diff --git a/.golangci.yml b/.golangci.yml
index 7b8b017..a5cc04e 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -20,11 +20,10 @@ linters:
     errcheck:
       check-type-assertions: false
       check-blank: false
-    gosec:
-      # Broad global excludes removed (G104/G115/G301/G304/G306).
-      # - G301 addressed by switching cache MkdirAll to 0700 (least privilege for CDN content).
-      # - Remaining justified cases documented with precise //nosec (or #nosec) + comments at the call sites.
-      # - G104 largely eliminated by errcheck + explicit _ = handling (or defer wrappers).
+    # gosec: no extra settings. Broad global excludes removed (G104/G115/G301/G304/G306).
+    # - G301 addressed by switching cache MkdirAll to 0700 (least privilege for CDN content).
+    # - Remaining justified cases documented with precise //nosec (or #nosec) + comments at the call sites.
+    # - G104 largely eliminated by errcheck + explicit _ = handling (or defer wrappers).
     staticcheck:
       checks: ["all"] # SA1019 exclusion removed (no deprecated API usages in tree)
     govet: