diff --git a/.github/actions/gomodtidy/Dockerfile b/.github/actions/gomodtidy/Dockerfile
index 9ea7e87af..20404759e 100644
--- a/.github/actions/gomodtidy/Dockerfile
+++ b/.github/actions/gomodtidy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:alpine
+FROM golang:1.20-alpine
 
 COPY entrypoint.sh /entrypoint.sh
 
diff --git a/BUILD.bazel b/BUILD.bazel
index a1f9544b4..3d5a380f1 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -4,6 +4,7 @@ load("@com_github_atlassian_bazel_tools//goimports:def.bzl", "goimports")
 load("@io_kubernetes_build//defs:run_in_workspace.bzl", "workspace_binary")
 load("@io_bazel_rules_go//go:def.bzl", "nogo")
 load("@bazel_skylib//rules:common_settings.bzl", "string_setting")
+load("@prysm//tools/nogo_config:def.bzl", "nogo_config_exclude")
 
 prefix = "github.com/prysmaticlabs/prysm"
 
@@ -82,9 +83,115 @@ workspace_binary(
     cmd = "@com_github_golang_lint//golint",
 )
 
+STATICCHECK_ANALYZERS = [
+    # Enabled static checks. See https://staticcheck.dev/docs/checks/
+    # Please. keep this list sorted. Don't be a bad person by inserting stuff randomly.
+    "sa1000",
+    "sa1001",
+    "sa1002",
+    "sa1003",
+    "sa1004",
+    "sa1005",
+    "sa1006",
+    "sa1007",
+    "sa1008",
+    "sa1010",
+    "sa1011",
+    "sa1012",
+    "sa1013",
+    "sa1014",
+    "sa1015",
+    "sa1016",
+    "sa1017",
+    "sa1018",
+    # "sa1019",
+    "sa1020",
+    "sa1021",
+    "sa1023",
+    "sa1024",
+    "sa1025",
+    "sa1026",
+    "sa1027",
+    "sa1028",
+    "sa1029",
+    "sa1030",
+    "sa2000",
+    "sa2001",
+    # "sa2002",
+    "sa2003",
+    "sa3000",
+    "sa3001",
+    "sa4000",
+    "sa4001",
+    "sa4003",
+    "sa4004",
+    # "sa4005",
+    # "sa4006",
+    "sa4008",
+    "sa4009",
+    # "sa4010",
+    "sa4011",
+    "sa4012",
+    "sa4013",
+    "sa4014",
+    "sa4015",
+    "sa4016",
+    "sa4017",
+    "sa4018",
+    "sa4019",
+    "sa4020",
+    "sa4021",
+    "sa4022",
+    # "sa4023",
+    "sa4024",
+    "sa4025",
+    "sa4026",
+    "sa4027",
+    "sa4028",
+    "sa4029",
+    "sa4030",
+    "sa4031",
+    "sa4032",
+    "sa5000",
+    "sa5001",
+    "sa5002",
+    "sa5003",
+    "sa5004",
+    "sa5005",
+    "sa5007",
+    "sa5008",
+    "sa5009",
+    "sa5010",
+    "sa5011",
+    "sa5012",
+    "sa6000",
+    "sa6001",
+    "sa6002",
+    "sa6003",
+    "sa6005",
+    "sa6006",
+    "sa9001",
+    "sa9002",
+    #"sa9003", # Doesn't build
+    "sa9004",
+    "sa9005",
+    "sa9006",
+    "sa9007",
+    "sa9008",
+]
+
+nogo_config_exclude(
+    name = "nogo_config_with_excludes",
+    checks = [sa.upper() for sa in STATICCHECK_ANALYZERS],
+    exclude_files = [
+        "external/.*",
+    ],
+    input = "nogo_config.json",
+)
+
 nogo(
     name = "nogo",
-    config = "nogo_config.json",
+    config = ":nogo_config_with_excludes",
     visibility = ["//visibility:public"],
     deps = [
         "@org_golang_x_tools//go/analysis/passes/unsafeptr:go_default_library",
@@ -136,7 +243,7 @@ nogo(
             "@org_golang_x_tools//go/analysis/passes/composite:go_default_library",
             "@org_golang_x_tools//go/analysis/passes/lostcancel:go_default_library",
         ],
-    }),
+    }) + ["@co_honnef_go_tools//staticcheck/%s:go_default_library" % c for c in STATICCHECK_ANALYZERS],
 )
 
