diff --git a/.golangci.yml b/.golangci.yml
index 2a303b8fe8..8586ec6112 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -35,6 +35,11 @@ linters:
       - linters:
           - revive
         text: var-naming
+      # Added to revive's defaults after golangci-lint v2.11; the flagged
+      # constructors are long-standing public API.
+      - linters:
+          - revive
+        text: unexported-return
     paths:
       - third_party$
       - builtin$
diff --git a/scripts/devtools.sh b/scripts/devtools.sh
index cab32ad63c..3d50176383 100755
--- a/scripts/devtools.sh
+++ b/scripts/devtools.sh
@@ -3,10 +3,23 @@ set -ex
 
 # Keep tooling installation deterministic and aligned with the active Go toolchain.
 # This avoids prebuilt golangci-lint binaries being built by an older Go version.
-GOLANGCI_LINT_VERSION=v2.11.2
+# v2.11.x panics while analysing Go 1.27's internal/poll package
+# ("unexpected expr: *ast.KeyValueExpr"); v2.14.0 handles Go 1.27.
+GOLANGCI_LINT_VERSION=v2.14.0
 GOSEC_VERSION=v2.29.0
+# gosec v2.29.0 pins golang.org/x/tools v0.49.0, which cannot decode Go 1.27
+# export data ("export data version 5 is greater than maximum supported
+# version"), so every package fails to type-check. Build it against a newer
+# x/tools until a gosec release catches up.
+GOSEC_X_TOOLS_VERSION=v0.52.0
 
-go mod download golang.org/x/tools@latest
 go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@${GOLANGCI_LINT_VERSION}
 # Build gosec from source with the active toolchain (prebuilt binaries lag).
-go install github.com/securego/gosec/v2/cmd/gosec@${GOSEC_VERSION}  # cspell:disable-line
+GOSEC_BUILD_DIR="$(mktemp -d)"
+(
+  cd "${GOSEC_BUILD_DIR}"
+  go mod init devtools-build
+  go get github.com/securego/gosec/v2/cmd/gosec@${GOSEC_VERSION} golang.org/x/tools@${GOSEC_X_TOOLS_VERSION}  # cspell:disable-line
+  go install github.com/securego/gosec/v2/cmd/gosec  # cspell:disable-line
+)
+rm -rf "${GOSEC_BUILD_DIR}"