diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index e171ac12..d364e8f2 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -33,6 +33,6 @@ jobs:
     - name: golangci-lint-${{matrix.working-directory}}
       uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
       with:
-        version: v2.6.2
+        version: v2.10.1
         working-directory: ${{matrix.working-directory}}
         args: --timeout=10m
diff --git a/.golangci.yaml b/.golangci.yaml
index 40f6cdc0..6f03128b 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -1,6 +1,6 @@
 version: "2"
 run:
-  go: "1.24"
+  go: "1.25"
 linters:
   default: none
   enable:
diff --git a/Makefile b/Makefile
index 8e4e9cb7..bda933a5 100644
--- a/Makefile
+++ b/Makefile
@@ -231,7 +231,7 @@ GOLANGCI_LINT ?= $(LOCALBIN)/golangci-lint
 ## Tool Versions
 KUSTOMIZE_VERSION ?= v5.4.2
 CONTROLLER_TOOLS_VERSION ?= v0.17.0
-GOLANGCI_LINT_VERSION ?= v2.6.2
+GOLANGCI_LINT_VERSION ?= v2.10.1
 
 KUSTOMIZE_INSTALL_SCRIPT ?= "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"
 .PHONY: kustomize
diff --git a/api/go.mod b/api/go.mod
index 3205c5fb..67bc4999 100644
--- a/api/go.mod
+++ b/api/go.mod
@@ -1,6 +1,6 @@
 module github.com/metal3-io/ironic-standalone-operator/api
 
-go 1.24.0
+go 1.25.0
 
 require (
 	github.com/stretchr/testify v1.11.1
diff --git a/cmd/run-local-ironic/main.go b/cmd/run-local-ironic/main.go
index b5f0ba40..3b33ca64 100644
--- a/cmd/run-local-ironic/main.go
+++ b/cmd/run-local-ironic/main.go
@@ -106,7 +106,7 @@ func runLocalIronic(inputFile, outputFile string, versionInfo ironic.VersionInfo
 	}
 
 	outputDir := filepath.Dir(outputFile)
-	if err = os.MkdirAll(outputDir, 0o755); err != nil {
+	if err = os.MkdirAll(outputDir, 0o755); err != nil { //nolint:gosec // outputDir is derived from a controlled output file path, not user input
 		return fmt.Errorf("failed to create output directory: %w", err)
 	}
 
@@ -144,7 +144,7 @@ func runLocalIronic(inputFile, outputFile string, versionInfo ironic.VersionInfo
 }
 
 func writeManifestsToYAML(manifests []runtime.Object, filename string, scheme *runtime.Scheme) error {
-	file, err := os.Create(filename)
+	file, err := os.Create(filename) //nolint:gosec // filename is a controlled output path, not user input
 	if err != nil {
 		return err
 	}
@@ -184,9 +184,9 @@ func writeManifestsToYAML(manifests []runtime.Object, filename string, scheme *r
 func runPodmanKubePlay(manifestFile string, tearDown bool) error {
 	var cmd *exec.Cmd
 	if tearDown {
-		cmd = exec.CommandContext(context.TODO(), "podman", "kube", "play", "--down", manifestFile)
+		cmd = exec.CommandContext(context.TODO(), "podman", "kube", "play", "--down", manifestFile) //nolint:gosec // manifestFile is a controlled output path, not user input
 	} else {
-		cmd = exec.CommandContext(context.TODO(), "podman", "kube", "play", "--network=host", manifestFile)
+		cmd = exec.CommandContext(context.TODO(), "podman", "kube", "play", "--network=host", manifestFile) //nolint:gosec // manifestFile is a controlled output path, not user input
 	}
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
diff --git a/go.mod b/go.mod
index 2be5bcb4..c507e6cc 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/metal3-io/ironic-standalone-operator
 