 config_setting(
diff --git a/WORKSPACE b/WORKSPACE
index 7e331592c..2a98fe433 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -126,10 +126,10 @@ http_archive(
         # Expose internals of go_test for custom build transitions.
         "//third_party:io_bazel_rules_go_test.patch",
     ],
-    sha256 = "91585017debb61982f7054c9688857a2ad1fd823fc3f9cb05048b0025c47d023",
+    sha256 = "d6ab6b57e48c09523e93050f13698f708428cfd5e619252e369d377af6597707",
     urls = [
-        "https://mirror.bazel.build/github.com/bazelbuild/rules_go/releases/download/v0.42.0/rules_go-v0.42.0.zip",
-        "https://github.com/bazelbuild/rules_go/releases/download/v0.42.0/rules_go-v0.42.0.zip",
+        "https://mirror.bazel.build/github.com/bazelbuild/rules_go/releases/download/v0.43.0/rules_go-v0.43.0.zip",
+        "https://github.com/bazelbuild/rules_go/releases/download/v0.43.0/rules_go-v0.43.0.zip",
     ],
 )
 
diff --git a/deps.bzl b/deps.bzl
index 22a04232c..cf2215464 100644
--- a/deps.bzl
+++ b/deps.bzl
@@ -37,8 +37,8 @@ def prysm_deps():
     go_repository(
         name = "co_honnef_go_tools",
         importpath = "honnef.co/go/tools",
-        sum = "h1:qTakTkI6ni6LFD5sBwwsdSO+AQqbSIxOauHTTQKZ/7o=",
-        version = "v0.1.3",
+        sum = "h1:VUeHARd+9362HPYyFWjsRa6jBIAf2xWbDv6QXMRztbQ=",
+        version = "v0.5.0-0.dev.0.20231205170804-aef76f4feee2",
     )
 
     go_repository(
@@ -1689,6 +1689,12 @@ def prysm_deps():
         sum = "h1:DLJCy1n/vrD4HPjOvYcT8aYQXpPIzoRZONaYwyycI+I=",
         version = "v0.4.1",
     )
+    go_repository(
+        name = "com_github_googleapis_google_cloud_go_testing",
+        importpath = "github.com/googleapis/google-cloud-go-testing",
+        sum = "h1:tlyzajkF3030q6M8SvmJSemC9DTHL/xaMa18b65+JM4=",
+        version = "v0.0.0-20200911160855-bcd43fbb19e8",
+    )
 
     go_repository(
         name = "com_github_gopherjs_gopherjs",
@@ -2471,6 +2477,12 @@ def prysm_deps():
         sum = "h1:30n5Eq2aBsT+cmDxl8F4PcfptcBxW5J22lbVErc/X9c=",
         version = "v0.0.0-20221015170604-22eb1ceceddc",
     )
+    go_repository(
+        name = "com_github_kr_fs",
+        importpath = "github.com/kr/fs",
+        sum = "h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=",
+        version = "v0.1.0",
+    )
 
     go_repository(
         name = "com_github_kr_logfmt",
@@ -3355,6 +3367,12 @@ def prysm_deps():
         sum = "h1:042Buzk+NhDI+DeSAA62RwJL8VAuZUMQZUjCsRz1Mug=",
         version = "v1.5.0",
     )
+    go_repository(
+        name = "com_github_pkg_sftp",
+        importpath = "github.com/pkg/sftp",
+        sum = "h1:I2qBYMChEhIjOgazfJmV3/mZM256btk6wkCDRmW7JYs=",
+        version = "v1.13.1",
+    )
 
     go_repository(
         name = "com_github_pkg_term",
@@ -3525,12 +3543,6 @@ def prysm_deps():
         sum = "h1:GA6Bl6oZY+g/flt00Pnu0XtivSD8vukOu3lYhJjnGEk=",
         version = "v0.5.2",
     )
-    go_repository(
-        name = "com_github_r3labs_sse_v2",
-        importpath = "github.com/r3labs/sse/v2",
-        sum = "h1:hFEkLLFY4LDifoHdiCN/LlGBAdVJYsANaLqNYa1l/v0=",
-        version = "v2.10.0",
-    )
 
     go_repository(
         name = "com_github_raulk_go_watchdog",
@@ -3877,8 +3889,8 @@ def prysm_deps():
     go_repository(
         name = "com_github_spf13_afero",
         importpath = "github.com/spf13/afero",
-        sum = "h1:5jhuqJyZCZf2JRofRvN/nIFgIWNzPa3/Vz8mYylgbWc=",
-        version = "v1.2.2",
+        sum = "h1:EaGW2JJh15aKOejeuJ+wpFSHnbd7GE6Wvp3TsNhb6LY=",
+        version = "v1.10.0",
     )
     go_repository(
         name = "com_github_spf13_cast",
@@ -4998,8 +5010,8 @@ def prysm_deps():
     go_repository(
         name = "com_google_cloud_go_storage",
         importpath = "cloud.google.com/go/storage",
-        sum = "h1:STgFzyU5/8miMl0//zKh2aQeTyeaUH3WN9bSUiJ09bA=",
-        version = "v1.10.0",
+        sum = "h1:6RRlFMv1omScs6iq2hfE3IvgE+l6RfJPampq8UZc5TU=",
+        version = "v1.14.0",
     )
     go_repository(
         name = "com_google_cloud_go_storagetransfer",
@@ -5162,12 +5174,6 @@ def prysm_deps():
         sum = "h1:stTHdEoWg1pQ8riaP5ROrjS6zy6wewH/Q2iwnLCQUXY=",
         version = "v1.0.0-20160220154919-db14e161995a",
     )
-    go_repository(
-        name = "in_gopkg_cenkalti_backoff_v1",
-        importpath = "gopkg.in/cenkalti/backoff.v1",
-        sum = "h1:Arh75ttbsvlpVA7WtVpH4u9h6Zl46xuptxqLxPiSo4Y=",
-        version = "v1.1.0",
-    )
 
     go_repository(
         name = "in_gopkg_check_v1",
@@ -5522,15 +5528,22 @@ def prysm_deps():
     go_repository(
         name = "org_golang_x_crypto",
         importpath = "golang.org/x/crypto",
-        sum = "h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=",
-        version = "v0.14.0",
+        sum = "h1:frVn1TEaCEaZcn3Tmd7Y2b5KKPaZ+I32Q2OA3kYp5TA=",
+        version = "v0.15.0",
     )
     go_repository(
         name = "org_golang_x_exp",
         importpath = "golang.org/x/exp",
-        sum = "h1:GoHiUyI/Tp2nVkLI2mCxVkOjsbSXD66ic0XW0js0R9g=",
-        version = "v0.0.0-20230905200255-921286631fa9",
+        sum = "h1:FRnLl4eNAQl8hwxVVC17teOw8kdjVDVAiFMtgUdTSRQ=",
+        version = "v0.0.0-20231110203233-9a3e6036ecaa",
     )
+    go_repository(
+        name = "org_golang_x_exp_typeparams",
+        importpath = "golang.org/x/exp/typeparams",
+        sum = "h1:1P7xPZEwZMoBoz0Yze5Nx2/4pxj6nw9ZqHWXqP0iRgQ=",
+        version = "v0.0.0-20231108232855-2478ac86f678",
+    )
+
     go_repository(
         name = "org_golang_x_image",
         importpath = "golang.org/x/image",
@@ -5554,15 +5567,15 @@ def prysm_deps():
     go_repository(
         name = "org_golang_x_mod",
         importpath = "golang.org/x/mod",
-        sum = "h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=",
-        version = "v0.12.0",
+        sum = "h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=",
+        version = "v0.14.0",
     )
 
     go_repository(
         name = "org_golang_x_net",
         importpath = "golang.org/x/net",
-        sum = "h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=",
-        version = "v0.17.0",
+        sum = "h1:mIYleuAkSbHh0tCv7RvjL3F6ZVbLjq4+R7zbOn3Kokg=",
+        version = "v0.18.0",
     )
     go_repository(
         name = "org_golang_x_oauth2",
@@ -5580,27 +5593,27 @@ def prysm_deps():
     go_repository(
         name = "org_golang_x_sync",
         importpath = "golang.org/x/sync",
-        sum = "h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=",
-        version = "v0.3.0",
+        sum = "h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=",
+        version = "v0.5.0",
     )
     go_repository(
         name = "org_golang_x_sys",
         importpath = "golang.org/x/sys",
-        sum = "h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=",
-        version = "v0.13.0",
+        sum = "h1:Vz7Qs629MkJkGyHxUlRHizWJRG2j8fbQKjELVSNhy7Q=",
+        version = "v0.14.0",
     )
     go_repository(
         name = "org_golang_x_term",
         importpath = "golang.org/x/term",
-        sum = "h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=",
-        version = "v0.13.0",
+        sum = "h1:LGK9IlZ8T9jvdy6cTdfKUCltatMFOehAQo9SRC46UQ8=",
+        version = "v0.14.0",
     )
 
     go_repository(
         name = "org_golang_x_text",
         importpath = "golang.org/x/text",
-        sum = "h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=",
-        version = "v0.13.0",
+        sum = "h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=",
+        version = "v0.14.0",
     )
     go_repository(
         name = "org_golang_x_time",
@@ -5611,8 +5624,8 @@ def prysm_deps():
     go_repository(
         name = "org_golang_x_tools",
         importpath = "golang.org/x/tools",
-        sum = "h1:Iey4qkscZuv0VvIt8E0neZjtPVQFSc870HQ448QgEmQ=",
-        version = "v0.13.0",
+        sum = "h1:zdAyfUGbYmuVokhzVmghFl2ZJh5QhcfebBgmVPFYA+8=",
+        version = "v0.15.0",
     )
 
