diff --git a/client/pkg/client/client.go b/client/pkg/client/client.go
index c622d0a2..b1c5ffb9 100644
--- a/client/pkg/client/client.go
+++ b/client/pkg/client/client.go
@@ -6,10 +6,10 @@
 package client
 
 import (
-	"context"
 	"crypto/tls"
 	"net"
 	"net/url"
+	"slices"
 
 	"github.com/siderolabs/go-api-signature/pkg/client/auth"
 	"google.golang.org/grpc"
@@ -32,7 +32,7 @@ type Client struct {
 }
 
 // New creates a new Omni API client.
-func New(ctx context.Context, endpoint string, opts ...Option) (*Client, error) {
+func New(endpoint string, opts ...Option) (*Client, error) {
 	u, err := url.Parse(endpoint)
 	if err != nil {
 		return nil, err
@@ -65,7 +65,7 @@ func New(ctx context.Context, endpoint string, opts ...Option) (*Client, error)
 			grpc.WithStreamInterceptor(options.AuthInterceptor.Stream()))
 	}
 
-	grpcDialOptions = append(grpcDialOptions, options.AdditionalGRPCDialOptions...)
+	grpcDialOptions = slices.Concat(grpcDialOptions, options.AdditionalGRPCDialOptions)
 
 	switch u.Scheme {
 	case "https":
@@ -88,7 +88,7 @@ func New(ctx context.Context, endpoint string, opts ...Option) (*Client, error)
 		endpoint: u.String(),
 	}
 
-	c.conn, err = grpc.DialContext(ctx, u.Host, grpcDialOptions...) //nolint:staticcheck
+	c.conn, err = grpc.NewClient(u.Host, grpcDialOptions...)
 	if err != nil {
 		return nil, err
 	}
diff --git a/client/pkg/client/example_test.go b/client/pkg/client/example_test.go
index cdd736ea..a5348914 100644
--- a/client/pkg/client/example_test.go
+++ b/client/pkg/client/example_test.go
@@ -42,7 +42,7 @@ func Example() {
 	ctx := context.Background()
 
 	// Creating a new client.
-	client, err := client.New(ctx, "https://<account>.omni.siderolabs.io:443", client.WithServiceAccount(
+	client, err := client.New("https://<account>.omni.siderolabs.io:443", client.WithServiceAccount(
 		"base64encodedkey", // From the generated service account.
 	))
 	if err != nil {
diff --git a/client/pkg/omnictl/internal/access/client.go b/client/pkg/omnictl/internal/access/client.go
index 51349a77..6947cfd1 100644
--- a/client/pkg/omnictl/internal/access/client.go
+++ b/client/pkg/omnictl/internal/access/client.go
@@ -112,7 +112,7 @@ func WithClient(f func(ctx context.Context, client *client.Client) error, client
 			url = endpointEnv
 		}
 
-		client, err := client.New(ctx, url, opts...)
+		client, err := client.New(url, opts...)
 		if err != nil {
 			return err
 		}
diff --git a/cmd/integration-test/pkg/clientconfig/clientconfig.go b/cmd/integration-test/pkg/clientconfig/clientconfig.go
index b8bd4a10..5a689a3a 100644
--- a/cmd/integration-test/pkg/clientconfig/clientconfig.go
+++ b/cmd/integration-test/pkg/clientconfig/clientconfig.go
@@ -60,21 +60,21 @@ func New(endpoint string) *ClientConfig {
 //
 // Clients are cached by their configuration, so if a client with the
 // given configuration was created before, the cached one will be returned.
-func (t *ClientConfig) GetClient(ctx context.Context, publicKeyOpts ...authcli.RegisterPGPPublicKeyOption) (*client.Client, error) {
-	return t.GetClientForEmail(ctx, defaultEmail, publicKeyOpts...)
+func (t *ClientConfig) GetClient(publicKeyOpts ...authcli.RegisterPGPPublicKeyOption) (*client.Client, error) {
+	return t.GetClientForEmail(defaultEmail, publicKeyOpts...)
 }
 
