diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 0672b1b..0e09c7e 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -86,10 +86,10 @@ jobs:
           go-version: ${{ env.latest_go }}
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v9
         with:
           # Required: the version of golangci-lint is required and must be specified without patch version: we always use the latest patch version.
-          version: v1.64.8
+          version: v2.4.0
           args: --verbose --timeout 5m
 
         # only run golangci-lint for pull requests, otherwise ALL hints get
diff --git a/.golangci.yml b/.golangci.yml
index b44c2c1..d72cb29 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,56 +1,44 @@
-# This is the configuration for golangci-lint for the restic project.
-#
-# A sample config with all settings is here:
-# https://github.com/golangci/golangci-lint/blob/master/.golangci.example.yml
-
+version: "2"
 linters:
   # only enable the linters listed below
-  disable-all: true
+  default: none
   enable:
+    # ensure that http response bodies are closed
+    - bodyclose
     # make sure all errors returned by functions are handled
     - errcheck
-
-    # show how code can be simplified
-    - gosimple
-
-    # make sure code is formatted
-    - gofmt
-
     # examine code and report suspicious constructs, such as Printf calls whose
     # arguments do not align with the format string
     - govet
-
-    # make sure names and comments are used according to the conventions
-    - revive
-
+    # consistent imports
+    - importas
     # detect when assignments to existing variables are not used
     - ineffassign
-
+    # make sure names and comments are used according to the conventions
+    - revive
     # run static analysis and find errors
     - staticcheck
-
     # find unused variables, functions, structs, types, etc.
     - unused
-
-    # parse and typecheck code
-    - typecheck
-
-    # ensure that http response bodies are closed
-    - bodyclose
-
-    - importas
-
-issues:
-  # don't use the default exclude rules, this hides (among others) ignored
-  # errors from Close() calls
-  exclude-use-default: false
-
-  # list of things to not warn about
-  exclude:
-    # revive: do not warn about missing comments for exported stuff
-    - exported (function|method|var|type|const) .* should have comment or be unexported
-    # revive: ignore constants in all caps
-    - don't use ALL_CAPS in Go names; use CamelCase
-    # revive: lots of packages don't have such a comment
-    - "package-comments: should have a package comment"
-    - "redefines-builtin-id:"
+  exclusions:
+    rules:
+      - path: (.+)\.go$
+        text: exported (function|method|var|type|const) .* should have comment or be unexported
+      - path: (.+)\.go$
+        text: don't use ALL_CAPS in Go names; use CamelCase
+      - path: (.+)\.go$
+        text: "package-comments: should have a package comment"
+      - path: (.+)\.go$
+        text: "redefines-builtin-id:"
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  enable:
+    - gofmt
+  exclusions:
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
diff --git a/cmd/rest-server/main.go b/cmd/rest-server/main.go
index fe6f04e..1a9153c 100644
--- a/cmd/rest-server/main.go
+++ b/cmd/rest-server/main.go
@@ -196,7 +196,7 @@ func (app *restServerApp) runRoot(_ *cobra.Command, _ []string) error {
 	case "1.3":
 		tlscfg.MinVersion = tls.VersionTLS13
 	default:
-		return fmt.Errorf("Unsupported TLS min version: %s. Allowed versions are 1.2 or 1.3", app.Server.TLSMinVer)
+		return fmt.Errorf("unsupported TLS min version: %s. Allowed versions are 1.2 or 1.3", app.Server.TLSMinVer)
 	}
 
 	srv := &http.Server{