     go_repository(
diff --git a/go.mod b/go.mod
index 3c0673ee6..98bd306d2 100644
--- a/go.mod
+++ b/go.mod
@@ -82,17 +82,18 @@ require (
 	go.etcd.io/bbolt v1.3.6
 	go.opencensus.io v0.24.0
 	go.uber.org/automaxprocs v1.5.2
-	golang.org/x/crypto v0.14.0
-	golang.org/x/exp v0.0.0-20230905200255-921286631fa9
-	golang.org/x/mod v0.12.0
-	golang.org/x/sync v0.3.0
-	golang.org/x/tools v0.13.0
+	golang.org/x/crypto v0.15.0
+	golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa
+	golang.org/x/mod v0.14.0
+	golang.org/x/sync v0.5.0
+	golang.org/x/tools v0.15.0
 	google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1
 	google.golang.org/grpc v1.56.3
 	google.golang.org/protobuf v1.30.0
 	gopkg.in/d4l3k/messagediff.v1 v1.2.1
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
+	honnef.co/go/tools v0.5.0-0.dev.0.20231205170804-aef76f4feee2
 	k8s.io/apimachinery v0.20.0
 	k8s.io/client-go v0.20.0
 )
@@ -232,10 +233,11 @@ require (
 	go.uber.org/fx v1.19.2 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.24.0 // indirect
-	golang.org/x/net v0.17.0 // indirect
+	golang.org/x/exp/typeparams v0.0.0-20231108232855-2478ac86f678 // indirect
+	golang.org/x/net v0.18.0 // indirect
 	golang.org/x/oauth2 v0.7.0 // indirect
-	golang.org/x/term v0.13.0 // indirect
-	golang.org/x/text v0.13.0 // indirect
+	golang.org/x/term v0.14.0 // indirect
+	golang.org/x/text v0.14.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.0.0 // indirect
@@ -256,7 +258,7 @@ require (
 	github.com/go-playground/validator/v10 v10.13.0
 	github.com/peterh/liner v1.2.0 // indirect
 	github.com/prysmaticlabs/gohashtree v0.0.3-alpha
-	golang.org/x/sys v0.13.0 // indirect
+	golang.org/x/sys v0.14.0 // indirect
 	google.golang.org/api v0.44.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	k8s.io/klog/v2 v2.80.0 // indirect
diff --git a/go.sum b/go.sum
index 0be2fa1b5..165016f32 100644
--- a/go.sum
+++ b/go.sum
@@ -1435,8 +1435,8 @@ golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
-golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
-golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
+golang.org/x/crypto v0.15.0 h1:frVn1TEaCEaZcn3Tmd7Y2b5KKPaZ+I32Q2OA3kYp5TA=
+golang.org/x/crypto v0.15.0/go.mod h1:4ChreQoLWfG3xLDer1WdlH5NdlQ3+mwnQq1YTKY+72g=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -1452,8 +1452,10 @@ golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EH
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
 golang.org/x/exp v0.0.0-20200331195152-e8c3332aa8e5/go.mod h1:4M0jN8W1tt0AVLNr8HDosyJCDCDuyL9N9+3m7wDWgKw=
 golang.org/x/exp v0.0.0-20220426173459-3bcf042a4bf5/go.mod h1:lgLbSvA5ygNOMpwM/9anMpWVlVJ7Z+cHWq/eFuinpGE=
-golang.org/x/exp v0.0.0-20230905200255-921286631fa9 h1:GoHiUyI/Tp2nVkLI2mCxVkOjsbSXD66ic0XW0js0R9g=
-golang.org/x/exp v0.0.0-20230905200255-921286631fa9/go.mod h1:S2oDrQGGwySpoQPVqRShND87VCbxmc6bL1Yd2oYrm6k=
+golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa h1:FRnLl4eNAQl8hwxVVC17teOw8kdjVDVAiFMtgUdTSRQ=
+golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa/go.mod h1:zk2irFbV9DP96SEBUUAy67IdHUaZuSnrz1n472HUCLE=
+golang.org/x/exp/typeparams v0.0.0-20231108232855-2478ac86f678 h1:1P7xPZEwZMoBoz0Yze5Nx2/4pxj6nw9ZqHWXqP0iRgQ=
+golang.org/x/exp/typeparams v0.0.0-20231108232855-2478ac86f678/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
 golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
@@ -1484,8 +1486,8 @@ golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/mod v0.6.0-dev.0.20211013180041-c96bc1413d57/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
-golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
+golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1550,8 +1552,8 @@ golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su
 golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
-golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
+golang.org/x/net v0.18.0 h1:mIYleuAkSbHh0tCv7RvjL3F6ZVbLjq4+R7zbOn3Kokg=
+golang.org/x/net v0.18.0/go.mod h1:/czyP5RqHAH4odGYxBJ1qz0+CE5WZ+2j1YgoEo8F2jQ=
 golang.org/x/oauth2 v0.0.0-20170912212905-13449ad91cb2/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181017192945-9dcd33a902f4/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -1584,8 +1586,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
+golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180810173357-98c5dad5d1a0/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1699,16 +1701,16 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
-golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.14.0 h1:Vz7Qs629MkJkGyHxUlRHizWJRG2j8fbQKjELVSNhy7Q=
+golang.org/x/sys v0.14.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20201210144234-2321bbc49cbf/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
-golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
-golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
+golang.org/x/term v0.14.0 h1:LGK9IlZ8T9jvdy6cTdfKUCltatMFOehAQo9SRC46UQ8=
+golang.org/x/term v0.14.0/go.mod h1:TySc+nGkYR6qt8km8wUhuFRTVSMIX3XPR58y2lC8vww=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1720,8 +1722,8 @@ golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/time v0.0.0-20170424234030-8be79e1e0910/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1808,8 +1810,8 @@ golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.8-0.20211029000441-d6a9af8af023/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.13.0 h1:Iey4qkscZuv0VvIt8E0neZjtPVQFSc870HQ448QgEmQ=
-golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.15.0 h1:zdAyfUGbYmuVokhzVmghFl2ZJh5QhcfebBgmVPFYA+8=
+golang.org/x/tools v0.15.0/go.mod h1:hpksKq4dtpQWS1uQ61JkdqWM3LscIS6Slf+VVkm+wQk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -2024,6 +2026,8 @@ honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.1.3/go.mod h1:NgwopIslSNH47DimFoV78dnkksY2EFtX0ajyb3K/las=
+honnef.co/go/tools v0.5.0-0.dev.0.20231205170804-aef76f4feee2 h1:VUeHARd+9362HPYyFWjsRa6jBIAf2xWbDv6QXMRztbQ=
+honnef.co/go/tools v0.5.0-0.dev.0.20231205170804-aef76f4feee2/go.mod h1:J8YyqAvNy0yWpeKUOCONA1m2G4hH2CqUSo/5ZO2/5UA=
 k8s.io/api v0.20.0 h1:WwrYoZNM1W1aQEbyl8HNG+oWGzLpZQBlcerS9BQw9yI=
 k8s.io/api v0.20.0/go.mod h1:HyLC5l5eoS/ygQYl1BXBgFzWNlkHiAuyNAbevIn+FKg=
 k8s.io/apimachinery v0.20.0 h1:jjzbTJRXk0unNS71L7h3lxGDH/2HPxMPaQY+MjECKL8=
diff --git a/tools/nogo_config/BUILD.bazel b/tools/nogo_config/BUILD.bazel
new file mode 100644
index 000000000..187509e76
--- /dev/null
+++ b/tools/nogo_config/BUILD.bazel
@@ -0,0 +1,27 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_binary")
+load("@prysm//tools/go:def.bzl", "go_library", "go_test")
+
+# gazelle:exclude hack.go
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "config.go",
+        "config_exclusion.go",
+        "main.go",
+    ],
+    importpath = "github.com/prysmaticlabs/prysm/v4/tools/nogo_config",
+    visibility = ["//visibility:private"],
+)
+
+go_binary(
+    name = "nogo_config",
+    embed = [":go_default_library"],
+    visibility = ["//visibility:public"],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["config_exclusion_test.go"],
+    embed = [":go_default_library"],
+)
diff --git a/tools/nogo_config/config.go b/tools/nogo_config/config.go
