diff --git a/Dockerfile b/Dockerfile
index 243bf5b..ec33b34 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,8 +4,8 @@ FROM golang@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4
 
 RUN apk add --no-cache git make gcc musl-dev binutils-gold
 
-# golangci-lint v2.10.1
-RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@5d1e709b7be35cb2025444e19de266b056b7b7ee
+# golangci-lint v2.12.2, 2026-08-07
+RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@c0d3ddc9cf3faa61a4e378e879ece580256d76e5
 # goimports v0.42.0
 RUN go install golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0
 
diff --git a/TODO.md b/TODO.md
index 3e8e557..bb5414c 100644
--- a/TODO.md
+++ b/TODO.md
@@ -25,6 +25,9 @@ confirm make check still passes.
 
 # Completed Steps
 
+- 2026-08-07: golangci-lint bumped to v2.12.2 (commit-pinned installs
+  in `Dockerfile` and `script/bootstrap`); fixed the resulting
+  `goconst` findings. `.golangci.yml` unchanged (canonical)
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-02-20: iterative DNS resolver implemented; tests made hermetic
diff --git a/internal/notify/delivery_test.go b/internal/notify/delivery_test.go
index 1822950..5c2be51 100644
--- a/internal/notify/delivery_test.go
+++ b/internal/notify/delivery_test.go
@@ -25,6 +25,18 @@ const (
 	colorDefault = "#6c757d"
 )
 
+// Priority and fixture values shared across tests.
+const (
+	prioError   = "error"
+	prioWarning = "warning"
+	prioInfo    = "info"
+	prioSuccess = "success"
+	prioUnknown = "unknown"
+	ntfyUrgent  = "urgent"
+	ntfyDefault = "default"
+	testHost    = "example.com"
+)
+
 // errSimulated is a static error for transport failures.
 var errSimulated = errors.New("simulated transport failure")
 
@@ -101,13 +113,13 @@ func TestNtfyPriority(t *testing.T) {
 		input string
 		want  string
 	}{
-		{"error", "urgent"},
-		{"warning", "high"},
-		{"success", "default"},
-		{"info", "low"},
-		{"", "default"},
-		{"unknown", "default"},
-		{"critical", "default"},
+		{prioError, ntfyUrgent},
+		{prioWarning, "high"},
+		{prioSuccess, ntfyDefault},
+		{prioInfo, "low"},
+		{"", ntfyDefault},
+		{prioUnknown, ntfyDefault},
+		{"critical", ntfyDefault},
 	}
 
 	for _, tc := range cases {
@@ -134,12 +146,12 @@ func TestSlackColor(t *testing.T) {
 		input string
 		want  string
 	}{
-		{"error", colorError},
-		{"warning", colorWarning},
-		{"success", colorSuccess},
-		{"info", colorInfo},
+		{prioError, colorError},
+		{prioWarning, colorWarning},
+		{prioSuccess, colorSuccess},
+		{prioInfo, colorInfo},
 		{"", colorDefault},
-		{"unknown", colorDefault},
+		{prioUnknown, colorDefault},
 		{"critical", colorDefault},
 	}
 
@@ -165,7 +177,7 @@ func TestNewRequest(t *testing.T) {
 
 	target := &url.URL{
 		Scheme: "https",
-		Host:   "example.com",
+		Host:   testHost,
 		Path:   "/webhook",
 	}
 	body := bytes.NewBufferString("hello")
@@ -187,9 +199,9 @@ func TestNewRequest(t *testing.T) {
 		)
 	}
 
-	if req.Host != "example.com" {
+	if req.Host != testHost {
 		t.Errorf(
-			"Host = %q, want %q", req.Host, "example.com",
+			"Host = %q, want %q", req.Host, testHost,
 		)
 	}
 
@@ -217,7 +229,7 @@ func TestNewRequestPreservesContext(t *testing.T) {
 		ctxKey("k"),
 		"v",
 	)
-	target := &url.URL{Scheme: "https", Host: "example.com"}
+	target := &url.URL{Scheme: "https", Host: testHost}
 
 	req := notify.NewRequestForTest(
 		ctx, http.MethodGet, target, http.NoBody,
@@ -289,10 +301,10 @@ func TestSendNtfyHeaders(t *testing.T) {
 		)
 	}
 
-	if captured.priority != "urgent" {
+	if captured.priority != ntfyUrgent {
 		t.Errorf(
 			"Priority header = %q, want %q",
-			captured.priority, "urgent",
+			captured.priority, ntfyUrgent,
 		)
 	}
 
