983e38be8..c3b744b6c5a33 100644
--- a/pkg/auth/authproviders/openshift/internal/dexconnector/openshift.go
+++ b/pkg/auth/authproviders/openshift/internal/dexconnector/openshift.go
@@ -163,7 +163,7 @@ func (c *openshiftConnector) validateOAuth2Endpoints(trustedCertPool *x509.CertP
 		return errors.Wrap(err, "creating unique endpoints")
 	}
 
-	tlsConfig := &tls.Config{RootCAs: trustedCertPool}
+	tlsConfig := &tls.Config{RootCAs: trustedCertPool, MinVersion: tls.VersionTLS12}
 
 	for _, endpoint := range endpoints {
 		if err := validateEndpoint(endpoint, tlsConfig); err != nil {
@@ -332,7 +332,7 @@ func (c *openshiftConnector) user(ctx context.Context, client *http.Client) (u u
 func newHTTPClient(certPool *x509.CertPool) (*http.Client, error) {
 	return &http.Client{
 		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{RootCAs: certPool},
+			TLSClientConfig: &tls.Config{RootCAs: certPool, MinVersion: tls.VersionTLS12},
 			Proxy:           proxy.FromConfig(),
 			DialContext: (&net.Dialer{
 				Timeout:   30 * time.Second,
diff --git a/pkg/clientconn/client.go b/pkg/clientconn/client.go
index abb0edc7b558d..912ccaff580a9 100644
--- a/pkg/clientconn/client.go
+++ b/pkg/clientconn/client.go
@@ -116,6 +116,7 @@ func TLSConfig(server mtls.Subject, opts TLSConfigOptions) (*tls.Config, error)
 		ServerName: serverName,
 		NextProtos: nextProtos,
 		RootCAs:    opts.RootCAs,
+		MinVersion: tls.VersionTLS12,
 	}
 
 	if opts.UseClientCert != DontUseClientCert {
diff --git a/pkg/grpc/endpoints_test.go b/pkg/grpc/endpoints_test.go
index 6015eb660c03a..d051f1502545d 100644
--- a/pkg/grpc/endpoints_test.go
+++ b/pkg/grpc/endpoints_test.go
@@ -71,6 +71,7 @@ func (s *misdirectedRequestSuite) SetupSuite() {
 	cert := testutils.IssueSelfSignedCert(s.T(), "*.example.com", "*.example.com")
 	tlsConfig := &tls.Config{
 		Certificates: []tls.Certificate{cert},
+		MinVersion:   tls.VersionTLS12,
 	}
 	s.tlsConfigurer = verifier.TLSConfigurerFunc(func() (*tls.Config, error) {
 		return tlsConfig, nil
@@ -216,7 +217,7 @@ func (s *misdirectedRequestSuite) TestAll() {
 }
 
 func makeRequestWithSNI(t *testing.T, endpoint net.Addr, targetURL, serverName string, useHTTP2 bool) *http.Response {
-	tlsConfig := &tls.Config{
+	tlsConfig := &tls.Config{ //#nosec G402 -- test code
 		InsecureSkipVerify: true,
 		ServerName:         serverName,
 	}
diff --git a/pkg/grpc/marshaler_test.go b/pkg/grpc/marshaler_test.go
index a81d6924a3660..3aa412a2a9c94 100644
--- a/pkg/grpc/marshaler_test.go
+++ b/pkg/grpc/marshaler_test.go
@@ -63,7 +63,7 @@ func (s *supressCveServiceTestErrorImpl) SuppressCVEs(_ context.Context, req *v1
 func (a *MarshalerTest) TestDurationParsing() {
 	testPort := testutils.GetFreeTestPort()
 	url := fmt.Sprintf("https://localhost:%d/v1/nodecves/suppress", testPort)
-	http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
+	http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{InsecureSkipVerify: true} //#nosec G402 -- test code
 
 	api := newAPIForTest(a.T(), defaultConf(testPort))
 	grpcServiceHandler := &supressCveServiceTestErrorImpl{}
diff --git a/pkg/grpc/requestinfo/requestinfo_test.go b/pkg/grpc/requestinfo/requestinfo_test.go
index de81eb26d14ba..eea62f1624e8f 100644
--- a/pkg/grpc/requestinfo/requestinfo_test.go
+++ b/pkg/grpc/requestinfo/requestinfo_test.go
@@ -23,7 +23,7 @@ import (
 	"google.golang.org/grpc/peer"
 )
 
