diff --git a/.github/workflows/container-images-1.0.yaml b/.github/workflows/container-images-1.0.yaml
index 2572f71c..4c05b613 100644
--- a/.github/workflows/container-images-1.0.yaml
+++ b/.github/workflows/container-images-1.0.yaml
@@ -91,6 +91,9 @@ jobs:
         with:
           version: v3.16.3
 
+      - name: Run lint
+        run: make golangci-lint
+
       - name: Run tests
         run: make helm-validate test
 
diff --git a/Makefile b/Makefile
index 092fe37d..f790f547 100644
--- a/Makefile
+++ b/Makefile
@@ -304,6 +304,10 @@ govulncheck: govulncheck-bin ## Run govulncheck
 # https://github.com/golangci/golangci-lint/blob/main/.pre-commit-hooks.yaml
 .PHONY: golangci-lint
 golangci-lint: golangci-lint-bin ## Run golangci-lint.
+	$(GOLANGCI_LINT) run
+
+.PHONY: golangci-lint-fix
+golangci-lint-fix: golangci-lint-bin ## Run golangci-lint and apply fixes.
 	$(GOLANGCI_LINT) run --fix
 
 # https://github.com/golangci/golangci-lint/blob/main/.pre-commit-hooks.yaml
diff --git a/VERSION b/VERSION
index 5b09c67c..a9707166 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.0.14
+1.0.15
diff --git a/internal/builder/accounting_app.go b/internal/builder/accounting_app.go
index b475eb5d..90b4ec27 100644
--- a/internal/builder/accounting_app.go
+++ b/internal/builder/accounting_app.go
@@ -29,8 +29,8 @@ const (
 	slurmdbdConfFile = "slurmdbd.conf"
 
 	// Volume names for accounting initContainer fix
-	slurmSecretsTmpVolume = "slurm-secrets-tmp"
-	slurmSecretsTmpDir    = "/tmp/slurm-secrets"
+	slurmSecretsTmpVolume = "slurm-secrets-tmp" //nolint:gosec // Kubernetes volume name, not a credential.
+	slurmSecretsTmpDir    = "/tmp/slurm-secrets" //nolint:gosec // Kubernetes mount path, not a credential.
 )
 
 func (b *Builder) BuildAccounting(accounting *slinkyv1beta1.Accounting) (*appsv1.StatefulSet, error) {
diff --git a/internal/builder/controller_config.go b/internal/builder/controller_config.go
index eba9abbf..e29fbbc9 100644
--- a/internal/builder/controller_config.go
+++ b/internal/builder/controller_config.go
@@ -275,7 +275,7 @@ func buildSlurmConf(
 	conf.AddProperty(config.NewPropertyRaw("### SYSTEM DEFAULTS ###"))
 	conf.AddProperty(config.NewProperty("UnkillableStepTimeout", 600))
 	conf.AddProperty(config.NewProperty("HealthCheckInterval", 60))
-	conf.AddProperty(config.NewProperty("HealthCheckNodeState", "ANY"))
+	conf.AddProperty(config.NewProperty("HealthCheckNodeState", "IDLE"))
 	conf.AddProperty(config.NewProperty("HealthCheckProgram", "/usr/bin/gpu_healthcheck.sh"))
 	conf.AddProperty(config.NewProperty("JobRequeue", 0))
 
diff --git a/internal/builder/controller_config_test.go b/internal/builder/controller_config_test.go
index 07706f10..5c4ebcd8 100644
--- a/internal/builder/controller_config_test.go
+++ b/internal/builder/controller_config_test.go
@@ -165,7 +165,7 @@ func TestBuilder_BuildControllerConfig(t *testing.T) {
 				for _, directive := range []string{
 					"UnkillableStepTimeout=600",
 					"HealthCheckInterval=60",
-					"HealthCheckNodeState=ANY",
+					"HealthCheckNodeState=IDLE",
 					"HealthCheckProgram=/usr/bin/gpu_healthcheck.sh",
 					"JobRequeue=0",
 				} {
@@ -173,6 +173,9 @@ func TestBuilder_BuildControllerConfig(t *testing.T) {
 						t.Errorf("slurm.conf missing system default %q", directive)
 					}
 				}
+				if strings.Contains(slurmConf, "HealthCheckNodeState=ANY") {
+					t.Errorf("slurm.conf must not run health checks on allocated nodes")
+				}
 				if cgroupConf, ok := got.Data[cgroupConfFile]; ok {
 					if !strings.Contains(cgroupConf, "ConstrainRAMSpace=yes") {
 						t.Errorf("cgroup.conf missing ConstrainRAMSpace=yes")