diff --git a/cmd/generate-database/README.md b/cmd/generate-database/README.md
index df311446d6..f2c36a7695 100644
--- a/cmd/generate-database/README.md
+++ b/cmd/generate-database/README.md
@@ -47,7 +47,7 @@ ensure the file has been cleared of content:
 
 ### Generation Directive Arguments
 
-The generation directive aruments have the following form:
+The generation directive arguments have the following form:
 
 `//generate-database:mapper <command> flags <kind> <args...>`
 
diff --git a/cmd/generate-database/db/parse.go b/cmd/generate-database/db/parse.go
index 89d621f0b9..3551b883dc 100644
--- a/cmd/generate-database/db/parse.go
+++ b/cmd/generate-database/db/parse.go
@@ -344,7 +344,7 @@ func parseField(f *types.Var, structTag string, kind string, pkgName string) (*F
 		return nil, fmt.Errorf("Unexported field name %q", name)
 	}
 
-	// Ignore fields that are marked with a tag of `db:"ingore"`
+	// Ignore fields that are marked with a tag of `db:"ignore"`
 	if structTag != "" {
 		tagValue := reflect.StructTag(structTag).Get("db")
 		if tagValue == "ignore" {
diff --git a/cmd/generate-database/file/boilerplate/boilerplate.go b/cmd/generate-database/file/boilerplate/boilerplate.go
index d6d779248e..253ab9f7c6 100644
--- a/cmd/generate-database/file/boilerplate/boilerplate.go
+++ b/cmd/generate-database/file/boilerplate/boilerplate.go
@@ -21,7 +21,7 @@ type preparer interface {
 
 // RegisterStmt register a SQL statement.
 //
-// Registered statements will be prepared upfront and re-used, to speed up
+// Registered statements will be prepared upfront and reused, to speed up
 // execution.
 //
 // Return a unique registration code.
diff --git a/cmd/incus-user/main_daemon.go b/cmd/incus-user/main_daemon.go
index 9cab0c4972..7f9d26311b 100644
--- a/cmd/incus-user/main_daemon.go
+++ b/cmd/incus-user/main_daemon.go
@@ -63,7 +63,7 @@ func (c *cmdDaemon) Run(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("Failed to obtain connection info: %w", err)
 	}
 
-	// Keep track of the socket path we used to succefully connect to the server
+	// Keep track of the socket path we used to successfully connect to the server
 	serverUnixPath := cinfo.SocketPath
 
 	// Validate the configuration.
diff --git a/cmd/incus/admin_init_interactive.go b/cmd/incus/admin_init_interactive.go
index d1bdcba8dd..757343daff 100644
--- a/cmd/incus/admin_init_interactive.go
+++ b/cmd/incus/admin_init_interactive.go
@@ -243,7 +243,7 @@ func (c *cmdAdminInit) askClustering(config *api.InitPreseed, d incus.InstanceSe
 				return fmt.Errorf(i18n.G("Failed to setup trust relationship with cluster: %w"), err)
 			}
 
-			// Now we have setup trust, don't send to server, othwerwise it will try and setup trust
+			// Now we have setup trust, don't send to server, otherwise it will try and setup trust
 			// again and if using a one-time join token, will fail.
 			config.Cluster.ClusterToken = ""
 
@@ -772,7 +772,7 @@ func (c *cmdAdminInit) askDaemon(config *api.InitPreseed, d incus.InstanceServer
 This means that unless you manually configured your host otherwise,
 you will not have enough uids and gids to allocate to your containers.
 
-Your container's own allocation can be re-used to avoid the problem.
+Your container's own allocation can be reused to avoid the problem.
 Doing so makes your nested containers slightly less safe as they could
 in theory attack their parent container and gain more privileges than
 they otherwise would.`) + "\n\n")
diff --git a/cmd/incus/copy.go b/cmd/incus/copy.go
index ad49cf43c5..95a2d8f939 100644
--- a/cmd/incus/copy.go
+++ b/cmd/incus/copy.go
@@ -471,7 +471,7 @@ func (c *cmdCopy) Run(cmd *cobra.Command, args []string) error {
 	keepVolatile := c.flagRefresh
 	instanceOnly := c.flagInstanceOnly
 
-	// If not target name is specified, one will be chosed by the server
+	// If target name is not specified, one will be chosen by the server
 	if len(args) < 2 {
 		return c.copyInstance(conf, args[0], "", keepVolatile, ephem, stateful, instanceOnly, mode, c.flagStorage, false)
 	}
diff --git a/cmd/incus/move.go b/cmd/incus/move.go
index 8db82c51fc..9a8dbf3487 100644
--- a/cmd/incus/move.go
+++ b/cmd/incus/move.go
@@ -316,7 +316,7 @@ func (c *cmdMove) moveInstance(sourceResource string, destResource string, state
 			return err
 		}
 
-		// Fetch the current isntance.
+		// Fetch the current instance.
 		inst, _, err := source.GetInstance(sourceName)
 		if err != nil {
 			return err
diff --git a/cmd/incus/storage_bucket.go b/cmd/incus/storage_bucket.go
index 41cd05d428..3b9f857575 100644
--- a/cmd/incus/storage_bucket.go
+++ b/cmd/incus/storage_bucket.go
@@ -518,7 +518,7 @@ Pre-defined column shorthand chars:
 	return cmd
 }
 
-const defaultStorageBucketColumns = "nd"
+const defaultStorageBucketColumns = "nd" // codespell:ignore nd
 
 func (c *cmdStorageBucketList) parseColumns(clustered bool) ([]storageBucketColumn, error) {
 	columnsShorthandMap := map[rune]storageBucketColumn{
diff --git a/cmd/incusd/api_cluster.go b/cmd/incusd/api_cluster.go
index 67658fbbd4..98cf0e5241 100644
--- a/cmd/incusd/api_cluster.go
+++ b/cmd/incusd/api_cluster.go
@@ -2160,8 +2160,8 @@ func internalClusterPostAccept(d *Daemon, r *http.Request) response.Response {
 		return response.BadRequest(fmt.Errorf("No name provided"))
 	}
 
-	// Redirect all requests to the leader, which is the one with
-	// knowning what nodes are part of the raft cluster.
+	// Redirect all requests to the leader, which is the one
+	// knowing what nodes are part of the raft cluster.
 	localClusterAddress := s.LocalConfig.ClusterAddress()
 
 	leader, err := s.Cluster.LeaderAddress()
diff --git a/cmd/incusd/api_internal_recover.go b/cmd/incusd/api_internal_recover.go
index 3f36955e6d..b7b989fafa 100644
--- a/cmd/incusd/api_internal_recover.go
+++ b/cmd/incusd/api_internal_recover.go
@@ -319,7 +319,7 @@ func internalRecoverScan(ctx context.Context, s *state.State, userPools []api.St
 
