diff --git a/control/beaconing/propagator_test.go b/control/beaconing/propagator_test.go
index 86e557a4b6..2430157843 100644
--- a/control/beaconing/propagator_test.go
+++ b/control/beaconing/propagator_test.go
@@ -95,12 +95,12 @@ func TestPropagatorRunNonCore(t *testing.T) {
 		gomock.Any()).Times(1).DoAndReturn(
 
 		func(_ context.Context, _ addr.IA, egIfID uint16,
-			nextHop *net.UDPAddr) (beaconing.Sender, error) {
-
+			nextHop *net.UDPAddr,
+		) (beaconing.Sender, error) {
 			sender := mock_beaconing.NewMockSender(mctrl)
 			sender.EXPECT().Send(gomock.Any(), gomock.Any()).Times(3).DoAndReturn(
-				func(_ context.Context, b *seg.PathSegment) error {
-					validateSend(t, b, egIfID, nextHop, pub, topo)
+				func(ctx context.Context, b *seg.PathSegment) error {
+					validateSend(ctx, t, b, egIfID, nextHop, pub, topo)
 					return nil
 				},
 			)
@@ -167,12 +167,12 @@ func TestPropagatorRunCore(t *testing.T) {
 	senderFactory.EXPECT().NewSender(gomock.Any(), gomock.Any(), uint16(1121),
 		gomock.Any()).DoAndReturn(
 		func(_ context.Context, _ addr.IA, egIfID uint16,
-			nextHop *net.UDPAddr) (beaconing.Sender, error) {
-
+			nextHop *net.UDPAddr,
+		) (beaconing.Sender, error) {
 			sender := mock_beaconing.NewMockSender(mctrl)
 			sender.EXPECT().Send(gomock.Any(), gomock.Any()).Times(2).DoAndReturn(
-				func(_ context.Context, b *seg.PathSegment) error {
-					validateSend(t, b, egIfID, nextHop, pub, topo)
+				func(ctx context.Context, b *seg.PathSegment) error {
+					validateSend(ctx, t, b, egIfID, nextHop, pub, topo)
 					return nil
 				},
 			)
@@ -183,12 +183,12 @@ func TestPropagatorRunCore(t *testing.T) {
 	senderFactory.EXPECT().NewSender(gomock.Any(), gomock.Any(), uint16(1113),
 		gomock.Any()).DoAndReturn(
 		func(_ context.Context, _ addr.IA, egIfID uint16,
-			nextHop *net.UDPAddr) (beaconing.Sender, error) {
-
+			nextHop *net.UDPAddr,
+		) (beaconing.Sender, error) {
 			sender := mock_beaconing.NewMockSender(mctrl)
 			sender.EXPECT().Send(gomock.Any(), gomock.Any()).Times(1).DoAndReturn(
-				func(_ context.Context, b *seg.PathSegment) error {
-					validateSend(t, b, egIfID, nextHop, pub, topo)
+				func(ctx context.Context, b *seg.PathSegment) error {
+					validateSend(ctx, t, b, egIfID, nextHop, pub, topo)
 					return nil
 				},
 			)
@@ -275,6 +275,7 @@ func TestPropagatorFastRecovery(t *testing.T) {
 }
 
 func validateSend(
+	ctx context.Context,
 	t *testing.T,
 	b *seg.PathSegment,
 	egIfID uint16,
@@ -284,7 +285,7 @@ func validateSend(
 ) {
 	// Check the beacon is valid and verifiable.
 	assert.NoError(t, b.Validate(seg.ValidateBeacon))
-	assert.NoError(t, b.VerifyASEntry(context.Background(),
+	assert.NoError(t, b.VerifyASEntry(ctx,
 		segVerifier{pubKey: pub}, b.MaxIdx()))
 	// Extract the hop field from the current AS entry to compare.
 	hopF := b.ASEntries[b.MaxIdx()].HopEntry.HopField
diff --git a/control/cmd/control/main.go b/control/cmd/control/main.go
index 91713e8de1..e0197eb9c5 100644
--- a/control/cmd/control/main.go
+++ b/control/cmd/control/main.go
@@ -224,7 +224,7 @@ func realMain(ctx context.Context) error {
 		MTU:                    topo.MTU(),
 		Topology:               adaptTopology(topo),
 	}
-	quicStack, err := nc.QUICStack()
+	quicStack, err := nc.QUICStack(ctx)
 	if err != nil {
 		return serrors.Wrap("initializing QUIC stack", err)
 	}
@@ -393,10 +393,11 @@ func realMain(ctx context.Context) error {
 			},
 			Registrations: libmetrics.NewPromCounter(metrics.SegmentRegistrationsTotal),
 		})
-
 	}
 
