diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6d07eaf..e3f72b8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,7 +32,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  GO_VERSION: "1.26.4"
+  GO_VERSION: "1.26.5"
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
 jobs:
diff --git a/cli/agent/claudecode/types.go b/cli/agent/claudecode/types.go
index 402b4d0..1f86dce 100644
--- a/cli/agent/claudecode/types.go
+++ b/cli/agent/claudecode/types.go
@@ -70,8 +70,8 @@ const (
 	ToolEdit         = "Edit"
 	ToolNotebookEdit = "NotebookEdit"
 	// #nosec G101 -- not a credential: this is an MCP tool name constant
-	ToolMCPWrite     = "mcp__acp__Write" //nolint:gosec // G101: This is a tool name, not a credential
-	ToolMCPEdit      = "mcp__acp__Edit"
+	ToolMCPWrite = "mcp__acp__Write" //nolint:gosec // G101: This is a tool name, not a credential
+	ToolMCPEdit  = "mcp__acp__Edit"
 )
 
 // FileModificationTools lists tools that create or modify files
diff --git a/cli/checkpoint/shadow_ref.go b/cli/checkpoint/shadow_ref.go
index febb9a0..e994170 100644
--- a/cli/checkpoint/shadow_ref.go
+++ b/cli/checkpoint/shadow_ref.go
@@ -118,7 +118,7 @@ func shadowRefBackoff(ctx context.Context, attempt int) error {
 	// Add a 1ms floor so the chosen sleep is always non-trivial, even when
 	// rand.Int64N happens to return 0.
 	// #nosec G404 -- non-cryptographic use (retry backoff jitter)
-	d := time.Duration(rand.Int64N(int64(base))) + time.Millisecond  //nolint:gosec // jitter, not security-sensitive
+	d := time.Duration(rand.Int64N(int64(base))) + time.Millisecond //nolint:gosec // jitter, not security-sensitive
 	select {
 	case <-time.After(d):
 		return nil