 	// Create the pools themselves.
 	for _, pool := range pools {
-		// Create missing storage pool DB record if neeed.
+		// Create missing storage pool DB record if needed.
 		if pool.ID() == storagePools.PoolIDTemporary {
 			var instPoolVol *backupConfig.Config // Instance volume used for new pool record.
 			var poolID int64                     // Pool ID of created pool record.
diff --git a/cmd/incusd/api_project.go b/cmd/incusd/api_project.go
index b8edd0c245..849a6a4d48 100644
--- a/cmd/incusd/api_project.go
+++ b/cmd/incusd/api_project.go
@@ -1578,7 +1578,7 @@ func projectValidateConfig(s *state.State, config map[string]string) error {
 		// gendoc:generate(entity=project, group=restricted, key=restricted.containers.privilege)
 		// Possible values are `unprivileged`, `isolated`, and `allow`.
 		//
-		// - When set to `unpriviliged`, this option prevents setting {config:option}`instance-security:security.privileged` to `true`.
+		// - When set to `unprivileged`, this option prevents setting {config:option}`instance-security:security.privileged` to `true`.
 		// - When set to `isolated`, this option prevents setting {config:option}`instance-security:security.privileged` and {config:option}`instance-security:security.idmap.isolated` to `true`.
 		// - When set to `allow`, there is no restriction.
 		// ---
diff --git a/cmd/incusd/daemon.go b/cmd/incusd/daemon.go
index d00017fc75..be45f103a1 100644
--- a/cmd/incusd/daemon.go
+++ b/cmd/incusd/daemon.go
@@ -1839,7 +1839,7 @@ func (d *Daemon) Stop(ctx context.Context, sig os.Signal) error {
 	if sig == unix.SIGPWR || sig == unix.SIGTERM {
 		if d.db.Cluster != nil {
 			// waitForOperations will block until all operations are done, or it's forced to shut down.
-			// For the latter case, we re-use the shutdown channel which is filled when a shutdown is
+			// For the latter case, we reuse the shutdown channel which is filled when a shutdown is
 			// initiated using `shutdown`.
 			waitForOperations(ctx, d.db.Cluster, s.GlobalConfig.ShutdownTimeout())
 		}
diff --git a/cmd/incusd/daemon_images.go b/cmd/incusd/daemon_images.go
index ab15964344..8ec5e3701d 100644
--- a/cmd/incusd/daemon_images.go
+++ b/cmd/incusd/daemon_images.go
@@ -544,7 +544,7 @@ func ImageDownload(ctx context.Context, r *http.Request, s *state.State, op *ope
 		return nil, false, fmt.Errorf("Unsupported protocol: %v", protocol)
 	}
 
-	// Override visiblity
+	// Override visibility
 	info.Public = args.Public
 
 	// We want to enable auto-update only if we were passed an
diff --git a/cmd/incusd/dev_incus.go b/cmd/incusd/dev_incus.go
index 3a517cdb80..893bdc725d 100644
--- a/cmd/incusd/dev_incus.go
+++ b/cmd/incusd/dev_incus.go
@@ -328,9 +328,9 @@ func devIncusAPI(d *Daemon, f hoistFunc) http.Handler {
  *    event, we use SO_PEERCRED to extract the creds for the socket.
  *
  * 2. We store a map from the connection pointer to the pid for that
- *    connection, so that once the HTTP negotiation occurrs and we get a
+ *    connection, so that once the HTTP negotiation occurs and we get a
  *    ResponseWriter, we know (because we negotiated on the first byte) which
- *    pid the connection belogs to.
+ *    pid the connection belongs to.
  *
  * 3. Regular HTTP negotiation and dispatch occurs via net/http.
  *
diff --git a/cmd/incusd/instance.go b/cmd/incusd/instance.go
index 416b6f17e1..45340e2cd9 100644
--- a/cmd/incusd/instance.go
+++ b/cmd/incusd/instance.go
@@ -672,7 +672,7 @@ func pruneExpiredAndAutoCreateInstanceSnapshotsTask(d *Daemon) (task.Func, task.
 			return
 		}
 
-		// Get list of instances on the local member that are due to have snaphots creating.
+		// Get list of instances on the local member that are due to have snapshots creating.
 		filter := dbCluster.InstanceFilter{Node: &s.ServerName}
 
 		err = s.DB.Cluster.Transaction(ctx, func(ctx context.Context, tx *db.ClusterTx) error {
diff --git a/cmd/incusd/instance_access.go b/cmd/incusd/instance_access.go
index 6fbb7eef10..d3951aa241 100644
--- a/cmd/incusd/instance_access.go
+++ b/cmd/incusd/instance_access.go
@@ -15,7 +15,7 @@ import (
 
