diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 60e842c..9aea70f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,10 +11,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - name: set up go 1.23
+      - name: set up go 1.24
         uses: actions/setup-go@v5
         with:
-          go-version: "1.23"
+          go-version: "1.24"
         id: go
 
       - name: checkout
@@ -38,14 +38,14 @@ jobs:
           TZ: "America/Chicago"
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v7
         with:
-          version: v1.61
+          version: v2.1.1
 
       - name: golangci-lint on example directory
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v7
         with:
-          version: v1.61
+          version: v2.1.1
           args: --config ../../.golangci.yml
           working-directory: examples/plugin
 
diff --git a/.golangci.yml b/.golangci.yml
index 3abafa9..24b60dd 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,70 +1,72 @@
-run:
-  timeout: 5m
-
-linters-settings:
-  govet:
-    enable:
-      - shadow
-  goconst:
-    min-len: 2
-    min-occurrences: 2
-  misspell:
-    locale: US
-  lll:
-    line-length: 140
-  gocritic:
-    enabled-tags:
-      - performance
-      - style
-      - experimental
-    disabled-checks:
-      - wrapperFunc
-      - hugeParam
-      - rangeValCopy
-      - singleCaseSwitch
-      - ifElseChain
-
+version: "2"
 linters:
+  default: none
   enable:
-    - staticcheck
-    - revive
-    - govet
-    - unconvert
-    - unused
-    - gosec
-    - gocyclo
     - dupl
-    - misspell
-    - unparam
-    - typecheck
-    - ineffassign
-    - stylecheck
     - gochecknoinits
     - gocritic
+    - gocyclo
+    - gosec
+    - govet
+    - ineffassign
+    - misspell
     - nakedret
-    - gosimple
     - prealloc
-  fast: false
-  disable-all: true
-
-issues:
-  exclude-dirs:
-    - vendor
-  exclude-rules:
-    - text: "at least one file in a package should have a package comment"
-      linters:
-        - stylecheck
-    - text: "should have a package comment"
-      linters:
-        - revive
-    - path: _test\.go
-      linters:
-        - gosec
-        - dupl
-    - linters:
-        - unparam
-        - unused
-        - revive
-      path: _test\.go$
-      text: "unused-parameter"
-  exclude-use-default: false
+    - revive
+    - staticcheck
+    - unconvert
+    - unparam
+    - unused
+  settings:
+    goconst:
+      min-len: 2
+      min-occurrences: 2
+    gocritic:
+      disabled-checks:
+        - wrapperFunc
+        - hugeParam
+        - rangeValCopy
+        - singleCaseSwitch
+        - ifElseChain
+      enabled-tags:
+        - performance
+        - style
+        - experimental
+    govet:
+      enable:
+        - shadow
+    lll:
+      line-length: 140
+    misspell:
+      locale: US
+  exclusions:
+    generated: lax
+    rules:
+      - linters:
+          - staticcheck
+        text: at least one file in a package should have a package comment
+      - linters:
+          - revive
+        text: should have a package comment
+      - linters:
+          - dupl
+          - gosec
+        path: _test\.go
+      - linters:
+          - revive
+          - unparam
+          - unused
+        path: _test\.go$
+        text: unused-parameter
+    paths:
+      - vendor
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
diff --git a/app/discovery/discovery.go b/app/discovery/discovery.go
index ac90f35..301e71f 100644
--- a/app/discovery/discovery.go
+++ b/app/discovery/discovery.go
@@ -539,7 +539,7 @@ func (m URLMapper) ping() (string, error) {
 
 	resp, err := client.Get(m.PingURL)
 	if err != nil {
-		errMsg := strings.Replace(err.Error(), "\"", "", -1)
+		errMsg := strings.ReplaceAll(err.Error(), "\"", "")
 		errMsg = fmt.Sprintf("failed to ping for health %s, %s", m.PingURL, errMsg)
 		return errMsg, fmt.Errorf("%s %s: %s, %v", m.Server, m.SrcMatch.String(), m.PingURL, errMsg)
 	}
diff --git a/app/discovery/provider/consulcatalog/consulcatalog.go b/app/discovery/provider/consulcatalog/consulcatalog.go
index a808d02..a548a34 100644
--- a/app/discovery/provider/consulcatalog/consulcatalog.go
+++ b/app/discovery/provider/consulcatalog/consulcatalog.go
@@ -173,13 +173,14 @@ func (cc *ConsulCatalog) List() ([]discovery.URLMapper, error) {
 
 		if v, ok := c.Labels["reproxy.keep-host"]; ok {
 			enabled = true
-			if v == "true" || v == "yes" || v == "1" {
+			switch v {
+			case "true", "yes", "1":
 				t := true
 				keepHost = &t
-			} else if v == "false" || v == "no" || v == "0" {
+			case "false", "no", "0":
 				f := false
 				keepHost = &f
-			} else {
+			default:
 				log.Printf("[WARN] invalid value for reproxy.keep-host: %s", v)
 			}
 		}
diff --git a/app/main.go b/app/main.go
index 1ca4a4c..4d675b0 100644
--- a/app/main.go
+++ b/app/main.go
@@ -299,7 +299,7 @@ func makeBasicAuth(htpasswdFile string) ([]string, error) {
 		basicAuthAllowed = strings.Split(string(data), "\n")
 		for i, v := range basicAuthAllowed {
 			basicAuthAllowed[i] = strings.TrimSpace(v)
-			basicAuthAllowed[i] = strings.Replace(basicAuthAllowed[i], "\t", "", -1)
+			basicAuthAllowed[i] = strings.ReplaceAll(basicAuthAllowed[i], "\t", "")
 		}
 	}
 	return basicAuthAllowed, nil
diff --git a/go.mod b/go.mod
index 02236f3..be2a016 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/umputun/reproxy
 
-go 1.23
+go 1.24
 require (
 	github.com/didip/tollbooth/v7 v7.0.2
 	github.com/go-pkgz/lgr v0.11.1