@@ -311,10 +323,10 @@ func TestSendNtfyAllPriorities(t *testing.T) {
 		input string
 		want  string
 	}{
-		{"error", "urgent"},
-		{"warning", "high"},
-		{"success", "default"},
-		{"info", "low"},
+		{prioError, ntfyUrgent},
+		{prioWarning, "high"},
+		{prioSuccess, ntfyDefault},
+		{prioInfo, "low"},
 	}
 
 	for _, tc := range priorities {
@@ -550,11 +562,11 @@ func TestSendSlackAllColors(t *testing.T) {
 		priority string
 		want     string
 	}{
-		{"error", colorError},
-		{"warning", colorWarning},
-		{"success", colorSuccess},
-		{"info", colorInfo},
-		{"unknown", colorDefault},
+		{prioError, colorError},
+		{prioWarning, colorWarning},
+		{prioSuccess, colorSuccess},
+		{prioInfo, colorInfo},
+		{prioUnknown, colorDefault},
 	}
 
 	for _, tc := range colors {
diff --git a/internal/notify/history_test.go b/internal/notify/history_test.go
index a60804d..b77ff52 100644
--- a/internal/notify/history_test.go
+++ b/internal/notify/history_test.go
@@ -29,14 +29,14 @@ func TestAlertHistoryAddAndRecent(t *testing.T) {
 		Timestamp: now.Add(-2 * time.Minute),
 		Title:     "first",
 		Message:   "msg1",
-		Priority:  "info",
+		Priority:  prioInfo,
 	})
 
 	h.Add(notify.AlertEntry{
 		Timestamp: now.Add(-1 * time.Minute),
 		Title:     "second",
 		Message:   "msg2",
-		Priority:  "warning",
+		Priority:  prioWarning,
 	})
 
 	entries := h.Recent()
diff --git a/internal/state/state_test.go b/internal/state/state_test.go
index 5e95eb9..0ed3093 100644
--- a/internal/state/state_test.go
+++ b/internal/state/state_test.go
@@ -13,6 +13,16 @@ import (
 
 const testHostname = "www.example.com"
 
+// Shared fixture values used across tests.
+const (
+	testNS1     = "ns1.example.com."
+	testNS2     = "ns2.example.com."
+	testAltNS1  = "ns1.test.com."
+	testIPv4    = "93.184.216.34"
+	testIP      = "1.2.3.4"
+	statusError = "error"
+)
+
 // populateState fills a State with representative test data across all categories.
 func populateState(t *testing.T, s *state.State) {
 	t.Helper()
@@ -20,7 +30,7 @@ func populateState(t *testing.T, s *state.State) {
 	now := time.Now().UTC().Truncate(time.Second)
 
 	s.SetDomainState("example.com", &state.DomainState{
-		Nameservers: []string{"ns1.example.com.", "ns2.example.com."},
+		Nameservers: []string{testNS1, testNS2},
 		LastChecked: now,
 	})
 
@@ -31,17 +41,17 @@ func populateState(t *testing.T, s *state.State) {
 
 	s.SetHostnameState(testHostname, &state.HostnameState{
 		RecordsByNameserver: map[string]*state.NameserverRecordState{
-			"ns1.example.com.": {
+			testNS1: {
 				Records: map[string][]string{
-					"A":    {"93.184.216.34"},
+					"A":    {testIPv4},
 					"AAAA": {"2606:2800:220:1:248:1893:25c8:1946"},
 				},
 				Status:      "ok",
 				LastChecked: now,
 			},
-			"ns2.example.com.": {
+			testNS2: {
 				Records: map[string][]string{
-					"A": {"93.184.216.34"},
+					"A": {testIPv4},
 				},
 				Status:      "ok",
 				LastChecked: now,
@@ -152,13 +162,13 @@ func TestSaveLoadRoundTrip_Hostnames(t *testing.T) {
 func verifyNS1Records(t *testing.T, hn *state.HostnameState) {
 	t.Helper()
 
-	ns1, ok := hn.RecordsByNameserver["ns1.example.com."]
+	ns1, ok := hn.RecordsByNameserver[testNS1]
 	if !ok {
 		t.Fatal("missing nameserver ns1.example.com.")
 	}
 
 	aRecords := ns1.Records["A"]
-	if len(aRecords) != 1 || aRecords[0] != "93.184.216.34" {
+	if len(aRecords) != 1 || aRecords[0] != testIPv4 {
 		t.Errorf("ns1 A records: got %v", aRecords)
 	}
 
@@ -653,7 +663,7 @@ func TestDomainState_GetSet(t *testing.T) {
 
 	now := time.Now().UTC().Truncate(time.Second)
 	ds := &state.DomainState{
-		Nameservers: []string{"ns1.test.com."},
+		Nameservers: []string{testAltNS1},
 		LastChecked: now,
 	}
 
@@ -664,7 +674,7 @@ func TestDomainState_GetSet(t *testing.T) {
 		t.Fatal("expected true for existing domain")
 	}
 
-	if len(got.Nameservers) != 1 || got.Nameservers[0] != "ns1.test.com." {
+	if len(got.Nameservers) != 1 || got.Nameservers[0] != testAltNS1 {
 		t.Errorf("nameservers: got %v", got.Nameservers)
 	}
 
@@ -674,7 +684,7 @@ func TestDomainState_GetSet(t *testing.T) {
 
 	// Overwrite.
 	ds2 := &state.DomainState{
-		Nameservers: []string{"ns1.test.com.", "ns2.test.com."},
+		Nameservers: []string{testAltNS1, "ns2.test.com."},
 		LastChecked: now.Add(time.Hour),
 	}
 
@@ -704,8 +714,8 @@ func TestHostnameState_GetSet(t *testing.T) {
 	now := time.Now().UTC().Truncate(time.Second)
 	hs := &state.HostnameState{
 		RecordsByNameserver: map[string]*state.NameserverRecordState{
-			"ns1.example.com.": {
-				Records:     map[string][]string{"A": {"1.2.3.4"}},
+			testNS1: {
+				Records:     map[string][]string{"A": {testIP}},
 				Status:      "ok",
 				LastChecked: now,
 			},
@@ -720,7 +730,7 @@ func TestHostnameState_GetSet(t *testing.T) {
 		t.Fatal("expected true for existing hostname")
 	}
 
-	nsState, ok := got.RecordsByNameserver["ns1.example.com."]
+	nsState, ok := got.RecordsByNameserver[testNS1]
 	if !ok {
 		t.Fatal("missing nameserver entry")
 	}
@@ -730,7 +740,7 @@ func TestHostnameState_GetSet(t *testing.T) {
 	}
 
 	aRecords := nsState.Records["A"]
-	if len(aRecords) != 1 || aRecords[0] != "1.2.3.4" {
+	if len(aRecords) != 1 || aRecords[0] != testIP {
 		t.Errorf("A records: got %v", aRecords)
 	}
 }
@@ -869,7 +879,7 @@ func TestCertificateState_ErrorField(t *testing.T) {
 
 	now := time.Now().UTC().Truncate(time.Second)
 	cs := &state.CertificateState{
-		Status:      "error",
+		Status:      statusError,
 		Error:       "connection refused",
 		LastChecked: now,
 	}
@@ -893,8 +903,8 @@ func TestCertificateState_ErrorField(t *testing.T) {
 		t.Fatal("missing certificate after load")
 	}
 
-	if got.Status != "error" {
-		t.Errorf("status: got %q, want %q", got.Status, "error")
+	if got.Status != statusError {
+		t.Errorf("status: got %q, want %q", got.Status, statusError)
 	}
 
 	if got.Error != "connection refused" {
@@ -912,9 +922,9 @@ func TestHostnameState_ErrorField(t *testing.T) {
 	now := time.Now().UTC().Truncate(time.Second)
 	hs := &state.HostnameState{
 		RecordsByNameserver: map[string]*state.NameserverRecordState{
-			"ns1.example.com.": {
+			testNS1: {
 				Records:     nil,
-				Status:      "error",
+				Status:      statusError,
 				Error:       "SERVFAIL",
 				LastChecked: now,
 			},
@@ -941,9 +951,9 @@ func TestHostnameState_ErrorField(t *testing.T) {
 		t.Fatal("missing hostname after load")
 	}
 
-	nsState := got.RecordsByNameserver["ns1.example.com."]
-	if nsState.Status != "error" {
-		t.Errorf("status: got %q, want %q", nsState.Status, "error")
+	nsState := got.RecordsByNameserver[testNS1]
+	if nsState.Status != statusError {
+		t.Errorf("status: got %q, want %q", nsState.Status, statusError)
 	}
 
 	if nsState.Error != "SERVFAIL" {
@@ -1085,7 +1095,7 @@ func runConcurrentOps(s *state.State, key string, now time.Time) {
 		s.SetHostnameState(key+".example.com", &state.HostnameState{
 			RecordsByNameserver: map[string]*state.NameserverRecordState{
 				"ns1.test.": {
-					Records:     map[string][]string{"A": {"1.2.3.4"}},
+					Records:     map[string][]string{"A": {testIP}},
 					Status:      "ok",
 					LastChecked: now,
 				},
diff --git a/internal/watcher/watcher.go b/internal/watcher/watcher.go
index bdf4f22..07dc092 100644
--- a/internal/watcher/watcher.go
+++ b/internal/watcher/watcher.go
@@ -26,6 +26,9 @@ const tlsPort = 443
 // hoursPerDay converts days to hours for duration calculations.
 const hoursPerDay = 24
 
