diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a32c32e..7a20df9 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -11,7 +11,7 @@ jobs:
     strategy:
       matrix:
         platform: [ubuntu-latest]
-        otp-version: [22, 23, 24, 25, 26]
+        otp-version: [23, 24, 25, 26, 27]
     runs-on: ${{ matrix.platform }}
     container:
       image: erlang:${{ matrix.otp-version }}
@@ -64,7 +64,7 @@ jobs:
     strategy:
       matrix:
         platform: [ubuntu-latest]
-        otp-version: [24, 25, 26]
+        otp-version: [24, 25, 26, 27]
     runs-on: ${{ matrix.platform }}
     container:
       image: erlang:${{ matrix.otp-version }}
@@ -86,4 +86,4 @@ jobs:
         restore-keys: |
           ${{ runner.os }}-dialyzer-
     - name: Generate docs
-      run: rebar3 ex_doc
\ No newline at end of file
+      run: rebar3 ex_doc
diff --git a/rebar.config b/rebar.config
index 7c17135..30e7b88 100644
--- a/rebar.config
+++ b/rebar.config
@@ -40,4 +40,4 @@
               , deprecated_functions
               ]}.
 
-{plugins, [ {rebar3_lint, "0.3.2"} ]}.
+{plugins, [ {rebar3_lint, "3.0.1"} ]}.
diff --git a/rebar.lock b/rebar.lock
index d98d1f7..1ac268d 100644
--- a/rebar.lock
+++ b/rebar.lock
@@ -1,14 +1,14 @@
 {"1.2.0",
 [{<<"eini">>,{pkg,<<"eini_beam">>,<<"2.2.4">>},0},
- {<<"iso8601">>,{pkg,<<"iso8601">>,<<"1.3.1">>},0},
+ {<<"iso8601">>,{pkg,<<"iso8601">>,<<"1.3.4">>},0},
  {<<"jsx">>,{pkg,<<"jsx">>,<<"3.1.0">>},0}]}.
 [
 {pkg_hash,[
  {<<"eini">>, <<"02143B1DCE4DDA4243248E7D9B3D8274B8D9F5A666445E3D868E2CCE79E4FF22">>},
- {<<"iso8601">>, <<"D1CEE73F56D71C35590C6B2DB2074873BF410BABAAB768F6EA566366D8CA4810">>},
+ {<<"iso8601">>, <<"7B1F095F86F6CF65E1E5A77872E8E8BF69BD58D4C3A415B3F77D9CC9423ECBB9">>},
  {<<"jsx">>, <<"D12516BAA0BB23A59BB35DCCAF02A1BD08243FCBB9EFE24F2D9D056CCFF71268">>}]},
 {pkg_hash_ext,[
  {<<"eini">>, <<"12DE479D144B19E09BB92BA202A7EA716739929AFDF9DFF01AD802E2B1508471">>},
- {<<"iso8601">>, <<"A8B00594F4309A41D17BA4AEAB2B94DFE1F4BE99F263BC1F46DAC9002CE99A29">>},
+ {<<"iso8601">>, <<"A334469C07F1C219326BC891A95F5EEC8EB12DD8071A3FFF56A7843CB20FAE34">>},
  {<<"jsx">>, <<"0C5CC8FDC11B53CC25CF65AC6705AD39E54ECC56D1C22E4ADB8F5A53FB9427F3">>}]}
 ].
diff --git a/src/aws_credentials.erl b/src/aws_credentials.erl
index f11cc0a..ee2efed 100644
--- a/src/aws_credentials.erl
+++ b/src/aws_credentials.erl
@@ -41,7 +41,8 @@
                , tref = undefined :: reference()
                                    | undefined
                }).
--type state() :: #state{}.
+-opaque state() :: #state{}.
+-export_type([state/0]). % for linter only
 
 -type credentials() :: #{ credential_provider := aws_credentials_provider:provider()
                         , access_key_id := access_key_id()
@@ -128,9 +129,9 @@ terminate(_Reason, _State) ->
 
 -spec handle_call(any(), any(), state()) ->
         {'noreply', _} | {'reply', any(), state()}.
-handle_call(get_credentials, _From, State=#state{credentials=C}) ->
+handle_call(get_credentials, _From, #state{credentials=C}=State) ->
     {reply, C, State};
-handle_call({force_refresh, Options}, _From, State=#state{tref=T}) ->
+handle_call({force_refresh, Options}, _From, #state{tref=T}=State) ->
     {ok, C, NewT} = fetch_credentials(Options),
     case is_reference(T) of
         true -> erlang:cancel_timer(T);
diff --git a/src/aws_credentials_app.erl b/src/aws_credentials_app.erl
index add4671..4aa78c7 100644
--- a/src/aws_credentials_app.erl
+++ b/src/aws_credentials_app.erl
@@ -11,9 +11,9 @@
 %% API
 %%====================================================================
 
--spec start( 'normal'
-           | {takeover, Node :: node()}
-           | {failover, Node :: node()}, any()) -> {ok, pid()}.
+-spec start('normal'
+          | {takeover, Node :: node()}
+          | {failover, Node :: node()}, any()) -> {ok, pid()}.
 start(_StartType, _StartArgs) ->
     aws_credentials_httpc:start(),
     aws_credentials_sup:start_link().
diff --git a/src/aws_credentials_httpc.erl b/src/aws_credentials_httpc.erl
index b9e75e5..d41bb70 100644
--- a/src/aws_credentials_httpc.erl
+++ b/src/aws_credentials_httpc.erl
@@ -32,14 +32,15 @@
 -type headers() :: [header()].
 -type response() :: {'error', response_error()} | {'ok', status_code(), body(), headers()}.
 
--export_type([response/0, response_error/0, status_code/0, body/0, headers/0]).
-
--spec start() -> ok.
+-export_type([response/0, response_error/0, status_code/0, body/0,
+              headers/0, header/0, url/0, method/0]).
 
 -include_lib("kernel/include/logger.hrl").
 
+-spec start() -> ok.
 start() ->
-    inets:start(httpc, [{profile, ?PROFILE}]).
+    _ = inets:start(httpc, [{profile, ?PROFILE}]),
+    ok.
 
 %% @doc Attempt to request a URL with the 3 retries. 3 is the default.
 -spec request(method(), url()) -> response().
@@ -58,7 +59,7 @@ request(Method, URL, RequestHeaders) ->
 %% successfully get the desired data. That is, it will return an
 %% ok tuple with a status code of 500 or 404 or some other HTTP error
 %% code and no data.
--spec request(method(), url(), [header()], pos_integer() ) -> response().
+-spec request(method(), url(), [header()], pos_integer()) -> response().
 request(Method, URL, RequestHeaders, Tries) when is_atom(Method)
                      andalso is_list(URL)
                      andalso is_integer(Tries)
diff --git a/src/aws_credentials_provider.erl b/src/aws_credentials_provider.erl
index 9ea7430..a3d95c9 100644
--- a/src/aws_credentials_provider.erl
+++ b/src/aws_credentials_provider.erl
@@ -38,7 +38,7 @@
                   | aws_credentials_ec2
                   | module().
 -type error_log() :: [{provider(), term()}].
--export_type([ options/0, expiration/0, provider/0 ]).
+-export_type([ options/0, expiration/0, provider/0, error_log/0 ]).
 
 -callback fetch(options()) ->
   {ok, aws_credentials:credentials(), expiration()} | {error, any()}.