 // swagger:operation GET /1.0/instances/{name}/access instances instance_access
 //
-//	Get who has access to an instnace
+//	Get who has access to an instance
 //
 //	Gets the access information for the instance.
 //
diff --git a/cmd/incusd/instance_test.go b/cmd/incusd/instance_test.go
index fe731b57ae..8f4d38fa42 100644
--- a/cmd/incusd/instance_test.go
+++ b/cmd/incusd/instance_test.go
@@ -208,7 +208,7 @@ func (suite *containerTestSuite) TestContainer_LoadFromDB() {
 	suite.Exactly(
 		apiC1,
 		apiC2,
-		"The loaded container isn't excactly the same as the created one.",
+		"The loaded container isn't exactly the same as the created one.",
 	)
 }
 
diff --git a/cmd/incusd/main_test.go b/cmd/incusd/main_test.go
index e69f854bc4..2dbc019c77 100644
--- a/cmd/incusd/main_test.go
+++ b/cmd/incusd/main_test.go
@@ -20,7 +20,7 @@ func mockStartDaemon() (*Daemon, error) {
 	d := defaultDaemon()
 	d.os.MockMode = true
 
-	// Setup test certificates. We re-use the ones already on disk under
+	// Setup test certificates. We reuse the ones already on disk under
 	// the test/ directory, to avoid generating new ones, which is
 	// expensive.
 	err := sys.SetupTestCerts(internalUtil.VarPath())
diff --git a/cmd/incusd/migration_connection.go b/cmd/incusd/migration_connection.go
index 748fc9b957..711202e86c 100644
--- a/cmd/incusd/migration_connection.go
+++ b/cmd/incusd/migration_connection.go
@@ -111,7 +111,7 @@ func (c *migrationConn) AcceptIncoming(r *http.Request, w http.ResponseWriter) e
 }
 
 // WebSocket returns the underlying websocket connection.
-// If the connection isn't yet active it will either wait for an incoming connection or if configured, will atempt
+// If the connection isn't yet active it will either wait for an incoming connection or if configured, will attempt
 // to initiate a new outbound connection. If the context is cancelled before the connection is established it
 // will return with an error.
 func (c *migrationConn) WebSocket(ctx context.Context) (*websocket.Conn, error) {
diff --git a/cmd/incusd/networks.go b/cmd/incusd/networks.go
index 788d3f3451..171bb8cca1 100644
--- a/cmd/incusd/networks.go
+++ b/cmd/incusd/networks.go
@@ -42,7 +42,7 @@ import (
 	"github.com/lxc/incus/v6/shared/util"
 )
 
-// Lock to prevent concurent networks creation.
+// Lock to prevent concurrent networks creation.
 var networkCreateLock sync.Mutex
 
 var networksCmd = APIEndpoint{
@@ -1187,7 +1187,7 @@ func networkPost(d *Daemon, r *http.Request) response.Response {
 	//        network having already been renamed in the database, which is
 	//        a chicken-and-egg problem for cluster notifications (the
 	//        serving node should typically do the database job, so the
-	//        network is not yet renamed inthe db when the notified node
+	//        network is not yet renamed in the db when the notified node
 	//        runs network.Start).
 	if s.ServerClustered {
 		return response.BadRequest(fmt.Errorf("Renaming clustered network not supported"))
diff --git a/cmd/incusd/snapshot_common.go b/cmd/incusd/snapshot_common.go
index 3d38f2021d..4fc704f165 100644
--- a/cmd/incusd/snapshot_common.go
+++ b/cmd/incusd/snapshot_common.go
@@ -107,7 +107,7 @@ func cronSpecIsNow(spec string) (bool, error) {
 	now := time.Now()
 
 	// Truncate the time now back to the start of the minute.
-	// This is neded because the cron scheduler will add a minute to the scheduled time
+	// This is needed because the cron scheduler will add a minute to the scheduled time
 	// and we don't want the next scheduled time to roll over to the next minute and break
 	// the time comparison below.
 	now = now.Truncate(time.Minute)
diff --git a/cmd/incusd/storage.go b/cmd/incusd/storage.go
index b4045cac32..631dfc2b55 100644
--- a/cmd/incusd/storage.go
+++ b/cmd/incusd/storage.go
@@ -24,7 +24,7 @@ import (
 )
 
