diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index 49533a17e3..bddfcf8e36 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -17,7 +17,7 @@ jobs:
         with:
           go-version-file: go.mod
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6.1.1
+        uses: golangci/golangci-lint-action@2226d7cb06a077cd73e56eedd38eecad18e5d837 # v6.5.0
         with:
           version: v1.55.1
           args: --timeout=8m
diff --git a/.github/workflows/test_crdb.yaml b/.github/workflows/test_crdb.yaml
index 2a1a5beb9f..4ccece1152 100644
--- a/.github/workflows/test_crdb.yaml
+++ b/.github/workflows/test_crdb.yaml
@@ -25,7 +25,7 @@ jobs:
         check-latest: true
         cache: true
 
-    - uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6.1.1
+    - uses: golangci/golangci-lint-action@2226d7cb06a077cd73e56eedd38eecad18e5d837 # v6.5.0
       with:
         version: 'v1.55.1'
         args: ./storage/crdb
@@ -62,7 +62,7 @@ jobs:
       run: docker run --rm -d --name=roach -p 8080:8080 -p 26257:26257 -v "${PWD}/cockroach-data:/cockroach/cockroach-data"  cockroachdb/cockroach:latest start-single-node --insecure
 
     - name: Wait for CockroachDB
-      uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e # v3.0.0
+      uses: nick-fields/retry@c97818ca39074beaea45180dba704f92496a0082 # v3.0.1
       with:
         timeout_seconds: 15
         max_attempts: 3
diff --git a/.github/workflows/test_pgdb.yaml b/.github/workflows/test_pgdb.yaml
index 0dd96ca4bf..5baf50e11b 100644
--- a/.github/workflows/test_pgdb.yaml
+++ b/.github/workflows/test_pgdb.yaml
@@ -25,7 +25,7 @@ jobs:
         check-latest: true
         cache: true
 
-    - uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6.1.1
+    - uses: golangci/golangci-lint-action@2226d7cb06a077cd73e56eedd38eecad18e5d837 # v6.5.0
       with:
         version: 'v1.55.1'
         args: ./storage/postgresql
diff --git a/.golangci.yaml b/.golangci.yaml
index dfe48fe6e8..149dc79c33 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -1,8 +1,6 @@
 run:
   # timeout for analysis, e.g. 30s, 5m, default is 1m
-  deadline: 90s
-  skip-files:
-    - types/internal/tls/tls.go
+  timeout: 90s
 
 linters-settings:
   gocyclo:
@@ -10,10 +8,11 @@ linters-settings:
     # TODO(mhutchinson): lower this again after reworking interceptor
     min-complexity: 26
   depguard:
-    list-type: blacklist
-    packages:
-      - golang.org/x/net/context
-      - github.com/gogo/protobuf/proto
+    rules:
+      main:
+        deny:
+          - pkg: "golang.org/x/net/context"
+          - pkg: "github.com/gogo/protobuf/proto"
 
 issues:
   # Don't turn off any checks by default. We can do this explicitly if needed.
@@ -27,3 +26,6 @@ issues:
       text: 'SA1019: grpc.DialContext is deprecated: use NewClient instead'
     - linters: [staticcheck]
       text: 'SA1019: grpc.WithBlock is deprecated: this DialOption is not supported by NewClient'
+
+  exclude-files:
+    - types/internal/tls/tls.go