-var insecureTLSConfig = &tls.Config{InsecureSkipVerify: true}
+var insecureTLSConfig = &tls.Config{InsecureSkipVerify: true} //#nosec G402 -- test code
 var insecureSkipVerify = credentials.NewTLS(insecureTLSConfig)
 
 const userAgentKey = "User-Agent"
@@ -90,7 +90,7 @@ func Test_gRPCGateway(t *testing.T) {
 	serviceInstance := &pingService{}
 
 	cert := testutils.IssueSelfSignedCert(t, "*.example.com", "*.example.com")
-	creds := credentials.NewTLS(&tls.Config{
+	creds := credentials.NewTLS(&tls.Config{ //#nosec G402 -- test code
 		InsecureSkipVerify: true,
 		Certificates:       []tls.Certificate{cert},
 	})
diff --git a/pkg/grpc/server_ratelimit_test.go b/pkg/grpc/server_ratelimit_test.go
index 7b2f1b6e2631a..b45d57a338fb4 100644
--- a/pkg/grpc/server_ratelimit_test.go
+++ b/pkg/grpc/server_ratelimit_test.go
@@ -57,7 +57,7 @@ func (s *pingServiceTestImpl) Ping(context.Context, *v1.Empty) (*v1.PongMessage,
 }
 
 func (a *APIServerSuite) Test_Server_RateLimit_HTTP_Integration() {
-	http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
+	http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{InsecureSkipVerify: true} //#nosec G402 -- test code
 
 	tests := []struct {
 		name       string
diff --git a/pkg/grpc/server_test.go b/pkg/grpc/server_test.go
index 08042b12e54fe..46c79b2941d02 100644
--- a/pkg/grpc/server_test.go
+++ b/pkg/grpc/server_test.go
@@ -115,7 +115,7 @@ func (a *APIServerSuite) Test_TwoTestsStartingAPIs() {
 }
 
 func (a *APIServerSuite) Test_CustomAPI() {
-	http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
+	http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{InsecureSkipVerify: true} //#nosec G402 -- test code
 
 	a.Run("fetch data from /test", func() {
 		testPort := testutils.GetFreeTestPort()
@@ -236,7 +236,7 @@ func (a *APIServerSuite) Test_GRPC_Server_Error_Response() {
 	url := fmt.Sprintf("https://localhost:%d/v1/ping", testPort)
 	jsonPayload := `{"code":3, "details":[], "error":"missing argument: invalid arguments", "message":"missing argument: invalid arguments"}`
 
-	http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
+	http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{InsecureSkipVerify: true} //#nosec G402 -- test code
 
 	api := newAPIForTest(a.T(), defaultConf(testPort))
 	grpcServiceHandler := &pingServiceTestErrorImpl{}
diff --git a/pkg/httputil/proxy/connect.go b/pkg/httputil/proxy/connect.go
index 7dacfa39772f6..24286d2eab763 100644
--- a/pkg/httputil/proxy/connect.go
+++ b/pkg/httputil/proxy/connect.go
@@ -72,7 +72,7 @@ func dialWithConnectProxy(ctx context.Context, proxyURL *url.URL, address string
 	}()
 
 	if proxyURL.Scheme == "https" {
-		rawConn = tls.Client(rawConn, &tls.Config{})
+		rawConn = tls.Client(rawConn, &tls.Config{MinVersion: tls.VersionTLS12})
 	}
 
