diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9b1c686..d9a13bf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,20 +6,25 @@ on:
     tags:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
 
     steps:
+      - name: checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
       - name: set up go 1.23
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v6
         with:
           go-version: "1.23"
         id: go
 
-      - name: checkout
-        uses: actions/checkout@v3
-
       - name: build and test
         run: |
           go get -v
@@ -31,11 +36,11 @@ jobs:
           TZ: "America/Chicago"
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v3
+        uses: golangci/golangci-lint-action@v9
         with:
           version: latest
 
-      - name: install goveralls, submit coverage
+      - name: submit coverage
         run: |
           go install github.com/mattn/goveralls@latest
           goveralls -service="github" -coverprofile=$GITHUB_WORKSPACE/profile.cov
diff --git a/.golangci.yml b/.golangci.yml
new file mode 100644
index 0000000..3e0d1ec
--- /dev/null
+++ b/.golangci.yml
@@ -0,0 +1,8 @@
+version: "2"
+
+linters:
+  exclusions:
+    rules:
+      - linters:
+          - staticcheck
+        text: "QF"