diff --git a/build/mage/release/formula.go b/build/mage/release/formula.go
index 62889cee..c9af32d5 100644
--- a/build/mage/release/formula.go
+++ b/build/mage/release/formula.go
@@ -40,26 +40,26 @@ class {{ .Formula }} < Formula
   stable do
     on_macos do
       if Hardware::CPU.intel?
-        url "https://{{ .Repository }}/releases/download/cmd%2F{{ .Bin }}%2F{{ .Release }}/{{ .Bin }}-darwin-amd64-{{ .Release }}.tar.xz"
-        sha256 "{{ sha256file (printf "dist/%s-darwin-amd64-%s.tar.xz" .Bin .Release) }}"
+        url "https://{{ .Repository }}/releases/download/cmd%2F{{ .Bin }}%2F{{ .Release }}/{{ .Bin }}-darwin-amd64-{{ .Release }}.tar.gz"
+        sha256 "{{ sha256file (printf "dist/%s-darwin-amd64-%s.tar.gz" .Bin .Release) }}"
       elsif Hardware::CPU.arm?
-        url "https://{{ .Repository }}/releases/download/cmd%2F{{ .Bin }}%2F{{ .Release }}/{{ .Bin }}-darwin-arm64-{{ .Release }}.tar.xz"
-        sha256 "{{ sha256file (printf "dist/%s-darwin-arm64-%s.tar.xz" .Bin .Release) }}"
+        url "https://{{ .Repository }}/releases/download/cmd%2F{{ .Bin }}%2F{{ .Release }}/{{ .Bin }}-darwin-arm64-{{ .Release }}.tar.gz"
+        sha256 "{{ sha256file (printf "dist/%s-darwin-arm64-%s.tar.gz" .Bin .Release) }}"
       end
     end
     on_linux do
       if Hardware::CPU.intel?
         if Hardware::CPU.is_64_bit?
-          url "https://{{ .Repository }}/releases/download/cmd%2F{{ .Bin }}%2F{{ .Release }}/{{ .Bin }}-linux-amd64-{{ .Release }}.tar.xz"
-          sha256 "{{ sha256file (printf "dist/%s-linux-amd64-%s.tar.xz" .Bin .Release) }}"
+          url "https://{{ .Repository }}/releases/download/cmd%2F{{ .Bin }}%2F{{ .Release }}/{{ .Bin }}-linux-amd64-{{ .Release }}.tar.gz"
+          sha256 "{{ sha256file (printf "dist/%s-linux-amd64-%s.tar.gz" .Bin .Release) }}"
         end
       elsif Hardware::CPU.arm?
         if Hardware::CPU.is_64_bit?
-          url "https://{{ .Repository }}/releases/download/cmd%2F{{ .Bin }}%2F{{ .Release }}/{{ .Bin }}-linux-arm64-{{ .Release }}.tar.xz"
-          sha256 "{{ sha256file (printf "dist/%s-linux-arm64-%s.tar.xz" .Bin .Release) }}"
+          url "https://{{ .Repository }}/releases/download/cmd%2F{{ .Bin }}%2F{{ .Release }}/{{ .Bin }}-linux-arm64-{{ .Release }}.tar.gz"
+          sha256 "{{ sha256file (printf "dist/%s-linux-arm64-%s.tar.gz" .Bin .Release) }}"
         else
-          url "https://{{ .Repository }}/releases/download/cmd%2F{{ .Bin }}%2F{{ .Release }}/{{ .Bin }}-linux-arm7-{{ .Release }}.tar.xz"
-          sha256 "{{ sha256file (printf "dist/%s-linux-arm7-%s.tar.xz" .Bin .Release) }}"
+          url "https://{{ .Repository }}/releases/download/cmd%2F{{ .Bin }}%2F{{ .Release }}/{{ .Bin }}-linux-arm7-{{ .Release }}.tar.gz"
+          sha256 "{{ sha256file (printf "dist/%s-linux-arm7-%s.tar.gz" .Bin .Release) }}"
         end
       end
     end
diff --git a/pkg/bundle/ruleset/engine/rego/engine.go b/pkg/bundle/ruleset/engine/rego/engine.go
index a6514114..49108fdd 100644
--- a/pkg/bundle/ruleset/engine/rego/engine.go
+++ b/pkg/bundle/ruleset/engine/rego/engine.go
@@ -23,6 +23,7 @@ import (
 	"fmt"
 	"io"
 
+	//nolint:staticcheck // deprecated package requires refactor
 	"github.com/open-policy-agent/opa/rego"
 
 	bundlev1 "github.com/elastic/harp/api/gen/go/harp/bundle/v1"
diff --git a/pkg/bundle/selector/match_rego.go b/pkg/bundle/selector/match_rego.go
index 856c2828..5ac018cf 100644
--- a/pkg/bundle/selector/match_rego.go
+++ b/pkg/bundle/selector/match_rego.go
@@ -22,6 +22,7 @@ import (
 	"errors"
 	"fmt"
 
+	//nolint:staticcheck // deprecated package requires refactor
 	"github.com/open-policy-agent/opa/rego"
 	"go.uber.org/zap"