 	// Note: the URL in the next line only matters for making sure we sent a correct `Host:` header.
diff --git a/pkg/httputil/proxy/proxy.go b/pkg/httputil/proxy/proxy.go
index 13d32afc27442..9ff1f150a0c9c 100644
--- a/pkg/httputil/proxy/proxy.go
+++ b/pkg/httputil/proxy/proxy.go
@@ -149,6 +149,7 @@ func AwareDialContextTLS(ctx context.Context, address string, tlsClientConf *tls
 	if tlsClientConf == nil {
 		tlsClientConf = &tls.Config{
 			ServerName: host,
+			MinVersion: tls.VersionTLS12,
 		}
 	} else if tlsClientConf.ServerName == "" {
 		tlsClientConf = tlsClientConf.Clone()
diff --git a/pkg/metrics/server_test.go b/pkg/metrics/server_test.go
index 95a9cb3586fe5..b6a7051f8f569 100644
--- a/pkg/metrics/server_test.go
+++ b/pkg/metrics/server_test.go
@@ -173,6 +173,7 @@ func fakeTLSConfig() (*tls.Config, error) {
 		Certificates: []tls.Certificate{cert},
 		ClientAuth:   tls.RequireAndVerifyClientCert,
 		ClientCAs:    certPool,
+		MinVersion:   tls.VersionTLS12,
 	}
 	return tlsConfig, nil
 }
@@ -184,7 +185,7 @@ func testClient() (*http.Client, error) {
 	}
 
 	tr := &http.Transport{
-		TLSClientConfig: &tls.Config{
+		TLSClientConfig: &tls.Config{ //#nosec G402 -- test code with self-signed certs
 			Certificates: []tls.Certificate{cert},
 			// We are using a self-signed certificate for testing.
 			InsecureSkipVerify: true,
diff --git a/pkg/metrics/verifier_test.go b/pkg/metrics/verifier_test.go
index caa8e24026997..a52ff43bdcc27 100644
--- a/pkg/metrics/verifier_test.go
+++ b/pkg/metrics/verifier_test.go
@@ -57,7 +57,7 @@ func TestClientCertVerifier(t *testing.T) {
 			tlsVerifier := &clientCertVerifier{
 				subjectCN: c.subjectCN,
 			}
-			tlsConfig := &tls.Config{ClientCAs: caPool}
+			tlsConfig := &tls.Config{ClientCAs: caPool, MinVersion: tls.VersionTLS12}
 			err = tlsVerifier.VerifyPeerCertificate(certs[0], nil, tlsConfig)
 
 			if c.isError {
diff --git a/pkg/mtls/verifier/verify.go b/pkg/mtls/verifier/verify.go
index 51f1cd52d412b..e9e962e6f54ba 100644
--- a/pkg/mtls/verifier/verify.go
+++ b/pkg/mtls/verifier/verify.go
@@ -87,7 +87,7 @@ func (NonCA) TLSConfig() (*tls.Config, error) {
 // When these are unset the compiled-in defaults are used (TLS 1.2 with
 // AES-256-GCM preferred over AES-128-GCM).
 func DefaultTLSServerConfig(certPool *x509.CertPool, certs []tls.Certificate) *tls.Config {
-	cfg := &tls.Config{
+	cfg := &tls.Config{ //nolint:gosec // G402: MinVersion governed by TLS profile configuration
 		MinVersion:               tlsprofile.MinVersion(),
 		PreferServerCipherSuites: true,
 		CipherSuites:             tlsprofile.CipherSuites(),
diff --git a/pkg/registries/docker/config.go b/pkg/registries/docker/config.go
index ec0376c37ad71..58b8a0d9ad69c 100644
--- a/pkg/registries/docker/config.go
+++ b/pkg/registries/docker/config.go
@@ -79,7 +79,7 @@ func DefaultTransport(cfg *Config) registry.Transport {
 	)
 	if cfg.Insecure {
 		transport = proxy.RoundTripper(
-			proxy.WithTLSConfig(&tls.Config{InsecureSkipVerify: true}),
+			proxy.WithTLSConfig(&tls.Config{InsecureSkipVerify: true}), //#nosec G402 -- InsecureSkipVerify is user-configurable for registry
 			proxy.WithDialTimeout(env.RegistryDialerTimeout.DurationSetting()),
 			proxy.WithResponseHeaderTimeout(env.RegistryResponseTimeout.DurationSetting()),
 		)
diff --git a/pkg/registries/docker/docker.go b/pkg/registries/docker/docker.go
index 9340dc469afd8..b77a0e82fc186 100644
--- a/pkg/registries/docker/docker.go
+++ b/pkg/registries/docker/docker.go
@@ -272,7 +272,7 @@ func (r *Registry) buildTransport() http.RoundTripper {
 	)
 	if r.cfg.Insecure {
 		transport = proxy.RoundTripper(
-			proxy.WithTLSConfig(&tls.Config{InsecureSkipVerify: true}),
+			proxy.WithTLSConfig(&tls.Config{InsecureSkipVerify: true}), //#nosec G402 -- InsecureSkipVerify is user-configurable for registry
 			proxy.WithDialTimeout(env.RegistryDialerTimeout.DurationSetting()),
 			proxy.WithResponseHeaderTimeout(env.RegistryResponseTimeout.DurationSetting()),
 		)
diff --git a/pkg/scanners/clair/clair.go b/pkg/scanners/clair/clair.go
index 3eae36c90faec..4d80e96a927ca 100644
--- a/pkg/scanners/clair/clair.go
+++ b/pkg/scanners/clair/clair.go
@@ -67,7 +67,7 @@ func newScanner(integration *storage.ImageIntegration) (*clair, error) {
 	client := &http.Client{
 		Timeout: requestTimeout,
 		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{
+			TLSClientConfig: &tls.Config{ //nolint:gosec // G402: InsecureSkipVerify is user-configurable for Clair scanner
 				InsecureSkipVerify: config.GetInsecure(),
 			},
 			Proxy: proxy.FromConfig(),
diff --git a/pkg/scanners/clairv4/clairv4.go b/pkg/scanners/clairv4/clairv4.go
index a747045127571..c5054e8b4a198 100644
--- a/pkg/scanners/clairv4/clairv4.go
+++ b/pkg/scanners/clairv4/clairv4.go
@@ -75,7 +75,7 @@ func newScanner(integration *storage.ImageIntegration, activeRegistries registri
 		// No need to specify a context for HTTP requests, as the client specifies a request timeout.
 		Timeout: requestTimeout,
 		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{
+			TLSClientConfig: &tls.Config{ //nolint:gosec // G402: InsecureSkipVerify is user-configurable for ClairV4 scanner
 				InsecureSkipVerify: cfg.GetInsecure(),
 			},
 			Proxy: proxy.FromConfig(),
diff --git a/pkg/scanners/quay/quay.go b/pkg/scanners/quay/quay.go
index ac690237ce5fb..b652b93c215f5 100644
--- a/pkg/scanners/quay/quay.go
+++ b/pkg/scanners/quay/quay.go
@@ -61,7 +61,7 @@ func newScanner(protoImageIntegration *storage.ImageIntegration) (*quay, error)
 	client := &http.Client{
 		Timeout: requestTimeout,
 		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{
+			TLSClientConfig: &tls.Config{ //nolint:gosec // G402: InsecureSkipVerify is user-configurable for Quay scanner
 				InsecureSkipVerify: config.GetInsecure(),
 			},
 			Proxy: proxy.FromConfig(),
diff --git a/pkg/signatures/cosign_sig_fetcher.go b/pkg/signatures/cosign_sig_fetcher.go
index bf72a1942b6e8..7e0cad34818fc 100644
--- a/pkg/signatures/cosign_sig_fetcher.go
+++ b/pkg/signatures/cosign_sig_fetcher.go
@@ -49,7 +49,7 @@ var insecureDefaultTransport *http.Transport
 
 func init() {
 	insecureDefaultTransport = gcrRemote.DefaultTransport.(*http.Transport).Clone()
-	insecureDefaultTransport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
+	insecureDefaultTransport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} //#nosec G402 -- intentional for insecure registry connections
 }
 