-	signer := cs.NewSigner(topo.IA(), trustDB, globalCfg.General.ConfigDir)
+	ctx, cancel := context.WithTimeout(ctx, time.Second)
+	defer cancel()
+	signer := cs.NewSigner(ctx, topo.IA(), trustDB, globalCfg.General.ConfigDir)
 
 	var chainBuilder renewal.ChainBuilder
 	var caClient *caapi.Client
@@ -837,7 +838,6 @@ func createBeaconStore(
 	policyConfig config.Policies,
 	provider beacon.ChainProvider,
 ) (cs.Store, bool, error) {
-
 	if core {
 		policies, err := cs.LoadCorePolicies(policyConfig)
 		if err != nil {
@@ -967,7 +967,6 @@ func getCAHealth(
 	ctx context.Context,
 	caClient *caapi.Client,
 ) (api.CAHealthStatus, error) {
-
 	logger := log.FromCtx(ctx)
 	rep, err := caClient.GetHealthcheck(ctx)
 	if err != nil {
diff --git a/control/drkey/grpc/fetcher_test.go b/control/drkey/grpc/fetcher_test.go
index c440b1f59a..1cc3b380fd 100644
--- a/control/drkey/grpc/fetcher_test.go
+++ b/control/drkey/grpc/fetcher_test.go
@@ -63,7 +63,9 @@ func TestLevel1KeyFetching(t *testing.T) {
 	ctrl := gomock.NewController(t)
 
 	lvl1db := mock_grpc.NewMockEngine(ctrl)
-	lvl1db.EXPECT().DeriveLevel1(gomock.Any(), gomock.Any()).AnyTimes().Return(drkey.Level1Key{}, nil)
+	lvl1db.EXPECT().DeriveLevel1(gomock.Any(), gomock.Any()).
+		AnyTimes().
+		Return(drkey.Level1Key{}, nil)
 
 	db := mock_trust.NewMockDB(ctrl)
 	db.EXPECT().SignedTRC(gomock.Any(), gomock.Any()).AnyTimes().Return(trc, nil)
diff --git a/control/drkey/service_engine.go b/control/drkey/service_engine.go
index 084e641c54..511a7ddfeb 100644
--- a/control/drkey/service_engine.go
+++ b/control/drkey/service_engine.go
@@ -90,7 +90,9 @@ func (s *ServiceEngine) GetLevel1PrefetchInfo() []Level1PrefetchInfo {
 }
 
 // DeriveLevel1 returns a Level1 key based on the presented information.
-func (s *ServiceEngine) DeriveLevel1(ctx context.Context, meta drkey.Level1Meta) (drkey.Level1Key, error) {
+func (s *ServiceEngine) DeriveLevel1(
+	ctx context.Context, meta drkey.Level1Meta,
+) (drkey.Level1Key, error) {
 	sv, err := s.GetSecretValue(ctx, drkey.SecretValueMeta{
 		ProtoId:  meta.ProtoId,
 		Validity: meta.Validity,
diff --git a/control/trust.go b/control/trust.go
index 6308d98832..b1ece4d657 100644
--- a/control/trust.go
+++ b/control/trust.go
@@ -78,13 +78,10 @@ func NewTLSCertificateLoader(
 }
 
 // NewSigner creates a renewing signer backed by a certificate chain.
-func NewSigner(ia addr.IA, db trust.DB, cfgDir string) cstrust.RenewingSigner {
+func NewSigner(ctx context.Context, ia addr.IA, db trust.DB, cfgDir string) cstrust.RenewingSigner {
 	signer := cstrust.RenewingSigner{
 		SignerGen: newCachingSignerGen(ia, x509.ExtKeyUsageAny, db, cfgDir),
 	}
-
-	ctx, cancelF := context.WithTimeout(context.Background(), time.Second)
-	defer cancelF()
 	if _, err := signer.SignerGen.Generate(ctx); err != nil {
 		log.Debug("Initial signer generation failed", "err", err)
 	}
diff --git a/control/trust_test.go b/control/trust_test.go
index b275bec011..88298b7c68 100644
--- a/control/trust_test.go
+++ b/control/trust_test.go
@@ -36,6 +36,7 @@ func TestNewSigner(t *testing.T) {
 	require.NoError(t, err)
 
