diff --git a/.golangci.yml b/.golangci.yml
index e9004a23..8dee07f5 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -38,3 +38,7 @@ linters-settings:
 
   goimports:
     local-prefixes: github.com/cloudbase/garm
+
+  gosec:
+    excludes:
+    - G115
diff --git a/Makefile b/Makefile
index 2a997f66..98c12805 100644
--- a/Makefile
+++ b/Makefile
@@ -57,6 +57,17 @@ create-release-files:
 release: build-static create-release-files ## Create a release
 
 ##@ Lint / Verify
+GOLANGCI_LINT ?= $(LOCALBIN)/golangci-lint
+
+## Tool Versions
+GOLANGCI_LINT_VERSION ?= v1.61.0
+
+.PHONY: golangci-lint
+golangci-lint: $(GOLANGCI_LINT) ## Download golangci-lint locally if necessary. If wrong version is installed, it will be overwritten.
+$(GOLANGCI_LINT): $(LOCALBIN)
+	test -s $(LOCALBIN)/golangci-lint && $(LOCALBIN)/golangci-lint --version | grep -q $(GOLANGCI_LINT_VERSION) || \
+	GOBIN=$(LOCALBIN) go install github.com/golangci/golangci-lint/cmd/golangci-lint@$(GOLANGCI_LINT_VERSION)
+
 .PHONY: lint
 lint: golangci-lint $(GOLANGCI_LINT) ## Run linting.
 	$(GOLANGCI_LINT) run -v --build-tags=testing,integration $(GOLANGCI_LINT_EXTRA_ARGS)
diff --git a/database/sql/jobs.go b/database/sql/jobs.go
index 887e041f..b7dda926 100644
--- a/database/sql/jobs.go
+++ b/database/sql/jobs.go
@@ -84,7 +84,8 @@ func (s *sqlDatabase) paramsJobToWorkflowJob(ctx context.Context, job params.Job
 	if job.RunnerName != "" {
 		instance, err := s.getInstanceByName(s.ctx, job.RunnerName)
 		if err != nil {
-			slog.With(slog.Any("error", err)).ErrorContext(ctx, "failed to get instance by name")
+			// This usually is very normal as not all jobs run on our runners.
+			slog.DebugContext(ctx, "failed to get instance by name", "instance_name", job.RunnerName)
 		} else {
 			workflofJob.InstanceID = &instance.ID
 		}
@@ -244,7 +245,8 @@ func (s *sqlDatabase) CreateOrUpdateJob(ctx context.Context, job params.Job) (pa
 			if err == nil {
 				workflowJob.InstanceID = &instance.ID
 			} else {
-				slog.With(slog.Any("error", err)).ErrorContext(ctx, "failed to get instance by name")
+				// This usually is very normal as not all jobs run on our runners.
+				slog.DebugContext(ctx, "failed to get instance by name", "instance_name", job.RunnerName)
 			}
 		}
 
diff --git a/database/sql/util.go b/database/sql/util.go
index 0b47b962..063ebe0d 100644
--- a/database/sql/util.go
+++ b/database/sql/util.go
@@ -402,7 +402,7 @@ func (s *sqlDatabase) updatePool(tx *gorm.DB, pool Pool, param params.UpdatePool
 	}
 
 	tags := []Tag{}
-	if param.Tags != nil && len(param.Tags) > 0 {
+	if len(param.Tags) > 0 {
 		for _, val := range param.Tags {
 			t, err := s.getOrCreateTag(tx, val)
 			if err != nil {
diff --git a/runner/pool/pool.go b/runner/pool/pool.go
index 4d317dd9..cca22d4f 100644
--- a/runner/pool/pool.go
+++ b/runner/pool/pool.go
@@ -145,6 +145,13 @@ func (r *basePoolManager) HandleWorkflowJob(job params.WorkflowJob) error {
 		return errors.Wrap(err, "validating owner")
 	}
 
+	// we see events where the lables seem to be missing. We should ignore these
+	// as we can't know if we should handle them or not.
+	if len(job.WorkflowJob.Labels) == 0 {
+		slog.WarnContext(r.ctx, "job has no labels", "workflow_job", job.WorkflowJob.Name)
+		return nil
+	}
+
 	var jobParams params.Job
 	var err error
 	var triggeredBy int64