 // GetClientForEmail returns a test client for the given email.
 //
 // Clients are cached by their configuration, so if a client with the
 // given configuration was created before, the cached one will be returned.
-func (t *ClientConfig) GetClientForEmail(ctx context.Context, email string, publicKeyOpts ...authcli.RegisterPGPPublicKeyOption) (*client.Client, error) {
+func (t *ClientConfig) GetClientForEmail(email string, publicKeyOpts ...authcli.RegisterPGPPublicKeyOption) (*client.Client, error) {
 	cacheKey := t.buildCacheKey(email, publicKeyOpts)
 
 	cliOrErr, _ := clientCache.GetOrCall(cacheKey, func() clientOrError {
 		signatureInterceptor := buildSignatureInterceptor(email, publicKeyOpts...)
 
-		cli, err := client.New(ctx, t.endpoint,
+		cli, err := client.New(t.endpoint,
 			client.WithGrpcOpts(
 				grpc.WithUnaryInterceptor(signatureInterceptor.Unary()),
 				grpc.WithStreamInterceptor(signatureInterceptor.Stream()),
diff --git a/cmd/integration-test/pkg/tests/auth.go b/cmd/integration-test/pkg/tests/auth.go
index f1c81247..78b75070 100644
--- a/cmd/integration-test/pkg/tests/auth.go
+++ b/cmd/integration-test/pkg/tests/auth.go
@@ -73,7 +73,7 @@ func AssertAnonymousAuthenication(testCtx context.Context, client *client.Client
 		_, err := client.Omni().State().List(ctx, resource.NewMetadata(resources.DefaultNamespace, omni.ClusterType, "", resource.VersionUndefined))
 		assert.Error(t, err)
 
-		assert.Equal(t, codes.Unauthenticated, status.Code(err))
+		assert.Equalf(t, codes.Unauthenticated, status.Code(err), "%s != %s", codes.Unauthenticated, status.Code(err))
 	}
 }
 
@@ -166,7 +166,7 @@ func AssertServiceAccountAPIFlow(testCtx context.Context, cli *client.Client) Te
 	return func(t *testing.T) {
 		name := "test-" + uuid.NewString()
 
-		saCli, armoredPublicKey, err := newServiceAccountClient(testCtx, cli, name)
+		saCli, armoredPublicKey, err := newServiceAccountClient(cli, name)
 		require.NoError(t, err)
 
 		defer saCli.Close() //nolint:errcheck
@@ -180,7 +180,7 @@ func AssertServiceAccountAPIFlow(testCtx context.Context, cli *client.Client) Te
 		assert.NoError(t, err)
 
 		// renew service account
-		renewedSACli, renewedArmoredPublicKey, err := newServiceAccountClient(testCtx, cli, name)
+		renewedSACli, renewedArmoredPublicKey, err := newServiceAccountClient(cli, name)
 		require.NoError(t, err)
 
 		defer renewedSACli.Close() //nolint:errcheck
@@ -232,7 +232,7 @@ func AssertServiceAccountAPIFlow(testCtx context.Context, cli *client.Client) Te
 	}
 }
 
-func newServiceAccountClient(testCtx context.Context, cli *client.Client, name string) (*client.Client, string, error) {
+func newServiceAccountClient(cli *client.Client, name string) (*client.Client, string, error) {
 	// generate a new PGP key with long lifetime
 	comment := fmt.Sprintf("%s/%s", runtime.GOOS, runtime.GOARCH)
 
@@ -260,7 +260,6 @@ func newServiceAccountClient(testCtx context.Context, cli *client.Client, name s
 
 	// create a new API client with the service account PGP signing interceptors
 	saCli, err := client.New(
-		testCtx,
 		cli.Endpoint(),
 		client.WithGrpcOpts(
 			grpc.WithUnaryInterceptor(interceptors.Unary()),
@@ -489,7 +488,7 @@ func AssertAPIAuthz(rootCtx context.Context, rootCli *client.Client, clientConfi
 		for _, tc := range testCases {
 			// test each test case without signature
 			t.Run(fmt.Sprintf("%s-no-signature", tc.namePrefix), func(t *testing.T) {
-				scopedClient, testErr := clientConfig.GetClient(rootCtx)
+				scopedClient, testErr := clientConfig.GetClient()
 				require.NoError(t, testErr)
 