 // FetchSignatures implements the SignatureFetcher interface.
diff --git a/pkg/testutils/centralgrpc/connect_to_central.go b/pkg/testutils/centralgrpc/connect_to_central.go
index 5e21d33475116..479f2705699a8 100644
--- a/pkg/testutils/centralgrpc/connect_to_central.go
+++ b/pkg/testutils/centralgrpc/connect_to_central.go
@@ -190,7 +190,7 @@ func grpcConnectionToCentral(t testutils.T, optsFuncs ...func(options *clientcon
 // the hostname and scheme part of the URL may be omitted.
 func HTTPClientForCentral(t testutils.T) *http.Client {
 	baseTransport := &http.Transport{
-		TLSClientConfig: &tls.Config{
+		TLSClientConfig: &tls.Config{ //nolint:gosec // G402: test helper, skip TLS verification
 			InsecureSkipVerify: true,
 		},
 	}
diff --git a/pkg/tlsutils/dial_context_test.go b/pkg/tlsutils/dial_context_test.go
index 5da172dd7de0e..eab81b2400f44 100644
--- a/pkg/tlsutils/dial_context_test.go
+++ b/pkg/tlsutils/dial_context_test.go
@@ -25,7 +25,7 @@ func TestDialContextError(t *testing.T) {
 				InnerLogger: zap.New(observedZapCore).Sugar(),
 			}
 
-			_, err := DialContext(context.Background(), "tcp", dialAddr, &tls.Config{})
+			_, err := DialContext(context.Background(), "tcp", dialAddr, &tls.Config{MinVersion: tls.VersionTLS12})
 
 			assert.NotContains(t, err.Error(), "127.0.0.1")
 			assert.NotContains(t, err.Error(), "10001")
diff --git a/roxctl/central/cert/cert.go b/roxctl/central/cert/cert.go
index b1607455192b2..6f30f4545dfc7 100644
--- a/roxctl/central/cert/cert.go
+++ b/roxctl/central/cert/cert.go
@@ -66,7 +66,7 @@ func (cmd *centralCertCommand) certs() error {
 
 	// Connect to the given server. We're not expecting the endpoint be
 	// trusted, but force the user to use insecure mode if needed.
-	config := tls.Config{
+	config := tls.Config{ //nolint:gosec // G402: InsecureSkipVerify is user-configurable
 		InsecureSkipVerify: skipTLSValidation(),
 		ServerName:         serverName,
 	}
diff --git a/scale/tests/utils_test.go b/scale/tests/utils_test.go
index 2d872fbfa1d53..6b1ae3e845d24 100644
--- a/scale/tests/utils_test.go
+++ b/scale/tests/utils_test.go
@@ -59,7 +59,7 @@ func asyncWithWaitGroup(function func() error, wg *concurrency.WaitGroup) {
 func getHTTPClient() *http.Client {
 	return &http.Client{
 		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{
+			TLSClientConfig: &tls.Config{ //#nosec G402 -- test code
 				InsecureSkipVerify: true,
 			},
 		},
diff --git a/scanner/cmd/scannerctl/scale.go b/scanner/cmd/scannerctl/scale.go
index a331833f77670..ce44e72e3554b 100644
--- a/scanner/cmd/scannerctl/scale.go
+++ b/scanner/cmd/scannerctl/scale.go
@@ -209,7 +209,7 @@ func scaleCmd(ctx context.Context) *cobra.Command {
 
 		httpClient := &http.Client{
 			Transport: &http.Transport{
-				TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+				TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //#nosec G402 -- scale testing tool, not production code
 			},
 		}
 
