diff --git a/.golangci.yml b/.golangci.yml
index 1c7741a01a..3e2c1d8e51 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -6,6 +6,7 @@ linters:
     - unconvert
     - staticcheck
     - ineffassign
+    - unparam
 
 issues:
   # Disable the default exclude list so that all excludes are explicitly
@@ -16,7 +17,36 @@ issues:
     # Temp Ignore SA9004: only the first constant in this group has an explicit type
     # https://staticcheck.io/docs/checks#SA9004
     - linters: [staticcheck]
-      text: "SA9004:"
+      text: 'SA9004:'
+
+    # An argument that always receives the same value is often not a problem.
+    - linters: [unparam]
+      text: 'always receives'
+
+    # Often functions will implement an interface that returns an error without
+    # needing to return an error. Sometimes the error return value is unnecessary
+    # but a linter can not tell the difference.
+    - linters: [unparam]
+      text: 'result \d+ \(error\) is always nil'
+
+    # Allow unused parameters to start with an underscore. Arguments with a name
+    # of '_' are already ignored.
+    # Ignoring longer names that start with underscore allow for better
+    # self-documentation than a single underscore by itself.  Underscore arguments
+    # should generally only be used when a function is implementing an interface.
+    - linters: [unparam]
+      text: '`_[^`]*` is unused'
+
+    # Temp ignore some common unused parameters so that unparam can be added
+    # incrementally.
+    - linters: [unparam]
+      text: '`(t|resp|req|entMeta)` is unused'
+
+    # Temp ignore everything in _oss(_test).go and _ent(_test).go. Many of these
+    # could use underscore to ignore the unused arguments, but the "always returns"
+    # issue will likely remain in oss, and will need to be excluded.
+    - linters: [unparam]
+      path: '(_oss.go|_oss_test.go|_ent.go|_ent_test.go)'
 
 linters-settings:
   gofmt:
diff --git a/agent/connect/ca/provider_consul.go b/agent/connect/ca/provider_consul.go
index c748220673..15c903133f 100644
--- a/agent/connect/ca/provider_consul.go
+++ b/agent/connect/ca/provider_consul.go
@@ -139,7 +139,7 @@ func (c *ConsulProvider) State() (map[string]string, error) {
 
 // ActiveRoot returns the active root CA certificate.
 func (c *ConsulProvider) ActiveRoot() (string, error) {
-	_, providerState, err := c.getState()
+	providerState, err := c.getState()
 	if err != nil {
 		return "", err
 	}
@@ -150,7 +150,7 @@ func (c *ConsulProvider) ActiveRoot() (string, error) {
 // GenerateRoot initializes a new root certificate and private key
 // if needed.
 func (c *ConsulProvider) GenerateRoot() error {
-	_, providerState, err := c.getState()
+	providerState, err := c.getState()
 	if err != nil {
 		return err
 	}
@@ -205,7 +205,7 @@ func (c *ConsulProvider) GenerateRoot() error {
 // GenerateIntermediateCSR creates a private key and generates a CSR
 // for another datacenter's root to sign.
 func (c *ConsulProvider) GenerateIntermediateCSR() (string, error) {
-	_, providerState, err := c.getState()
+	providerState, err := c.getState()
 	if err != nil {
 		return "", err
 	}
@@ -249,7 +249,7 @@ func (c *ConsulProvider) GenerateIntermediateCSR() (string, error) {
 // SetIntermediate validates that the given intermediate is for the right private key
 // and writes the given intermediate and root certificates to the state.
 func (c *ConsulProvider) SetIntermediate(intermediatePEM, rootPEM string) error {
-	_, providerState, err := c.getState()
+	providerState, err := c.getState()
 	if err != nil {
 		return err
 	}
@@ -289,7 +289,7 @@ func (c *ConsulProvider) ActiveIntermediate() (string, error) {
 		return c.ActiveRoot()
 	}
 
-	_, providerState, err := c.getState()
+	providerState, err := c.getState()
 	if err != nil {
 		return "", err
 	}
@@ -325,7 +325,7 @@ func (c *ConsulProvider) Sign(csr *x509.CertificateRequest) (string, error) {
 	defer c.Unlock()
 
 	// Get the provider state
-	_, providerState, err := c.getState()
+	providerState, err := c.getState()
 	if err != nil {
 		return "", err
 	}
@@ -437,7 +437,7 @@ func (c *ConsulProvider) Sign(csr *x509.CertificateRequest) (string, error) {
 // are met. It should return a signed CA certificate with a path length constraint
 // of 0 to ensure that the certificate cannot be used to generate further CA certs.
 func (c *ConsulProvider) SignIntermediate(csr *x509.CertificateRequest) (string, error) {
-	_, providerState, err := c.getState()
+	providerState, err := c.getState()
 	if err != nil {
 		return "", err
 	}
@@ -520,7 +520,7 @@ func (c *ConsulProvider) CrossSignCA(cert *x509.Certificate) (string, error) {
 	}
 
 	// Get the provider state
-	_, providerState, err := c.getState()
+	providerState, err := c.getState()
 	if err != nil {
 		return "", err
 	}
@@ -586,18 +586,18 @@ func (c *ConsulProvider) SupportsCrossSigning() (bool, error) {
 
 // getState returns the current provider state from the state delegate, and returns
 // ErrNotInitialized if no entry is found.
-func (c *ConsulProvider) getState() (uint64, *structs.CAConsulProviderState, error) {
+func (c *ConsulProvider) getState() (*structs.CAConsulProviderState, error) {
 	stateStore := c.Delegate.State()
-	idx, providerState, err := stateStore.CAProviderState(c.id)
+	_, providerState, err := stateStore.CAProviderState(c.id)
 	if err != nil {
-		return 0, nil, err
+		return nil, err
 	}
 
 	if providerState == nil {
-		return 0, nil, ErrNotInitialized
+		return nil, ErrNotInitialized
 	}
 
-	return idx, providerState, nil
+	return providerState, nil
 }
 
 func (c *ConsulProvider) incrementAndGetNextSerialNumber() (uint64, error) {
diff --git a/agent/dns.go b/agent/dns.go
index 604b682090..eee8e9c79c 100644
--- a/agent/dns.go
+++ b/agent/dns.go
@@ -1138,7 +1138,8 @@ func trimUDPResponse(req, resp *dns.Msg, udpAnswerLimit int) (trimmed bool) {
 }
 
 // trimDNSResponse will trim the response for UDP and TCP
-func (d *DNSServer) trimDNSResponse(cfg *dnsConfig, network string, req, resp *dns.Msg) (trimmed bool) {
+func (d *DNSServer) trimDNSResponse(cfg *dnsConfig, network string, req, resp *dns.Msg) {
+	var trimmed bool
 	if network != "tcp" {
 		trimmed = trimUDPResponse(req, resp, cfg.UDPAnswerLimit)
 	} else {
@@ -1148,7 +1149,6 @@ func (d *DNSServer) trimDNSResponse(cfg *dnsConfig, network string, req, resp *d
 	if trimmed && cfg.EnableTruncate {
 		resp.Truncated = true
 	}
-	return trimmed
 }
 
 // lookupServiceNodes returns nodes with a given service.