new file mode 100644
index 000000000..40f90add2
--- /dev/null
+++ b/tools/nogo_config/config.go
@@ -0,0 +1,13 @@
+package main
+
+// These Config types are copied from bazelbuild/rules_go.
+// License: Apache 2.0
+// https://github.com/bazelbuild/rules_go/blob/c90a11ad8dc5f3f9d633f0556b22c90af1b01116/go/tools/builders/generate_nogo_main.go#L193
+type Configs map[string]Config
+
+type Config struct {
+	Description   string
+	OnlyFiles     map[string]string `json:"only_files"`
+	ExcludeFiles  map[string]string `json:"exclude_files"`
+	AnalyzerFlags map[string]string `json:"analyzer_flags"`
+}
diff --git a/tools/nogo_config/config_exclusion.go b/tools/nogo_config/config_exclusion.go
new file mode 100644
index 000000000..d655b29eb
--- /dev/null
+++ b/tools/nogo_config/config_exclusion.go
@@ -0,0 +1,17 @@
+package main
+
+// AddExclusion adds an exclusion to the Configs, if they do not exist already.
+func (c Configs) AddExclusion(check string, exclusions []string) {
+	for _, e := range exclusions {
+		if cc, ok := c[check]; !ok {
+			c[check] = Config{
+				ExcludeFiles: make(map[string]string),
+			}
+		} else if cc.ExcludeFiles == nil {
+			cc.ExcludeFiles = make(map[string]string)
+		}
+		if _, ok := c[check].ExcludeFiles[e]; !ok {
+			c[check].ExcludeFiles[e] = exclusionMessage
+		}
+	}
+}
diff --git a/tools/nogo_config/config_exclusion_test.go b/tools/nogo_config/config_exclusion_test.go
new file mode 100644
index 000000000..fa5286d96
--- /dev/null
+++ b/tools/nogo_config/config_exclusion_test.go
@@ -0,0 +1,29 @@
+package main
+
+import "testing"
+
+func TestAddExclusion(t *testing.T) {
+	cfg := Configs{
+		"foo": Config{},
+	}
+
+	cfg.AddExclusion("sa0000", []string{"foo.go", "bar.go"})
+
+	if len(cfg["sa0000"].ExcludeFiles) != 2 {
+		t.Errorf("Expected 2 exclusions, got %d", len(cfg["sa0000"].ExcludeFiles))
+	}
+	if cfg["sa0000"].ExcludeFiles["foo.go"] != exclusionMessage {
+		t.Errorf("Expected exclusion message, got %s", cfg["sa0000"].ExcludeFiles["foo.go"])
+	}
+	if cfg["sa0000"].ExcludeFiles["bar.go"] != exclusionMessage {
+		t.Errorf("Expected exclusion message, got %s", cfg["sa0000"].ExcludeFiles["bar.go"])
+	}
+
+	cfg.AddExclusion("sa0000", []string{"foo.go", "baz.go"})
+	if len(cfg["sa0000"].ExcludeFiles) != 3 {
+		t.Errorf("Expected 3 exclusions, got %d", len(cfg["sa0000"].ExcludeFiles))
+	}
+	if cfg["sa0000"].ExcludeFiles["baz.go"] != exclusionMessage {
+		t.Errorf("Expected exclusion message, got %s", cfg["sa0000"].ExcludeFiles["baz.go"])
+	}
+}
diff --git a/tools/nogo_config/def.bzl b/tools/nogo_config/def.bzl
new file mode 100644
index 000000000..798d900e9
--- /dev/null
+++ b/tools/nogo_config/def.bzl
@@ -0,0 +1,75 @@
+"""
+Easily add exclusions to nogo_config.json. The tool also allows for hand written entries in the 
+input file to be preserved.
+
+Example usage:
+
+nogo_config_exclude(
+    name = "nogo_config_with_excludes",
+    input = "nogo_config.json",
+    exclude_files = [
+        "third_party/.*",
+        ".*_test\\.go",
+    ],
+    checks = [
+        "ifferr",
+        "sa0000",
+        "neverbuild",
+    ],
+)
+
+nogo(
+    name = "nogo",
+    config = ":nogo_config_with_excludes",
+    ...
+)
+"""
+
+def _nogo_config_exclude_impl(ctx):
+    input_file = ctx.attr.input.files.to_list()[0].path
+    output_file = ctx.outputs.out.path
+    exclude_files = ctx.attr.exclude_files
+    checks = ctx.attr.checks
+
+    ctx.actions.run(
+        executable = ctx.executable.tool,
+        inputs = ctx.attr.input.files,
+        outputs = [ctx.outputs.out],
+        arguments = [
+            "--input=%s" % input_file,