diff --git a/scanner/indexer/indexer.go b/scanner/indexer/indexer.go
index 1294b39866e07..36376190252af 100644
--- a/scanner/indexer/indexer.go
+++ b/scanner/indexer/indexer.go
@@ -126,9 +126,9 @@ func proxiedRemoteTransport(insecure bool) http.RoundTripper {
 	}()
 	if insecure {
 		if tr.TLSClientConfig == nil {
-			tr.TLSClientConfig = &tls.Config{}
+			tr.TLSClientConfig = &tls.Config{MinVersion: tls.VersionTLS12}
 		}
-		tr.TLSClientConfig.InsecureSkipVerify = true
+		tr.TLSClientConfig.InsecureSkipVerify = true //#nosec G402 -- intentional for insecure registry connections
 	}
 	return tr
 }
diff --git a/scanner/internal/httputil/transport.go b/scanner/internal/httputil/transport.go
index c7ac0685dd173..23410dd0c0c4d 100644
--- a/scanner/internal/httputil/transport.go
+++ b/scanner/internal/httputil/transport.go
@@ -27,9 +27,9 @@ type insecureCapableTransport struct {
 func NewInsecureCapableTransport(transport *http.Transport) http.RoundTripper {
 	insecure := transport.Clone()
 	if insecure.TLSClientConfig == nil {
-		insecure.TLSClientConfig = &tls.Config{}
+		insecure.TLSClientConfig = &tls.Config{MinVersion: tls.VersionTLS12}
 	}
-	insecure.TLSClientConfig.InsecureSkipVerify = true
+	insecure.TLSClientConfig.InsecureSkipVerify = true //#nosec G402 -- intentional for insecure-capable transport
 
 	return &insecureCapableTransport{
 		transport:         transport,
diff --git a/sensor/common/centralclient/client.go b/sensor/common/centralclient/client.go
index f7afe23139f01..f36f82428589f 100644
--- a/sensor/common/centralclient/client.go
+++ b/sensor/common/centralclient/client.go
@@ -82,7 +82,7 @@ func NewClient(endpoint string) (*Client, error) {
 	if err != nil {
 		return nil, errors.Wrap(err, "obtaining client certificate")
 	}
-	tlsConf := &tls.Config{
+	tlsConf := &tls.Config{ //nolint:gosec // G402: Sensor-to-Central uses mTLS, hostname verification unnecessary
 		InsecureSkipVerify: true,
 		Certificates: []tls.Certificate{
 			clientCert,
diff --git a/sensor/common/centralclient/client_test.go b/sensor/common/centralclient/client_test.go
index 89d25c0686e45..613ae5c99fc92 100644
--- a/sensor/common/centralclient/client_test.go
+++ b/sensor/common/centralclient/client_test.go
@@ -170,6 +170,7 @@ func (t *ClientTestSuite) TestGetTLSTrustedCerts_ErrorHandling() {
 			if testCase.ServerTLSCertificate != nil {
 				ts.TLS = &tls.Config{
 					Certificates: []tls.Certificate{*testCase.ServerTLSCertificate},
+					MinVersion:   tls.VersionTLS12,
 				}
 			}
 
@@ -212,6 +213,7 @@ func (t *ClientTestSuite) TestGetTLSTrustedCerts_GetCertificate() {
 
 	ts.TLS = &tls.Config{
 		Certificates: []tls.Certificate{*t.newSelfSignedCertificate("StackRox Certificate Authority")},
+		MinVersion:   tls.VersionTLS12,
 	}
 
 	ts.StartTLS()
@@ -410,7 +412,7 @@ func (t *ClientTestSuite) TestGetTLSTrustedCerts_SecondaryCA() {
 				})
 			}))
 
-			ts.TLS = &tls.Config{Certificates: []tls.Certificate{*primaryCA}}
+			ts.TLS = &tls.Config{Certificates: []tls.Certificate{*primaryCA}, MinVersion: tls.VersionTLS12}
 			ts.StartTLS()
 			defer ts.Close()
 
diff --git a/sensor/tests/helper/http.go b/sensor/tests/helper/http.go
index 969f3b9517d94..b37f4c8d3bd7b 100644
--- a/sensor/tests/helper/http.go
+++ b/sensor/tests/helper/http.go
@@ -32,6 +32,7 @@ func NewCentralHTTPTestServer(t *testing.T) *httptest.Server {
 	server := httptest.NewUnstartedServer(handler)
 	server.TLS = &tls.Config{
 		Certificates: []tls.Certificate{issuedCertToTLSCertificate(t, serverCert)},
+		MinVersion:   tls.VersionTLS12,
 	}
 	server.StartTLS()
 	return server
@@ -61,7 +62,7 @@ func NewHTTPTestClient(t *testing.T, serviceType storage.ServiceType) *http.Clie
 	clientCert := issuedCertToTLSCertificate(t, issuedCert)
 
 	transport := &http.Transport{
-		TLSClientConfig: &tls.Config{
+		TLSClientConfig: &tls.Config{ //nolint:gosec // G402: test helper, skip TLS verification
 			InsecureSkipVerify: true,
 			Certificates:       []tls.Certificate{clientCert},
 		},
diff --git a/tests/cert_test.go b/tests/cert_test.go
index 9b87f905bb677..095682e0ca847 100644
--- a/tests/cert_test.go
+++ b/tests/cert_test.go
@@ -17,7 +17,7 @@ import (
 
 func TestInternalCert(t *testing.T) {
 
-	tlsConf := &tls.Config{
+	tlsConf := &tls.Config{ //#nosec G402 -- test code
 		InsecureSkipVerify: true,
 		ServerName:         "central.stackrox",
 	}
@@ -51,6 +51,7 @@ func TestCustomCert(t *testing.T) {
 		InsecureSkipVerify: false,
 		ServerName:         centralCN,
 		RootCAs:            trustPool,
+		MinVersion:         tls.VersionTLS12,
 	}
 
 	conn, err := tls.Dial("tcp", centralgrpc.RoxAPIEndpoint(t), tlsConf)
diff --git a/tests/client_ca_test.go b/tests/client_ca_test.go
index 7b2c1c4a1a0c1..852978c7bb271 100644
--- a/tests/client_ca_test.go
+++ b/tests/client_ca_test.go
@@ -127,7 +127,7 @@ func tlsConfWithCertChain(leafKey crypto.PrivateKey, leafCert *x509.Certificate,
 		certChain = append(certChain, cert.Raw)
 	}
 
-	return &tls.Config{
+	return &tls.Config{ //#nosec G402 -- test code
 		InsecureSkipVerify: true,
 		Certificates:       []tls.Certificate{{Certificate: certChain, PrivateKey: leafKey}},
 	}
@@ -195,7 +195,7 @@ func TestClientCAAuthWithMultipleVerifiedChains(t *testing.T) {
 	token := getTokenForUserPKIAuthProvider(t, createdAuthProvider.GetId(), tlsConfWithLeaf)
 
 	// If only token is passed but with no client certs, we expect an error.
-	_, err = getAuthStatus(t, &tls.Config{InsecureSkipVerify: true}, token)
+	_, err = getAuthStatus(t, &tls.Config{InsecureSkipVerify: true}, token) //#nosec G402 -- test code
 	assert.Error(t, err)
 
 	// Token plus other, non-matching cert => should error.
@@ -227,7 +227,7 @@ func TestClientCARequested(t *testing.T) {
 	require.NoError(t, err, "Could not parse client CA PEM data")
 
 	var acceptableCAs [][]byte
-	tlsConf := &tls.Config{
+	tlsConf := &tls.Config{ //#nosec G402 -- test code
 		InsecureSkipVerify: true,
 		ServerName:         "central.stackrox",
 		GetClientCertificate: func(cri *tls.CertificateRequestInfo) (*tls.Certificate, error) {
diff --git a/tests/endpoints_test.go b/tests/endpoints_test.go
index e98b7dd05c514..958e1ae7c72ed 100644
--- a/tests/endpoints_test.go
+++ b/tests/endpoints_test.go
@@ -79,7 +79,8 @@ type endpointsTestContext struct {
 
 func (c *endpointsTestContext) tlsConfig(clientCert *tls.Certificate, serverName string, useSNI bool) *tls.Config {
 	tlsConf := &tls.Config{
-		RootCAs: c.certPool,
+		RootCAs:    c.certPool,
+		MinVersion: tls.VersionTLS12,
 	}
 	if clientCert != nil {
 		tlsConf.Certificates = []tls.Certificate{*clientCert}