 // Simple cache used to store the activated drivers on this server.
-// This allows us to avoid querying the database everytime and API call is made.
+// This allows us to avoid querying the database every time an API call is made.
 var (
 	storagePoolUsedDriversCacheVal      atomic.Value
 	storagePoolSupportedDriversCacheVal atomic.Value
diff --git a/cmd/incusd/storage_pools.go b/cmd/incusd/storage_pools.go
index 73aef009a1..d6b1b4b0b4 100644
--- a/cmd/incusd/storage_pools.go
+++ b/cmd/incusd/storage_pools.go
@@ -31,7 +31,7 @@ import (
 	"github.com/lxc/incus/v6/shared/util"
 )
 
-// Lock to prevent concurent storage pools creation.
+// Lock to prevent concurrent storage pools creation.
 var storagePoolCreateLock sync.Mutex
 
 var storagePoolsCmd = APIEndpoint{
diff --git a/cmd/incusd/storage_volumes.go b/cmd/incusd/storage_volumes.go
index bfe06f18b0..54c2e5254b 100644
--- a/cmd/incusd/storage_volumes.go
+++ b/cmd/incusd/storage_volumes.go
@@ -359,7 +359,7 @@ func storagePoolVolumesGet(d *Daemon, r *http.Request) response.Response {
 			}
 
 			// The project name used for custom volumes varies based on whether the
-			// project has the featues.storage.volumes feature enabled.
+			// project has the features.storage.volumes feature enabled.
 			customVolProjectName = project.StorageVolumeProjectFromRecord(p, db.StoragePoolVolumeTypeCustom)
 
 			projectImages, err = tx.GetImagesFingerprints(ctx, requestProjectName, false)
diff --git a/cmd/lxc-to-incus/main_migrate_test.go b/cmd/lxc-to-incus/main_migrate_test.go
index 263f049c86..f369d82490 100644
--- a/cmd/lxc-to-incus/main_migrate_test.go
+++ b/cmd/lxc-to-incus/main_migrate_test.go
@@ -26,7 +26,7 @@ func TestValidateConfig(t *testing.T) {
 			true,
 		},
 		{
-			"container name missmatch (1)",
+			"container name mismatch (1)",
 			[]string{
 				"lxc.uts.name = c2",
 			},
@@ -34,7 +34,7 @@ func TestValidateConfig(t *testing.T) {
 			true,
 		},
 		{
-			"container name missmatch (2)",
+			"container name mismatch (2)",
 			[]string{
 				"lxc.utsname = c2",
 			},
diff --git a/cmd/lxd-to-incus/db.go b/cmd/lxd-to-incus/db.go
index fa3824e05e..3c1d50a8f5 100644
--- a/cmd/lxd-to-incus/db.go
+++ b/cmd/lxd-to-incus/db.go
@@ -92,7 +92,7 @@ func lz4Uncompress(zfilename string) error {
 
 	zinfo, err := zfile.Stat()
 	if err != nil {
-		return fmt.Errorf("Fialed to get file info for %q: %w", zfilename, err)
+		return fmt.Errorf("Failed to get file info for %q: %w", zfilename, err)
 	}
 
 	// use the same mode for the output file
diff --git a/cmd/lxd-to-incus/validate.go b/cmd/lxd-to-incus/validate.go
index 032ffd046b..696ef0a74f 100644
--- a/cmd/lxd-to-incus/validate.go
+++ b/cmd/lxd-to-incus/validate.go
@@ -83,7 +83,7 @@ func (c *cmdMigrate) validate(source source, target target) error {
 			return false, nil
 		}
 
-		// Check if any instance is persent.
+		// Check if any instance is present.
 		names, err = srcClient.GetInstanceNames(api.InstanceTypeAny)
 		if err != nil {
 			return false, err