diff --git a/openflare_agent/internal/sync/service.go b/openflare_agent/internal/sync/service.go
index 406db221..e51857ce 100644
--- a/openflare_agent/internal/sync/service.go
+++ b/openflare_agent/internal/sync/service.go
@@ -103,18 +103,6 @@ func (s *Service) sync(ctx context.Context, startup bool, target *protocol.Activ
 		}
 		slog.Debug("local openresty config already up to date", "mode", mode, "version", target.Version)
 		shouldReport := shouldReportNoopApply(snapshot, target.Version, target.Checksum)
-		if startup {
-			slog.Debug("ensuring openresty runtime on startup", "version", target.Version)
-			if err = s.nginxManager.EnsureRuntime(ctx, true); err != nil {
-				snapshot.OpenrestyStatus = protocol.OpenrestyStatusUnhealthy
-				snapshot.OpenrestyMessage = err.Error()
-				_ = s.stateStore.Save(snapshot)
-				return err
-			}
-			slog.Debug("openresty runtime ensured on startup", "version", target.Version)
-			snapshot.OpenrestyStatus = protocol.OpenrestyStatusHealthy
-			snapshot.OpenrestyMessage = ""
-		}
 		if shouldReport {
 			if err = s.reportNoopApply(ctx, snapshot.NodeID, target.Version, target.Checksum, "", "", 0); err != nil {
 				return err
@@ -178,18 +166,6 @@ func (s *Service) applyIfNeeded(ctx context.Context, mode string, startup bool,
 	if currentChecksum == config.Checksum && !startup {
 		slog.Debug("local openresty config already up to date", "mode", mode, "version", config.Version)
 		shouldReport := shouldReportNoopApply(snapshot, config.Version, config.Checksum)
-		if startup {
-			slog.Debug("ensuring openresty runtime on startup", "version", config.Version)
-			if err := s.nginxManager.EnsureRuntime(ctx, true); err != nil {
-				snapshot.OpenrestyStatus = protocol.OpenrestyStatusUnhealthy
-				snapshot.OpenrestyMessage = err.Error()
-				_ = s.stateStore.Save(snapshot)
-				return err
-			}
-			slog.Debug("openresty runtime ensured on startup", "version", config.Version)
-			snapshot.OpenrestyStatus = protocol.OpenrestyStatusHealthy
-			snapshot.OpenrestyMessage = ""
-		}
 		if shouldReport {
 			rendered, renderErr := renderActiveConfig(config)
 			if renderErr != nil {
diff --git a/openflare_agent/internal/updater/updater.go b/openflare_agent/internal/updater/updater.go
index f5de782f..170e9b9f 100644
--- a/openflare_agent/internal/updater/updater.go
+++ b/openflare_agent/internal/updater/updater.go
@@ -121,26 +121,7 @@ func (s *Service) getRelease(ctx context.Context, repo string, options agent.Upd
 
 func (s *Service) getLatestStableRelease(ctx context.Context, repo string) (*githubRelease, error) {
 	url := fmt.Sprintf("https://api.github.com/repos/%s/releases/latest", repo)
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
-	if err != nil {
-		return nil, err
-	}
-	req.Header.Set("Accept", "application/vnd.github+json")
-
-	resp, err := s.httpClient.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode == http.StatusNotFound {
-		return nil, nil
-	}
-	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("github api returned %s", resp.Status)
-	}
-
-	return decodeRelease(resp.Body)
+	return s.fetchReleaseFromURL(ctx, url)
 }
 
 func (s *Service) getLatestPreviewRelease(ctx context.Context, repo string) (*githubRelease, error) {
@@ -177,6 +158,10 @@ func (s *Service) getLatestPreviewRelease(ctx context.Context, repo string) (*gi
 
 func (s *Service) getReleaseByTag(ctx context.Context, repo string, tag string) (*githubRelease, error) {
 	url := fmt.Sprintf("https://api.github.com/repos/%s/releases/tags/%s", repo, strings.TrimSpace(tag))
+	return s.fetchReleaseFromURL(ctx, url)
+}
+
+func (s *Service) fetchReleaseFromURL(ctx context.Context, url string) (*githubRelease, error) {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
 	if err != nil {
 		return nil, err
@@ -187,7 +172,12 @@ func (s *Service) getReleaseByTag(ctx context.Context, repo string, tag string)
 	if err != nil {
 		return nil, err
 	}
-	defer resp.Body.Close()
+	defer func(Body io.ReadCloser) {
+		err := Body.Close()
+		if err != nil {
+			slog.Error("failed to close response body", "error", err)
+		}
+	}(resp.Body)
 
 	if resp.StatusCode == http.StatusNotFound {
 		return nil, nil
@@ -498,9 +488,9 @@ func compareVersions(local string, remote string) int {
 			if leftNumber > rightNumber {
 				return 1
 			}
-		case leftErr == nil && rightErr != nil:
+		case leftErr == nil:
 			return -1
-		case leftErr != nil && rightErr == nil:
+		case rightErr == nil:
 			return 1
 		default:
 			if leftPart < rightPart {
diff --git a/openflare_agent/internal/wsclient/client.go b/openflare_agent/internal/wsclient/client.go
index d587730a..132d2c7c 100644
--- a/openflare_agent/internal/wsclient/client.go
+++ b/openflare_agent/internal/wsclient/client.go
@@ -140,7 +140,8 @@ func (conn *Connection) Receive() (protocol.WSMessage, error) {
 	}
 	err := websocket.JSON.Receive(conn.conn, &message)
 	if err != nil {
-		if netErr, ok := err.(net.Error); ok && netErr.Timeout() {
+		var netErr net.Error
+		if errors.As(err, &netErr) && netErr.Timeout() {
 			slog.Debug("agent ws receive timeout waiting for server message", "timeout", conn.readTimeout)
 		}
 		return message, err
diff --git a/openflare_server/service/update.go b/openflare_server/service/update.go
index aac915a2..0176eb91 100644
--- a/openflare_server/service/update.go
+++ b/openflare_server/service/update.go
@@ -751,9 +751,9 @@ func compareVersionInfo(left versionInfo, right versionInfo) int {
 			if leftNumber > rightNumber {
 				return 1
 			}
-		case leftErr == nil && rightErr != nil:
+		case leftErr == nil:
 			return -1
-		case leftErr != nil && rightErr == nil:
+		case rightErr == nil:
 			return 1
 		default:
 			if leftPart < rightPart {