 				// skip signing the request
@@ -521,7 +520,6 @@ func AssertAPIAuthz(rootCtx context.Context, rootCli *client.Client, clientConfi
 			// test with the role which should succeed
 			t.Run(fmt.Sprintf("%s-success", tc.namePrefix), func(t *testing.T) {
 				scopedClient, testErr := clientConfig.GetClient(
-					rootCtx,
 					authcli.WithRole(string(tc.requiredRole)),
 					authcli.WithSkipUserRole(true),
 				)
@@ -548,7 +546,6 @@ func AssertAPIAuthz(rootCtx context.Context, rootCli *client.Client, clientConfi
 
 			t.Run(fmt.Sprintf("%s-failure", tc.namePrefix), func(t *testing.T) {
 				scopedClient, testErr := clientConfig.GetClient(
-					rootCtx,
 					authcli.WithRole(string(failureRole)),
 					authcli.WithSkipUserRole(true))
 				require.NoError(t, testErr)
@@ -998,7 +995,6 @@ func AssertResourceAuthz(rootCtx context.Context, rootCli *client.Client, client
 
 					t.Run(name, func(t *testing.T) {
 						scopedCli, testErr := clientConfig.GetClient(
-							rootCtx,
 							authcli.WithRole(string(testRole)),
 							authcli.WithSkipUserRole(true),
 						)
@@ -1143,7 +1139,7 @@ func AssertResourceAuthzWithACL(ctx context.Context, rootCli *client.Client, cli
 
 		t.Cleanup(func() { destroy(ctx, t, rootCli, accessPolicy.Metadata()) })
 
-		userCli, err := clientConfig.GetClientForEmail(ctx, identity.Metadata().ID())
+		userCli, err := clientConfig.GetClientForEmail(identity.Metadata().ID())
 		require.NoError(t, err)
 
 		t.Cleanup(func() { userCli.Close() }) //nolint:errcheck
diff --git a/cmd/integration-test/pkg/tests/tests.go b/cmd/integration-test/pkg/tests/tests.go
index cb3817db..702765d4 100644
--- a/cmd/integration-test/pkg/tests/tests.go
+++ b/cmd/integration-test/pkg/tests/tests.go
@@ -69,7 +69,7 @@ type Options struct {
 //
 //nolint:maintidx
 func Run(ctx context.Context, clientConfig *clientconfig.ClientConfig, options Options) error {
-	rootClient, err := clientConfig.GetClient(ctx)
+	rootClient, err := clientConfig.GetClient()
 	if err != nil {
 		return err
 	}
diff --git a/cmd/omni/main.go b/cmd/omni/main.go
index 3c29f1e2..bf157458 100644
--- a/cmd/omni/main.go
+++ b/cmd/omni/main.go
@@ -174,7 +174,7 @@ func runWithState(logger *zap.Logger) func(context.Context, state.State, *virtua
 		linkCounterDeltaCh := make(chan siderolink.LinkCounterDeltas)
 		siderolinkEventsCh := make(chan *omnires.MachineStatusSnapshot)
 
-		discoveryClient, err := discovery.NewClient(ctx)
+		discoveryClient, err := discovery.NewClient()
 		if err != nil {
 			return fmt.Errorf("failed to create discovery client: %w", err)
 		}
diff --git a/internal/backend/discovery/client.go b/internal/backend/discovery/client.go
index 6fe8dce6..2edd5a03 100644
--- a/internal/backend/discovery/client.go
+++ b/internal/backend/discovery/client.go
@@ -30,8 +30,8 @@ type Client struct {
 }
 
 // NewClient creates a new discovery service client.
-func NewClient(ctx context.Context) (*Client, error) {
-	conn, err := createConn(ctx)
+func NewClient() (*Client, error) {
+	conn, err := createConn()
 	if err != nil {
 		return nil, fmt.Errorf("failed to create connection to discovery service: %w", err)
 	}
@@ -63,7 +63,7 @@ func (client *Client) Close() error {
 }
 