+            "--output=%s" % output_file,
+            "--checks=%s" % ",".join(checks),
+            "--exclude_files=%s" % ",".join(exclude_files),
+            "--silent",
+        ],
+        progress_message = "Generating nogo_config.json with exclusions.",
+    )
+
+nogo_config_exclude = rule(
+    implementation = _nogo_config_exclude_impl,
+    attrs = {
+        "input": attr.label(
+            mandatory = True,
+            allow_single_file = True,
+            doc = "The input nogo_config.json file.",
+        ),
+        "exclude_files": attr.string_list(
+            mandatory = False,
+            doc = "A list of regexes to exclude from the input file.",
+        ),
+        "checks": attr.string_list(
+            mandatory = True,
+            doc = "A list of checks to exclude.",
+        ),
+        "tool": attr.label(
+            executable = True,
+            cfg = "exec",
+            default = Label("@prysm//tools/nogo_config:nogo_config"),
+            doc = "The nogo config exclusion tool.",
+        ),
+    },
+    doc = "Generate a nogo_config.json file with exclusions.",
+    outputs = {
+        "out": "nogo_config.generated.json",
+    },
+)
diff --git a/tools/nogo_config/hack.go b/tools/nogo_config/hack.go
new file mode 100644
index 000000000..0ac1c7f52
--- /dev/null
+++ b/tools/nogo_config/hack.go
@@ -0,0 +1,5 @@
+package main
+
+import (
+	_ "honnef.co/go/tools/staticcheck" // Hack to keep go mod tidy happy. This dep is needed by bazel tooling.
+)
diff --git a/tools/nogo_config/main.go b/tools/nogo_config/main.go
new file mode 100644
index 000000000..ea1ab7941
--- /dev/null
+++ b/tools/nogo_config/main.go
@@ -0,0 +1,94 @@
+package main
+
+import (
+	"encoding/json"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+)
+
+const exclusionMessage = "Excluded by @prysm//tools/nogo_config tool"
+
+var (
+	defaultExclusions = []string{
+		"external/.*",
+	}
+)
+
+var (
+	input      = flag.String("input", "", "(required) input file")
+	output     = flag.String("output", "", "(required) output file")
+	checks     = flag.String("checks", "", "(required) comma separated list of checks to exclude")
+	exclusions = flag.String("exclude_files", strings.Join(defaultExclusions, ","), "exclusions file")
+	silent     = flag.Bool("silent", false, "disable logging")
+)
+
+func main() {
+	flag.Parse()
+
+	if *input == "" || *output == "" {
+		fmt.Println("Error: input and output must be specified. Review the help text.")
+		flag.Usage()
+		return
+	}
+
+	if *checks == "" {
+		fmt.Println("Error: checks must be specified. Review the help text.")
+		flag.Usage()
+		return
+	}
+
+	e := defaultExclusions
+	if *exclusions != "" {
+		e = strings.Split(*exclusions, ",")
+	}
+
+	f, err := os.Open(*input)
+	if err != nil {
+		fmt.Printf("Error: %v\n", err)
+		return
+	}
+	defer func() {
+		err := f.Close()
+		if err != nil {
+			panic(err)
+		}
+	}()
+	data, err := io.ReadAll(f)
+	if err != nil {
+		fmt.Printf("Error: %v\n", err)
+		return
+	}
+
+	var c Configs
+	if err := json.Unmarshal(data, &c); err != nil {
+		fmt.Printf("Error: %v\n", err)
+		return
+	}
+
+	for _, check := range strings.Split(*checks, ",") {
+		c.AddExclusion(strings.TrimSpace(check), e)
+	}
+
+	out, err := os.Create(*output)
+	if err != nil {
+		fmt.Printf("Error: %v\n", err)
+		return
+	}
+	defer func() {
+		err := out.Close()
+		if err != nil {
+			panic(err)
+		}
+	}()
+	if err := json.NewEncoder(out).Encode(c); err != nil {
+		fmt.Printf("Error: %v\n", err)
+		return
+	}
+
+	if !*silent {
+		fmt.Printf("Wrote %v\n", *output)
+	}
+}