diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index d0a96a78..2ff76a6d 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -43,7 +43,7 @@ jobs:
       - name: Run golangci-lint
         uses: golangci/golangci-lint-action@v7
         with:
-          version: v2.12.2
+          version: v2.13.2
           args: --timeout=10m
 
   dco:
diff --git a/.golangci.yml b/.golangci.yml
index 22e96969..4cd729e3 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -4,7 +4,16 @@ linters:
   default: all
   disable:
     - depguard
+    # exhaustruct: v2.13 ships the v5 rewrite under a new name and keeps
+    # both generations enabled under `default: all`, so disabling one
+    # leaves the other reporting. Both names are needed.
+    #
+    # This pins a floor: `run` on v2.12.2 dies with
+    # `unknown linters: 'exhaustruct_v5'` before it analyses anything
+    # (`config verify` does not catch it). That matches the version this
+    # repository pins in CI, so a local binary has to keep up with it.
     - exhaustruct
+    - exhaustruct_v5
     - gochecknoinits
     - wsl
     - lll
@@ -135,6 +144,13 @@ linters:
           # failed for the same reason. Disable goconst on test files.
           - goconst
         path: _test\.go
+      # pkg/engine/helm is a copy of helm.sh/helm/v4/pkg/engine kept close
+      # to upstream so it can be re-synced. Its doc.go carries upstream's
+      # canonical-import-path comment, which Go ignores in module mode;
+      # rewriting it would buy nothing and add a diff against upstream.
+      - linters:
+          - modernize
+        path: pkg/engine/helm/
 
 formatters:
   enable:
diff --git a/go.mod b/go.mod
index dcfdcb30..20853e02 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/cozystack/talm
 
-go 1.26.5
+go 1.27.1
 
 // Kubernetes dependencies sharing the same version.
 require (
diff --git a/pkg/engine/engine.go b/pkg/engine/engine.go
index 31f113c4..3b6492e3 100644
--- a/pkg/engine/engine.go
+++ b/pkg/engine/engine.go
@@ -935,7 +935,7 @@ func pruneBodyIdentitiesAgainstRendered(body, rendered []byte) ([]byte, bool, er
 // upstream replace then leaves rendered untouched. Skipping kicks in
 // only on the partial-edit branches below the deep-equal check.
 //
-//nolint:gochecknoglobals,goconst // immutable lookup table consulted by pruneIdenticalKeysAt; init-time literal, never mutated. The second occurrence of each path string is in the docstring above (where it documents the v1alpha1 merge behaviour); making it a const just to satisfy goconst would split documentation from data without runtime benefit.
+//nolint:gochecknoglobals // immutable lookup table consulted by pruneIdenticalKeysAt; init-time literal, never mutated.
 var replaceSemanticPaths = map[string]struct{}{
 	"cluster/network/podSubnets":     {},
 	"cluster/network/serviceSubnets": {},