diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 27ea117..d5d17b2 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -37,13 +37,13 @@ jobs:
       # Install Go!
       - uses: actions/setup-go@v3
         with:
-          go-version: "~1.22"
+          go-version: "~1.23"
 
       # Check for Go linting errors!
       - name: Lint Go
-        uses: golangci/golangci-lint-action@v6.0.1
+        uses: golangci/golangci-lint-action@v6.1.1
         with:
-          version: v1.59.1
+          version: v1.62.2
           args: "--out-${NO_FUTURE}format colored-line-number"
 
       - name: Lint shell scripts
@@ -98,7 +98,7 @@ jobs:
 
       - uses: actions/setup-go@v3
         with:
-          go-version: "~1.22"
+          go-version: "~1.23"
 
       # Sadly the new "set output" syntax (of writing env vars to
       # $GITHUB_OUTPUT) does not work on both powershell and bash so we use the
@@ -136,7 +136,7 @@ jobs:
 
       - uses: actions/setup-go@v3
         with:
-          go-version: "~1.22"
+          go-version: "~1.23"
 
       # Sadly the new "set output" syntax (of writing env vars to
       # $GITHUB_OUTPUT) does not work on both powershell and bash so we use the
@@ -170,7 +170,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-go@v3
         with:
-          go-version: "~1.22"
+          go-version: "~1.23"
 
       - name: Go Cache Paths
         id: go-cache-paths
@@ -223,7 +223,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v3
         with:
-          go-version: "~1.22"
+          go-version: "~1.23"
 
       - name: Go Cache Paths
         id: go-cache-paths
@@ -257,7 +257,7 @@ jobs:
 
       - uses: actions/setup-go@v3
         with:
-          go-version: "~1.22"
+          go-version: "~1.23"
 
       - name: build image
         run: make -j build/image/envbox
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index adb1d2e..20e051b 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -57,7 +57,7 @@ jobs:
 
       - uses: actions/setup-go@v3
         with:
-          go-version: "~1.22"
+          go-version: "~1.23"
 
       - name: Go Cache Paths
         id: go-cache-paths
diff --git a/cli/cliflag/cliflag_test.go b/cli/cliflag/cliflag_test.go
index 042fd04..89ec8bb 100644
--- a/cli/cliflag/cliflag_test.go
+++ b/cli/cliflag/cliflag_test.go
@@ -113,9 +113,11 @@ func TestCliflag(t *testing.T) {
 		flagset, name, shorthand, env, usage := randomFlag()
 		def, _ := cryptorand.Intn(10)
 
+		//nolint:gosec
 		cliflag.Uint8VarP(flagset, &ptr, name, shorthand, env, uint8(def), usage)
 		got, err := flagset.GetUint8(name)
 		require.NoError(t, err)
+		//nolint:gosec
 		require.Equal(t, uint8(def), got)
 		require.Contains(t, flagset.FlagUsages(), usage)
 		require.Contains(t, flagset.FlagUsages(), fmt.Sprintf("Consumes $%s", env))
@@ -125,12 +127,15 @@ func TestCliflag(t *testing.T) {
 		var ptr uint8
 		flagset, name, shorthand, env, usage := randomFlag()
 		envValue, _ := cryptorand.Intn(10)
+		//nolint:gosec
 		t.Setenv(env, strconv.FormatUint(uint64(envValue), 10))
 		def, _ := cryptorand.Intn(10)
 
+		//nolint:gosec
 		cliflag.Uint8VarP(flagset, &ptr, name, shorthand, env, uint8(def), usage)
 		got, err := flagset.GetUint8(name)
 		require.NoError(t, err)
+		//nolint:gosec
 		require.Equal(t, uint8(envValue), got)
 	})
 
@@ -141,9 +146,11 @@ func TestCliflag(t *testing.T) {
 		t.Setenv(env, envValue)
 		def, _ := cryptorand.Intn(10)
 
+		//nolint:gosec
 		cliflag.Uint8VarP(flagset, &ptr, name, shorthand, env, uint8(def), usage)
 		got, err := flagset.GetUint8(name)
 		require.NoError(t, err)
+		//nolint:gosec
 		require.Equal(t, uint8(def), got)
 	})
 
@@ -164,6 +171,7 @@ func TestCliflag(t *testing.T) {
 		var ptr int
 		flagset, name, shorthand, env, usage := randomFlag()
 		envValue, _ := cryptorand.Intn(10)
+		//nolint:gosec
 		t.Setenv(env, strconv.FormatUint(uint64(envValue), 10))
 		def, _ := cryptorand.Intn(10)
 
diff --git a/dockerutil/network.go b/dockerutil/network.go
index 7c613a9..158181c 100644
--- a/dockerutil/network.go
+++ b/dockerutil/network.go
@@ -36,6 +36,7 @@ func mustNextIPv4(ip net.IP, inc int) net.IP {
 	v += uint32(ip4[1]) << 16
 	v += uint32(ip4[2]) << 8
 	v += uint32(ip4[3])
+	//nolint:gosec
 	v += uint32(inc)
 	v3 := byte(v & 0xFF)
 	v2 := byte((v >> 8) & 0xFF)
diff --git a/go.mod b/go.mod
index 5e11c55..1ae705a 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/coder/envbox
 
-go 1.22.4
+go 1.23.3
 
 // There are a few minor changes we make to Tailscale that we're slowly upstreaming. Compare here:
 // https://github.com/tailscale/tailscale/compare/main...coder:tailscale:main
diff --git a/xunix/device.go b/xunix/device.go
index e7c3332..0392af0 100644
--- a/xunix/device.go
+++ b/xunix/device.go
@@ -109,6 +109,7 @@ func createDevice(ctx context.Context, conf deviceConfig) error {
 		return xerrors.Errorf("ensure parent dir: %w", err)
 	}
 
+	//nolint:gosec
 	err = fs.Mknod(conf.path, conf.ftype|conf.mode, int(conf.dev))
 	if err != nil {
 		return xerrors.Errorf("mknod %s c %d %d: %w", conf.path, conf.major, conf.minor, err)