diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 6060c70f9..ecf0c7c0d 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -95,7 +95,7 @@ jobs:
           GOBIN=/usr/local/bin go install github.com/zricethezav/gitleaks/v8@v8.30.1
 
           # golangci-lint
-          GOBIN=/usr/local/bin go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.1
+          GOBIN=/usr/local/bin go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0
 
           # govulncheck — known-CVE reachability over the module graph + stdlib
           # (sweep 2026-07-09 M-2: the blind spot that let GO-2026-4970 sit a week).
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index de6bec2d7..4e453386d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -65,7 +65,7 @@ jobs:
           GOBIN=/usr/local/bin go install github.com/zricethezav/gitleaks/v8@v8.30.1
 
           # golangci-lint
-          GOBIN=/usr/local/bin go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.1
+          GOBIN=/usr/local/bin go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0
 
           # Use the same scanner pins as the nightly full-security lane.
           # govulncheck covers known-CVE reachability in dependencies and stdlib.
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 467b8027e..7f6a10339 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -621,7 +621,7 @@ jobs:
           retry python -m pip install semgrep==1.169.0 ruff==0.15.21 radon==6.0.1
           retry env GOBIN=/usr/local/bin go install github.com/securego/gosec/v2/cmd/gosec@v2.27.1
           retry env GOBIN=/usr/local/bin go install github.com/zricethezav/gitleaks/v8@v8.30.1
-          retry env GOBIN=/usr/local/bin go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.1
+          retry env GOBIN=/usr/local/bin go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0
           retry env GOBIN=/usr/local/bin go install golang.org/x/vuln/cmd/govulncheck@v1.6.0
           # trivy — pinned tag, download-then-execute (mirrors nightly.yml; piping a
           # mutable-branch script into sh is the gha-curl-pipe-shell supply-chain class).
diff --git a/scripts/golangci-lint-v2.sh b/scripts/golangci-lint-v2.sh
index 42b1c79d4..9aacbf5d8 100755
--- a/scripts/golangci-lint-v2.sh
+++ b/scripts/golangci-lint-v2.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-VERSION="${GOLANGCI_LINT_VERSION:-v2.13.1}"
+VERSION="${GOLANGCI_LINT_VERSION:-v2.14.0}"
 DISPLAY_VERSION="${VERSION#v}"
 MODULE="github.com/golangci/golangci-lint/v2/cmd/golangci-lint"