-go 1.24.0
+go 1.25.0
 
 require (
 	github.com/go-logr/logr v1.4.3
diff --git a/hack/ensure-go.sh b/hack/ensure-go.sh
index bd99ac99..327869d5 100755
--- a/hack/ensure-go.sh
+++ b/hack/ensure-go.sh
@@ -32,7 +32,7 @@ EOF
     local go_version
     IFS=" " read -ra go_version <<< "$(go version)"
     local minimum_go_version
-    minimum_go_version=go1.24
+    minimum_go_version=go1.25
     if [[ "${minimum_go_version}" != $(echo -e "${minimum_go_version}\n${go_version[2]}" | sort -s -t. -k 1,1 -k 2,2n -k 3,3n | head -n1) ]] && [[ "${go_version[2]}" != "devel" ]]; then
         cat << EOF
 Detected go version: ${go_version[*]}.
diff --git a/hack/gomod.sh b/hack/gomod.sh
index ef4c79d5..f463b9cf 100755
--- a/hack/gomod.sh
+++ b/hack/gomod.sh
@@ -39,6 +39,6 @@ else
         --volume "${PWD}:/workdir:ro,z" \
         --entrypoint sh \
         --workdir /workdir \
-        docker.io/golang:1.24 \
+        docker.io/golang:1.25 \
         /workdir/hack/gomod.sh "$@"
 fi
diff --git a/pkg/ironic/secrets_test.go b/pkg/ironic/secrets_test.go
index 0a629e41..46781acd 100644
--- a/pkg/ironic/secrets_test.go
+++ b/pkg/ironic/secrets_test.go
@@ -57,7 +57,7 @@ func TestGenerateHtpasswd(t *testing.T) {
 		Scenario string
 
 		User     string
-		Password string
+		Password string //nolint:gosec // test struct field, not a real secret
 	}{
 		{
 			User:     "admin",
@@ -86,7 +86,7 @@ func TestSecretNeedsUpdating(t *testing.T) {
 		Scenario string
 
 		User            string
-		Password        string
+		Password        string //nolint:gosec // test struct field, not a real secret
 		CurrentHtpasswd string
 
 		ExpectedChanged bool
diff --git a/test/go.mod b/test/go.mod
index db42a6ce..b77a136f 100644
--- a/test/go.mod
+++ b/test/go.mod
@@ -1,6 +1,6 @@
 module github.com/metal3-io/ironic-standalone-operator/test
 
-go 1.24.2
+go 1.25.0
 
 require (
 	github.com/gophercloud/gophercloud/v2 v2.10.0
diff --git a/test/helpers/clients.go b/test/helpers/clients.go
index 9afdfe96..ec8d0841 100644
--- a/test/helpers/clients.go
+++ b/test/helpers/clients.go
@@ -23,9 +23,9 @@ var (
 
 func LoadIronicCert() {
 	var err error
-	ironicCertPEM, err = os.ReadFile(os.Getenv("IRONIC_CERT_FILE"))
+	ironicCertPEM, err = os.ReadFile(os.Getenv("IRONIC_CERT_FILE")) //nolint:gosec // path comes from trusted test environment variable
 	Expect(err).NotTo(HaveOccurred())
-	ironicKeyPEM, err = os.ReadFile(os.Getenv("IRONIC_KEY_FILE"))
+	ironicKeyPEM, err = os.ReadFile(os.Getenv("IRONIC_KEY_FILE")) //nolint:gosec // path comes from trusted test environment variable
 	Expect(err).NotTo(HaveOccurred())
 }
 
@@ -50,7 +50,7 @@ func GetStatusCode(ctx context.Context, httpClient *http.Client, url string) int
 	req, err := http.NewRequestWithContext(ctx, http.MethodHead, url, http.NoBody)
 	Expect(err).NotTo(HaveOccurred())
 
-	resp, err := httpClient.Do(req)
+	resp, err := httpClient.Do(req) //nolint:gosec // URL is controlled by test infrastructure
 	Expect(err).NotTo(HaveOccurred())
 	defer resp.Body.Close()
 
diff --git a/test/suite_test.go b/test/suite_test.go
index 2b93be9b..bfa80db0 100644
--- a/test/suite_test.go
+++ b/test/suite_test.go
@@ -303,13 +303,13 @@ func WaitForIronicFailure(name types.NamespacedName, message string, tolerateRea
 
 func writeYAML(obj interface{}, namespace, name, typ string) {
 	fileDir := fmt.Sprintf("%s/%s", os.Getenv("LOGDIR"), namespace)
-	err := os.MkdirAll(fileDir, 0o755)
+	err := os.MkdirAll(fileDir, 0o755) //nolint:gosec // path derived from trusted LOGDIR env var
 	Expect(err).NotTo(HaveOccurred())
 
 	fileName := fmt.Sprintf("%s/%s_%s.yaml", fileDir, typ, name)
 	yamlData, err := yaml.Marshal(obj)
 	Expect(err).NotTo(HaveOccurred())
-	err = os.WriteFile(fileName, yamlData, 0o600)
+	err = os.WriteFile(fileName, yamlData, 0o600) //nolint:gosec // path derived from trusted LOGDIR env var
 	Expect(err).NotTo(HaveOccurred())
 }
 
@@ -596,7 +596,7 @@ func writeContainerLogs(pod *corev1.Pod, containerName, logDir string) {
 	defer podLogs.Close()
 
 	targetFileName := fmt.Sprintf("%s/%s.log", logDir, containerName)
-	logFile, err := os.Create(targetFileName)
+	logFile, err := os.Create(targetFileName) //nolint:gosec // path derived from trusted LOGDIR env var
 	Expect(err).NotTo(HaveOccurred())
 	defer logFile.Close()
 
@@ -638,7 +638,7 @@ func CollectLogs(namespace string) {
 
 	for _, pod := range pods.Items {
 		logDir := fmt.Sprintf("%s/%s/pod_%s", os.Getenv("LOGDIR"), namespace, pod.Name)
-		err = os.MkdirAll(logDir, 0o755)
+		err = os.MkdirAll(logDir, 0o755) //nolint:gosec // path derived from trusted LOGDIR env var
 		Expect(err).NotTo(HaveOccurred())
 
 		writeYAML(&pod, namespace, pod.Name, "pod")
@@ -656,7 +656,7 @@ func CollectLogs(namespace string) {
 
 	for _, rset := range rsets.Items {
 		logDir := fmt.Sprintf("%s/%s/replicaset_%s", os.Getenv("LOGDIR"), namespace, rset.Name)
-		err = os.MkdirAll(logDir, 0o755)
+		err = os.MkdirAll(logDir, 0o755) //nolint:gosec // path derived from trusted LOGDIR env var
 		Expect(err).NotTo(HaveOccurred())
 
 		writeYAML(&rset, namespace, rset.Name, "replicaset")
@@ -667,7 +667,7 @@ func CollectLogs(namespace string) {
 
 	for _, job := range jobs.Items {
 		logDir := fmt.Sprintf("%s/%s/job_%s", os.Getenv("LOGDIR"), namespace, job.Name)
-		err = os.MkdirAll(logDir, 0o755)
+		err = os.MkdirAll(logDir, 0o755) //nolint:gosec // path derived from trusted LOGDIR env var
 		Expect(err).NotTo(HaveOccurred())
 
 		writeYAML(&job, namespace, job.Name, "job")
@@ -713,7 +713,7 @@ func saveEvents(namespace string) {
 	Expect(err).NotTo(HaveOccurred())
 
 	targetFileName := fmt.Sprintf("%s/%s/events.yaml", os.Getenv("LOGDIR"), namespace)
-	logFile, err := os.Create(targetFileName)
+	logFile, err := os.Create(targetFileName) //nolint:gosec // path derived from trusted LOGDIR env var
 	Expect(err).NotTo(HaveOccurred())
 	defer logFile.Close()