diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ccf6985..9f3237a 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,8 @@ updates:
     directory: "/"
     schedule:
       interval: monthly
+    cooldown:
+      default-days: 7
     groups:
       go-dependencies:
         patterns:
@@ -13,6 +15,8 @@ updates:
     directory: "/"
     schedule:
       interval: monthly
+    cooldown:
+      default-days: 7
     groups:
       github-actions-dependencies:
         patterns:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 0000000..84d5b8d
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,31 @@
+name: Linting
+
+on:
+  push:
+    branches:
+      - 'main'
+  pull_request:
+    branches:
+      - '**'
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  lint:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+    - name: Checkout
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
+
+    - name: Run zizmor
+      uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+      with:
+        # Fail the check on findings and annotate them inline, rather than
+        # uploading SARIF to code scanning (which never fails the check).
+        advanced-security: false
+        annotations: true
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 7a50095..7bbea0f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -14,17 +14,17 @@ permissions:
 
 jobs:
   test:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
     - name: Checkout
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
 
     - name: Set up Go
-      uses: actions/setup-go@v7
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
-        go-version: 'stable'
+        go-version: '1.27.1'
 
     - name: Build
       run: go build -v ./...
@@ -33,9 +33,9 @@ jobs:
       run: go test -v ./...
 
     - name: Lint
-      uses: golangci/golangci-lint-action@v9
+      uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
       with:
-        version: v2.12.2
+        version: v2.13.2
 
     - name: Vendorcheck
       shell: bash
diff --git a/.golangci.yaml b/.golangci.yaml
index c5eec0e..4b4352c 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -5,7 +5,9 @@ linters:
     - depguard
     - err113
     - exhaustruct
+    - exhaustruct_v5
     - goconst
+    - gomodguard # deprecated; gomodguard_v2 is enabled instead
     - lll
     - musttag
     - wsl
diff --git a/cmd/sunlight-secretmanager/filesystem_test.go b/cmd/sunlight-secretmanager/filesystem_test.go
index bebafe9..58bb5fe 100644
--- a/cmd/sunlight-secretmanager/filesystem_test.go
+++ b/cmd/sunlight-secretmanager/filesystem_test.go
@@ -4,6 +4,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"syscall"
 	"testing"
 )
 
@@ -21,6 +22,9 @@ func TestWriteFile(t *testing.T) {
 		t.Fatalf("failed to close test setup file: %s", err)
 	}
 
+	// Get the FS type of the tempdir, which may vary between environments
+	tempDirFSType := filesystemType(t, tempDir)
+
 	for _, tc := range []struct {
 		name    string
 		path    string
@@ -42,7 +46,7 @@ func TestWriteFile(t *testing.T) {
 		{
 			name:    "happy path",
 			path:    filepath.Join(tempDir, "happy"),
-			fsType:  61267, // The statfs.Type for a normal unix filesystem
+			fsType:  tempDirFSType, // Whatever filesystem the test temp dir is on
 			wantErr: "",
 		},
 	} {
@@ -74,3 +78,16 @@ func TestWriteFile(t *testing.T) {
 		})
 	}
 }
+
+// filesystemType returns the statfs.Type of the filesystem containing path.
+func filesystemType(t *testing.T, path string) int64 {
+	t.Helper()
+
+	var statfs syscall.Statfs_t
+	err := syscall.Statfs(path, &statfs)
+	if err != nil {
+		t.Fatalf("failed to get filesystem info for %q: %s", path, err)
+	}
+
+	return statfs.Type
+}