diff --git a/.github/workflows/check-flake.yml b/.github/workflows/check-flake.yml
index 11bfd385..d8083b94 100644
--- a/.github/workflows/check-flake.yml
+++ b/.github/workflows/check-flake.yml
@@ -2,7 +2,7 @@ name: Check Nix flake
 on:
   pull_request:
     paths:
-      - '**.nix'
+      - "**.nix"
       - flake.lock
   push:
     branches:
@@ -11,9 +11,9 @@ jobs:
   check-flake:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/magic-nix-cache-action@main
+      - uses: actions/checkout@v6
+      - uses: DeterminateSystems/nix-installer-action@v22
+      - uses: DeterminateSystems/magic-nix-cache-action@v13
       - name: Check Nix flake inputs
         uses: DeterminateSystems/flake-checker-action@v5
         with:
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index f1a1be64..2ad0ba0e 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -2,26 +2,26 @@ name: Test and Validate
 on:
   push:
     paths-ignore:
-      - '**.md'
-      - '.github/ISSUE_TEMPLATE/**'
+      - "**.md"
+      - ".github/ISSUE_TEMPLATE/**"
   pull_request:
     paths-ignore:
-      - '**.md'
-      - '.github/ISSUE_TEMPLATE/**'
+      - "**.md"
+      - ".github/ISSUE_TEMPLATE/**"
 
 jobs:
   build:
     name: Test
     runs-on: ubuntu-latest
     steps:
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@v6
+
       - name: Set up Go 1.x
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v6
         with:
           go-version: ^1.18
 
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v3
-
       - name: Test
         run: make test
 
@@ -31,17 +31,17 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
       - name: "Set up Go 1.x"
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v6
         with:
           go-version: 1.19
 
-      - name: Check out code
-        uses: actions/checkout@v3
-
-      - name: Lint with golanci-lint
-        uses: golangci/golangci-lint-action@v3
+      - name: Lint with golangci-lint
+        uses: golangci/golangci-lint-action@v9
         with:
           # version of golangci-lint to use
           # Version should stay in sync with version used for local linting (lint job in Makefile).
-          version: v1.50.1
+          version: v2.12.2
diff --git a/.github/workflows/update-flake-dependencies.yml b/.github/workflows/update-flake-dependencies.yml
index 0bfc1225..0ab5638d 100644
--- a/.github/workflows/update-flake-dependencies.yml
+++ b/.github/workflows/update-flake-dependencies.yml
@@ -2,15 +2,15 @@
 name: Update flake dependencies
 on:
   schedule:
-    - cron: '0 16 * * 5'
+    - cron: "0 16 * * 5"
   workflow_dispatch: # for allowing manual triggers of the workflow
 jobs:
   update-dependencies:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/magic-nix-cache-action@main
+      - uses: actions/checkout@v6
+      - uses: DeterminateSystems/nix-installer-action@v22
+      - uses: DeterminateSystems/magic-nix-cache-action@v13
       - name: Update flake.lock and create signed commit with flake.lock changes
         env:
           GITHUB_TOKEN: ${{ secrets.OP_BOT_TOKEN }}
diff --git a/.golangci.yml b/.golangci.yml
index e1bb4d03..6d0a4c17 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,26 +1,29 @@
+version: "2"
 linters:
-  disable-all: true
+  default: none
   enable:
     # Defaults:
-    - errcheck
-    - gosimple
     - govet
     - ineffassign
-    - staticcheck
-    - typecheck
     - unused
     # Extra:
     - asciicheck
     - bidichk
+  disable:
+    # Scott L: currently these produce errors that need to be fixed in a seprate PR
+    - errcheck
     - depguard
-    - goimports
-    - gofmt
+    - staticcheck
+
+  settings:
+    depguard:
+      rules:
+        main:
+          deny:
+            - pkg: math/rand
+              desc: "please use the safer crypto/rand"
 
-linters-settings:
-  depguard:
-    list-type: blacklist
-    include-go-root: false
-    packages:
-      - math/rand
-    packages-with-error-message:
-      - math/rand: "please use the safer crypto/rand"
+formatters:
+  enable:
+    - gofmt
+    - goimports
diff --git a/Makefile b/Makefile
index 91eb70e6..2948a819 100644
--- a/Makefile
+++ b/Makefile
@@ -44,7 +44,7 @@ test:
 
 lint:
 	# Version used should stay in sync with version in CI (.github/workflows/test.yaml).
-	docker run --rm -v $(pwd):/app -w /app golangci/golangci-lint:v1.50.1 golangci-lint run
+	docker run --rm -v $(pwd):/app -w /app golangci/golangci-lint:v2.12.2 golangci-lint run
 
 %/remove-local: beta-notice
 	$(eval plugin := $(firstword $(subst /, ,$@)))
diff --git a/flake.lock b/flake.lock
index f15a97b5..78ac2651 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1756035328,
-        "narHash": "sha256-vC7SslUBCtdT3T37ZH3PLIWYmTkSeppL5BJJByUjYCM=",
+        "lastModified": 1778124196,
+        "narHash": "sha256-pYEytCNic/czazbV9r3tbQ6BZzqRBg/41x2dIC5ymOo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6b0b1559e918d4f7d1df398ee1d33aeac586d4d6",
+        "rev": "68a8af93ff4297686cb68880845e61e5e2e41d92",
         "type": "github"
       },
       "original": {