 // createConn creates a gRPC connection to the discovery service.
-func createConn(ctx context.Context) (*grpc.ClientConn, error) {
+func createConn() (*grpc.ClientConn, error) {
 	u, err := url.Parse(constants.DefaultDiscoveryServiceEndpoint)
 	if err != nil {
 		return nil, err
@@ -75,7 +75,7 @@ func createConn(ctx context.Context) (*grpc.ClientConn, error) {
 
 	opts = append(opts, grpc.WithSharedWriteBuffer(true))
 
-	discoveryConn, err := grpc.DialContext(ctx, net.JoinHostPort(u.Host, "443"), opts...) //nolint:staticcheck
+	discoveryConn, err := grpc.NewClient(net.JoinHostPort(u.Host, "443"), opts...)
 	if err != nil {
 		return nil, err
 	}
diff --git a/internal/backend/grpc/grpc_test.go b/internal/backend/grpc/grpc_test.go
index a586719c..a9d3343b 100644
--- a/internal/backend/grpc/grpc_test.go
+++ b/internal/backend/grpc/grpc_test.go
@@ -308,7 +308,7 @@ func (suite *GrpcSuite) newServer(imageFactoryClient *imagefactory.Client, logge
 		}
 	}()
 
-	suite.conn, err = grpc.DialContext(suite.ctx, grpcAddress, grpc.WithTransportCredentials(insecure.NewCredentials())) //nolint:staticcheck
+	suite.conn, err = grpc.NewClient(grpcAddress, grpc.WithTransportCredentials(insecure.NewCredentials()))
 	if err != nil {
 		return err
 	}
diff --git a/internal/backend/grpc/router/router.go b/internal/backend/grpc/router/router.go
index 1abaf40c..ee6fde25 100644
--- a/internal/backend/grpc/router/router.go
+++ b/internal/backend/grpc/router/router.go
@@ -75,7 +75,12 @@ func NewRouter(
 	authEnabled bool,
 	verifier grpc.UnaryServerInterceptor,
 ) (*Router, error) {
-	omniConn, err := grpc.Dial(transport.Address, //nolint:staticcheck
+	address := transport.Address
+	if address == "grpc-conn" {
+		address = "passthrough:whatever"
+	}
+
+	omniConn, err := grpc.NewClient(address,
 		grpc.WithContextDialer(func(context.Context, string) (net.Conn, error) {
 			return transport.Dial()
 		}),
@@ -246,8 +251,7 @@ func (r *Router) getConn(ctx context.Context, contextName string) (*grpc.ClientC
 		grpc.WithSharedWriteBuffer(true),
 	}
 
-	return grpc.DialContext( //nolint:staticcheck
-		ctx,
+	return grpc.NewClient(
 		endpoint,
 		opts...,
 	)
diff --git a/internal/backend/grpc/router/talos_backend_test.go b/internal/backend/grpc/router/talos_backend_test.go
index b2a62ca4..516e0de0 100644
--- a/internal/backend/grpc/router/talos_backend_test.go
+++ b/internal/backend/grpc/router/talos_backend_test.go
@@ -57,7 +57,7 @@ func TestTalosBackendRoles(t *testing.T) {
 
 	t.Cleanup(func() { require.NoError(t, g.Wait()) })
 
-	conn := must.Value(grpc.DialContext(ctx, proxyEndpoint, grpc.WithTransportCredentials(insecure.NewCredentials())))(t) //nolint:staticcheck
+	conn := must.Value(grpc.NewClient(proxyEndpoint, grpc.WithTransportCredentials(insecure.NewCredentials())))(t)
 	rebootResult := must.Value(machine.NewMachineServiceClient(conn).Reboot(ctx, &machine.RebootRequest{Mode: 0}))(t)
 	require.NotNil(t, rebootResult)
 
@@ -96,8 +96,8 @@ type testDirector struct {
 	serverEndpoint string
 }
 
-func (t *testDirector) Director(ctx context.Context, _ string) (proxy.Mode, []proxy.Backend, error) {
-	conn, err := dial(ctx, t.serverEndpoint)
+func (t *testDirector) Director(context.Context, string) (proxy.Mode, []proxy.Backend, error) {
+	conn, err := dial(t.serverEndpoint)
 	if err != nil {
 		return 0, nil, err
 	}
@@ -115,7 +115,7 @@ func (t *testDirector) Director(ctx context.Context, _ string) (proxy.Mode, []pr
 	return proxy.One2One, []proxy.Backend{backend}, nil
 }
 
-func dial(ctx context.Context, serverEndpoint string) (*grpc.ClientConn, error) {
+func dial(serverEndpoint string) (*grpc.ClientConn, error) {
 	backoffConfig := backoff.DefaultConfig
 	backoffConfig.MaxDelay = 15 * time.Second
 
@@ -131,7 +131,7 @@ func dial(ctx context.Context, serverEndpoint string) (*grpc.ClientConn, error)
 		grpc.WithCodec(proxy.Codec()), //nolint:staticcheck
 	}
 
-	return grpc.DialContext(ctx, serverEndpoint, opts...) //nolint:staticcheck
+	return grpc.NewClient(serverEndpoint, opts...)
 }
 
 func startTestServer(lis net.Listener) (closer func() error) {
diff --git a/internal/pkg/auth/interceptor/signature_test.go b/internal/pkg/auth/interceptor/signature_test.go
index cd667ee4..61544a35 100644
--- a/internal/pkg/auth/interceptor/signature_test.go
+++ b/internal/pkg/auth/interceptor/signature_test.go
@@ -93,7 +93,7 @@ func (suite *SignatureTestSuite) SetupSuite() {
 		grpc.WithTransportCredentials(insecure.NewCredentials()),
 	}
 
-	suite.clientConn, err = grpc.Dial(suite.Target, dialOptions...) //nolint:staticcheck
+	suite.clientConn, err = grpc.NewClient(suite.Target, dialOptions...)
 	suite.Require().NoError(err)
 
 	suite.testServiceClient = grpc_testing.NewTestServiceClient(suite.clientConn)
diff --git a/internal/pkg/grpcutil/logger_test.go b/internal/pkg/grpcutil/logger_test.go
index 598b525a..7218a791 100644
--- a/internal/pkg/grpcutil/logger_test.go
+++ b/internal/pkg/grpcutil/logger_test.go
@@ -74,7 +74,8 @@ func TestPayloadUnaryServerInterceptor(t *testing.T) {
 		errCh <- server.Serve(listener)
 	}()
 
-	dial, err := grpc.Dial(listener.Addr().String(), //nolint:staticcheck
+	dial, err := grpc.NewClient(
+		listener.Addr().String(),
 		grpc.WithTransportCredentials(insecure.NewCredentials()),
 	)
 	if err != nil {
diff --git a/internal/pkg/siderolink/siderolink_test.go b/internal/pkg/siderolink/siderolink_test.go
index e69ba602..55f1bcbf 100644
--- a/internal/pkg/siderolink/siderolink_test.go
+++ b/internal/pkg/siderolink/siderolink_test.go
@@ -179,7 +179,7 @@ func (suite *SiderolinkSuite) TestNodes() {
 		spec = r.TypedSpec().Value
 	})
 
-	conn, err := grpc.DialContext(suite.ctx, suite.address, grpc.WithTransportCredentials(insecure.NewCredentials())) //nolint:staticcheck
+	conn, err := grpc.NewClient(suite.address, grpc.WithTransportCredentials(insecure.NewCredentials()))
 	suite.Require().NoError(err)
 
 	client := pb.NewProvisionServiceClient(conn)
@@ -267,7 +267,7 @@ func (suite *SiderolinkSuite) TestVirtualNodes() {
 		spec = r.TypedSpec().Value
 	})
 
-	conn, err := grpc.DialContext(suite.ctx, suite.address, grpc.WithTransportCredentials(insecure.NewCredentials())) //nolint:staticcheck
+	conn, err := grpc.NewClient(suite.address, grpc.WithTransportCredentials(insecure.NewCredentials()))
 	suite.Require().NoError(err)
 
 	client := pb.NewProvisionServiceClient(conn)