 	signer := cs.NewSigner(
+		context.Background(),
 		addr.MustParseIA("1-ff00:0:110"),
 		db,
 		filepath.Join(dir, "/ISD1/ASff00_0_110"),
@@ -59,7 +60,7 @@ func testCrypto(t *testing.T) string {
 
 	raw, err := os.ReadFile(filepath.Join(dir, "trcs/ISD1-B1-S1.trc"))
 	require.NoError(t, err)
-	err = os.WriteFile(filepath.Join(dir, "ISD1/ASff00_0_110/certs/ISD1-B1-S1.trc"), raw, 0666)
+	err = os.WriteFile(filepath.Join(dir, "ISD1/ASff00_0_110/certs/ISD1-B1-S1.trc"), raw, 0o666)
 	require.NoError(t, err)
 	return dir
 }
diff --git a/daemon/internal/servers/grpc.go b/daemon/internal/servers/grpc.go
index 339edc77ac..3146cf2d22 100644
--- a/daemon/internal/servers/grpc.go
+++ b/daemon/internal/servers/grpc.go
@@ -71,8 +71,8 @@ type DaemonServer struct {
 
 // Paths serves the paths request.
 func (s *DaemonServer) Paths(ctx context.Context,
-	req *sdpb.PathsRequest) (*sdpb.PathsResponse, error) {
-
+	req *sdpb.PathsRequest,
+) (*sdpb.PathsResponse, error) {
 	start := time.Now()
 	dstI := addr.IA(req.DestinationIsdAs).ISD()
 	response, err := s.paths(ctx, req)
@@ -84,8 +84,8 @@ func (s *DaemonServer) Paths(ctx context.Context,
 }
 
 func (s *DaemonServer) paths(ctx context.Context,
-	req *sdpb.PathsRequest) (*sdpb.PathsResponse, error) {
-
+	req *sdpb.PathsRequest,
+) (*sdpb.PathsResponse, error) {
 	if _, ok := ctx.Deadline(); !ok {
 		var cancelF context.CancelFunc
 		ctx, cancelF = context.WithTimeout(ctx, 10*time.Second)
@@ -115,7 +115,6 @@ func (s *DaemonServer) fetchPaths(
 	src, dst addr.IA,
 	refresh bool,
 ) ([]snet.Path, error) {
-
 	r, err, _ := group.Do(fmt.Sprintf("%s%s%t", src, dst, refresh),
 		func() (any, error) {
 			return s.Fetcher.GetPaths(ctx, src, dst, refresh)
@@ -187,7 +186,6 @@ func pathToPB(path snet.Path) *sdpb.Path {
 		Notes:        meta.Notes,
 		EpicAuths:    epicAuths,
 	}
-
 }
 
 func linkTypeToPB(lt snet.LinkType) sdpb.LinkType {
@@ -210,7 +208,7 @@ func (s *DaemonServer) backgroundPaths(origCtx context.Context, src, dst addr.IA
 		// the original context is large enough no need to spin a background fetch.
 		return
 	}
-	ctx, cancelF := context.WithTimeout(context.Background(), backgroundTimeout)
+	ctx, cancelF := context.WithTimeout(origCtx, backgroundTimeout)
 	defer cancelF()
 	var spanOpts []opentracing.StartSpanOption
 	if span := opentracing.SpanFromContext(origCtx); span != nil {
@@ -259,8 +257,8 @@ func (s *DaemonServer) as(ctx context.Context, req *sdpb.ASRequest) (*sdpb.ASRes
 
