diff --git a/.golangci.yml b/.golangci.yml
index a5cc04e..989a6cd 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -20,12 +20,20 @@ linters:
     errcheck:
       check-type-assertions: false
       check-blank: false
-    # gosec: no extra settings. Broad global excludes removed (G104/G115/G301/G304/G306).
-    # - G301 addressed by switching cache MkdirAll to 0700 (least privilege for CDN content).
-    # - Remaining justified cases documented with precise //nosec (or #nosec) + comments at the call sites.
-    # - G104 largely eliminated by errcheck + explicit _ = handling (or defer wrappers).
+    # gosec: keep source-level //nosec for G104/G115/G301/G304/G306.
+    # G704/G705 are new taint-analysis rules (SSRF/XSS) not present in v1.64.8;
+    # a CDN cache proxy forwards upstream URLs and response bodies by design.
+    gosec:
+      excludes:
+        - G704
+        - G705
+    # v1 staticcheck checks: ["all"] meant SA* only. v2 merged stylecheck (ST*)
+    # and quickfix (QF*) into staticcheck; keep the previous SA*+gosimple set.
     staticcheck:
-      checks: ["all"] # SA1019 exclusion removed (no deprecated API usages in tree)
+      checks:
+        - all
+        - "-ST*"
+        - "-QF*"
     govet:
       enable-all: true
       disable: