diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index bf71ee6..091ea59 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,12 +1,18 @@
-on: [push, pull_request]
 name: Test
+on: [push, pull_request]
+
+permissions:
+  contents: read
+
 jobs:
   test:
     strategy:
       matrix:
-        go-version: [1.18.x, 1.19.x, 1.20.x, 1.21.x, 1.22.x]
+        go-version: [1.18.x, 1.19.x, 1.20.x, 1.21.x, 1.22.x, 1.23.x, 1.24.x, 1.25.x, 1.26.x]
         platform: [ubuntu-latest, windows-latest]
     runs-on: ${{ matrix.platform }}
+    env:
+      GOTOOLCHAIN: local
     steps:
       - name: Install Go
         uses: actions/setup-go@v6
@@ -16,6 +22,14 @@ jobs:
         uses: actions/checkout@v6
       - name: Test
         run: go test -v ./...
+      - name: Lint
+        uses: golangci/golangci-lint-action@v9
+        with:
+          version: v2.11
       - name: Test Blake3
         run: go test -v ./...
         working-directory: blake3
+      - name: Lint Blake3
+        uses: golangci/golangci-lint-action@v9
+        with:
+          version: v2.11
diff --git a/verifiers_test.go b/verifiers_test.go
index 0e35115..ae181d6 100644
--- a/verifiers_test.go
+++ b/verifiers_test.go
@@ -25,12 +25,18 @@ import (
 
 func TestDigestVerifier(t *testing.T) {
 	p := make([]byte, 1<<20)
-	rand.Read(p)
+	_, err := rand.Read(p)
+	if err != nil {
+		t.Fatal(err)
+	}
 	digest := FromBytes(p)
 
 	verifier := digest.Verifier()
 
-	io.Copy(verifier, bytes.NewReader(p))
+	_, err = io.Copy(verifier, bytes.NewReader(p))
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	if !verifier.Verified() {
 		t.Fatalf("bytes not verified")