 // Interfaces serves the interfaces request.
 func (s *DaemonServer) Interfaces(ctx context.Context,
-	req *sdpb.InterfacesRequest) (*sdpb.InterfacesResponse, error) {
-
+	req *sdpb.InterfacesRequest,
+) (*sdpb.InterfacesResponse, error) {
 	start := time.Now()
 	response, err := s.interfaces(ctx, req)
 	s.Metrics.InterfacesRequests.inc(
@@ -271,8 +269,8 @@ func (s *DaemonServer) Interfaces(ctx context.Context,
 }
 
 func (s *DaemonServer) interfaces(ctx context.Context,
-	_ *sdpb.InterfacesRequest) (*sdpb.InterfacesResponse, error) {
-
+	_ *sdpb.InterfacesRequest,
+) (*sdpb.InterfacesResponse, error) {
 	reply := &sdpb.InterfacesResponse{
 		Interfaces: make(map[uint64]*sdpb.Interface),
 	}
@@ -293,8 +291,8 @@ func (s *DaemonServer) interfaces(ctx context.Context,
 
 // Services serves the services request.
 func (s *DaemonServer) Services(ctx context.Context,
-	req *sdpb.ServicesRequest) (*sdpb.ServicesResponse, error) {
-
+	req *sdpb.ServicesRequest,
+) (*sdpb.ServicesResponse, error) {
 	start := time.Now()
 	respsonse, err := s.services(ctx, req)
 	s.Metrics.ServicesRequests.inc(
@@ -305,8 +303,8 @@ func (s *DaemonServer) Services(ctx context.Context,
 }
 
 func (s *DaemonServer) services(ctx context.Context,
-	_ *sdpb.ServicesRequest) (*sdpb.ServicesResponse, error) {
-
+	_ *sdpb.ServicesRequest,
+) (*sdpb.ServicesResponse, error) {
 	reply := &sdpb.ServicesResponse{
 		Services: make(map[string]*sdpb.ListService),
 	}
@@ -321,8 +319,8 @@ func (s *DaemonServer) services(ctx context.Context,
 
 // NotifyInterfaceDown notifies the server about an interface that is down.
 func (s *DaemonServer) NotifyInterfaceDown(ctx context.Context,
-	req *sdpb.NotifyInterfaceDownRequest) (*sdpb.NotifyInterfaceDownResponse, error) {
-
+	req *sdpb.NotifyInterfaceDownRequest,
+) (*sdpb.NotifyInterfaceDownResponse, error) {
 	start := time.Now()
 	response, err := s.notifyInterfaceDown(ctx, req)
 	s.Metrics.InterfaceDownNotifications.inc(
@@ -333,8 +331,8 @@ func (s *DaemonServer) NotifyInterfaceDown(ctx context.Context,
 }
 
 func (s *DaemonServer) notifyInterfaceDown(ctx context.Context,
-	req *sdpb.NotifyInterfaceDownRequest) (*sdpb.NotifyInterfaceDownResponse, error) {
-
+	req *sdpb.NotifyInterfaceDownRequest,
+) (*sdpb.NotifyInterfaceDownResponse, error) {
 	revInfo := &path_mgmt.RevInfo{
 		RawIsdas:     addr.IA(req.IsdAs),
 		IfID:         iface.ID(req.Id),
@@ -358,7 +356,6 @@ func (s *DaemonServer) PortRange(
 	_ context.Context,
 	_ *emptypb.Empty,
 ) (*sdpb.PortRangeResponse, error) {
-
 	startPort, endPort := s.Topology.PortRange()
 	return &sdpb.PortRangeResponse{
 		DispatchedPortStart: uint32(startPort),
@@ -370,7 +367,6 @@ func (s *DaemonServer) DRKeyASHost(
 	ctx context.Context,
 	req *pb_daemon.DRKeyASHostRequest,
 ) (*pb_daemon.DRKeyASHostResponse, error) {
-
 	if s.DRKeyClient == nil {
 		return nil, serrors.New("DRKey is not available")
 	}
@@ -395,7 +391,6 @@ func (s *DaemonServer) DRKeyHostAS(
 	ctx context.Context,
 	req *pb_daemon.DRKeyHostASRequest,
 ) (*pb_daemon.DRKeyHostASResponse, error) {
-
 	if s.DRKeyClient == nil {
 		return nil, serrors.New("DRKey is not available")
 	}
@@ -420,7 +415,6 @@ func (s *DaemonServer) DRKeyHostHost(
 	ctx context.Context,
 	req *pb_daemon.DRKeyHostHostRequest,
 ) (*pb_daemon.DRKeyHostHostResponse, error) {
-
 	if s.DRKeyClient == nil {
 		return nil, serrors.New("DRKey is not available")
 	}
diff --git a/gateway/gateway.go b/gateway/gateway.go
index 2f2233dfd6..0705a0753e 100644
--- a/gateway/gateway.go
+++ b/gateway/gateway.go
@@ -67,8 +67,8 @@ type DataplaneSessionFactory struct {
 }
 
 func (dpf DataplaneSessionFactory) New(id uint8, policyID int,
-	remoteIA addr.IA, remoteAddr net.Addr) control.DataplaneSession {
-
+	remoteIA addr.IA, remoteAddr net.Addr,
+) control.DataplaneSession {
 	conn, err := dpf.PacketConnFactory.New()
 	if err != nil {
 		panic(err)
@@ -113,7 +113,6 @@ type RoutingTableFactory struct {
 func (rtf RoutingTableFactory) New(
 	routingChains []*control.RoutingChain,
 ) (control.RoutingTable, error) {
-
 	return dataplane.NewRoutingTable(routingChains), nil
 }
 
@@ -284,9 +283,7 @@ func (g *Gateway) Run(ctx context.Context) error {
 
 	// periodically clean up the revocation store.
 	revCleaner := periodic.Start(periodic.Func{
-		Task: func(ctx context.Context) {
-			revStore.Cleanup(ctx)
-		},
+		Task:     revStore.Cleanup,
 		TaskName: "revocation_store_cleaner",
 	}, 30*time.Second, 30*time.Second)
 	defer revCleaner.Stop()
@@ -431,6 +428,7 @@ func (g *Gateway) Run(ctx context.Context) error {
 
 	// Initialize the UDP/SCION QUIC conn for outgoing Gateway Discovery RPCs and outgoing Prefix
 	// Fetching. Open up a random high port for this.
+	//nolint:contextcheck // Unclear whether ctx can be used here.
 	clientConn, err := scionNetworkNoSCMP.Listen(
 		context.TODO(),
 		"udp",
@@ -524,6 +522,7 @@ func (g *Gateway) Run(ctx context.Context) error {
 	}()
 	logger.Debug("Remote monitor started.")
 
+	//nolint:contextcheck // It's unclear whether ctx can be used here.
 	serverConn, err := scionNetworkNoSCMP.Listen(
 		context.TODO(),
 		"udp",
@@ -575,12 +574,13 @@ func (g *Gateway) Run(ctx context.Context) error {
 	// received from the session monitors of the remote gateway.
 	// *********************************************************************************
 
+	//nolint:contextcheck // It's not clear whether ctx can be used here.
 	probeConn, err := scionNetwork.Listen(context.TODO(), "udp", g.ProbeServerAddr)
 	if err != nil {
 		return serrors.Wrap("creating server probe conn", err)
 	}
 	probeServer := controlgrpc.ProbeDispatcher{}
-	probeServerCtx, probeServerCancel := context.WithCancel(context.Background())
+	probeServerCtx, probeServerCancel := context.WithCancel(ctx)
 	defer probeServerCancel()
 	go func() {
 		defer log.HandlePanic()
@@ -592,7 +592,6 @@ func (g *Gateway) Run(ctx context.Context) error {
 	// Start dataplane ingress
 	if err := StartIngress(ctx, scionNetwork, g.DataServerAddr, deviceManager,
 		g.Metrics); err != nil {
-
 		return err
 	}
 	logger.Debug("Ingress started")
@@ -700,7 +699,6 @@ func (g *Gateway) diagnosticsSGRP(
 	routePublisherFactory control.PublisherFactory,
 	pub *control.ConfigPublisher,
 ) http.HandlerFunc {
-
 	return func(w http.ResponseWriter, _ *http.Request) {
 		var d struct {
 			Advertise struct {
@@ -766,9 +764,10 @@ func CreateIngressMetrics(m *Metrics) dataplane.IngressMetrics {
 }
 
 func StartIngress(ctx context.Context, scionNetwork *snet.SCIONNetwork, dataAddr *net.UDPAddr,
-	deviceManager control.DeviceManager, metrics *Metrics) error {
-
+	deviceManager control.DeviceManager, metrics *Metrics,
+) error {
 	logger := log.FromCtx(ctx)
+	//nolint:contextcheck // Unclear whether ctx can be used here.
 	dataplaneServerConn, err := scionNetwork.Listen(
 		context.TODO(),
 		"udp",
@@ -856,8 +855,8 @@ func createRouterMetrics(m *Metrics) control.RouterMetrics {
 }
 
 func createRouteManager(ctx context.Context,
-	deviceManager control.DeviceManager) control.PublisherFactory {
-
+	deviceManager control.DeviceManager,
+) control.PublisherFactory {
 	linux := &routemgr.Linux{DeviceManager: deviceManager}
 	go func() {
 		defer log.HandlePanic()
diff --git a/gateway/pathhealth/monitor.go b/gateway/pathhealth/monitor.go
index bf75341618..158db58bb2 100644
--- a/gateway/pathhealth/monitor.go
+++ b/gateway/pathhealth/monitor.go
@@ -63,6 +63,8 @@ type Monitor struct {
 }
 
 // Register starts monitoring given AS under the specified selector.
+//
+//nolint:contextcheck // Internal context is only used for remoteWatcherItem
 func (m *Monitor) Register(remote addr.IA, selector PathSelector) *Registration {
 	m.mtx.Lock()
 	defer m.mtx.Unlock()
@@ -73,6 +75,7 @@ func (m *Monitor) Register(remote addr.IA, selector PathSelector) *Registration
 	// Otherwise, increase its reference count.
 	item := m.remoteWatchers[remote]
 	if item == nil {
+		//nolint:contextcheck
 		ctx, cancel := context.WithCancel(context.Background())
 		item = &remoteWatcherItem{
 			RemoteWatcher: m.RemoteWatcherFactory.New(remote),
diff --git a/gateway/pathmonitor.go b/gateway/pathmonitor.go
index 4c7b66166a..b3e2cf504b 100644
--- a/gateway/pathmonitor.go
+++ b/gateway/pathmonitor.go
@@ -37,7 +37,6 @@ func (pm *PathMonitor) Register(
 	policies *policies.Policies,
 	policyID string,
 ) control.PathMonitorRegistration {
-
 	reg := pm.Monitor.Register(remote, &pathhealth.FilteringPathSelector{
 		PathPolicy:      policies.PathPolicy,
 		PathCount:       policies.PathCount,
diff --git a/private/app/appnet/infraenv.go b/private/app/appnet/infraenv.go
index 5531fa8291..e196e77a47 100644
--- a/private/app/appnet/infraenv.go
+++ b/private/app/appnet/infraenv.go
@@ -93,9 +93,8 @@ func (nc *NetworkConfig) TCPStack() (net.Listener, error) {
 	})
 }
 
-func (nc *NetworkConfig) QUICStack() (*QUICStack, error) {
-
-	client, server, err := nc.initQUICSockets()
+func (nc *NetworkConfig) QUICStack(ctx context.Context) (*QUICStack, error) {
+	client, server, err := nc.initQUICSockets(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -208,7 +207,9 @@ func (nc *NetworkConfig) AddressRewriter() *AddressRewriter {
 	}
 }
 
-func (nc *NetworkConfig) initQUICSockets() (net.PacketConn, net.PacketConn, error) {
+func (nc *NetworkConfig) initQUICSockets(
+	ctx context.Context,
+) (net.PacketConn, net.PacketConn, error) {
 	reply := &svc.Reply{
 		Transports: map[svc.Transport]string{
 			svc.QUIC: nc.Public.String(),
@@ -228,7 +229,7 @@ func (nc *NetworkConfig) initQUICSockets() (net.PacketConn, net.PacketConn, erro
 		SCMPHandler:       ignoreSCMP{},
 		PacketConnMetrics: nc.SCIONPacketConnMetrics,
 	}
-	pconn, err := serverNet.OpenRaw(context.Background(), nc.Public)
+	pconn, err := serverNet.OpenRaw(ctx, nc.Public)
 	if err != nil {
 		return nil, nil, serrors.Wrap("creating server raw PacketConn", err)
 	}
@@ -262,7 +263,7 @@ func (nc *NetworkConfig) initQUICSockets() (net.PacketConn, net.PacketConn, erro
 		IP:   nc.Public.IP,
 		Zone: nc.Public.Zone,
 	}
-	client, err := clientNet.Listen(context.Background(), "udp", clientAddr)
+	client, err := clientNet.Listen(ctx, "udp", clientAddr)
 	if err != nil {
 		return nil, nil, serrors.Wrap("creating client connection", err)
 	}