+// statusError is the status value recorded for failed checks.
+const statusError = "error"
+
 // Params contains dependencies for Watcher.
 type Params struct {
 	fx.In
@@ -421,7 +424,7 @@ func (w *Watcher) detectNSDisappearances(
 
 	for ns := range current {
 		prevNS, ok := prev.RecordsByNameserver[ns]
-		if !ok || prevNS.Status != "error" {
+		if !ok || prevNS.Status != statusError {
 			continue
 		}
 
@@ -721,7 +724,7 @@ func (w *Watcher) handleTLSError(
 
 	w.state.SetCertificateState(
 		certKey, &state.CertificateState{
-			Status:      "error",
+			Status:      statusError,
 			Error:       err.Error(),
 			LastChecked: now,
 		},
@@ -760,7 +763,7 @@ func (w *Watcher) detectTLSChanges(
 	prev *state.CertificateState,
 	cert *tlscheck.CertificateInfo,
 ) {
-	if prev.Status == "error" {
+	if prev.Status == statusError {
 		msg := fmt.Sprintf(
 			"Host: %s\nIP: %s\nTLS recovered",
 			hostname, ip,
diff --git a/internal/watcher/watcher_test.go b/internal/watcher/watcher_test.go
index ea6dbef..0069af2 100644
--- a/internal/watcher/watcher_test.go
+++ b/internal/watcher/watcher_test.go
@@ -18,6 +18,17 @@ import (
 // errNotFound is returned when mock data is missing.
 var errNotFound = errors.New("not found")
 
+// Fixture values shared across tests.
+const (
+	testDomain = "example.com"
+	testHost   = "www.example.com"
+	testNS1    = "ns1.example.com."
+	testNS2    = "ns2.example.com."
+	testIPv4   = "93.184.216.34"
+	testIP     = "1.2.3.4"
+	testIssuer = "DigiCert"
+)
+
 // --- Mock implementations ---
 
 type mockResolver struct {
@@ -256,8 +267,8 @@ func TestFirstRunBaseline(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{"example.com"}
-	cfg.Hostnames = []string{"www.example.com"}
+	cfg.Domains = []string{testDomain}
+	cfg.Hostnames = []string{testHost}
 
 	w, deps := newTestWatcher(t, cfg)
 	setupBaselineMocks(deps)
@@ -269,37 +280,37 @@ func TestFirstRunBaseline(t *testing.T) {
 }
 
 func setupBaselineMocks(deps *testDeps) {
-	deps.resolver.nsRecords["example.com"] = []string{
-		"ns1.example.com.",
-		"ns2.example.com.",
+	deps.resolver.nsRecords[testDomain] = []string{
+		testNS1,
+		testNS2,
 	}
-	deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
-		"ns1.example.com.": {"A": {"93.184.216.34"}},
-		"ns2.example.com.": {"A": {"93.184.216.34"}},
+	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
+		testNS1: {"A": {testIPv4}},
+		testNS2: {"A": {testIPv4}},
 	}
-	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
-		"ns1.example.com.": {"A": {"93.184.216.34"}},
-		"ns2.example.com.": {"A": {"93.184.216.34"}},
+	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
+		testNS1: {"A": {testIPv4}},
+		testNS2: {"A": {testIPv4}},
 	}
-	deps.resolver.ipAddresses["www.example.com"] = []string{
-		"93.184.216.34",
+	deps.resolver.ipAddresses[testHost] = []string{
+		testIPv4,
 	}
 	deps.portChecker.results["93.184.216.34:80"] = true
 	deps.portChecker.results["93.184.216.34:443"] = true
 	deps.tlsChecker.certs["93.184.216.34:www.example.com"] = &tlscheck.CertificateInfo{
-		CommonName: "www.example.com",
-		Issuer:     "DigiCert",
+		CommonName: testHost,
+		Issuer:     testIssuer,
 		NotAfter:   time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
-			"www.example.com",
+			testHost,
 		},
 	}
 	deps.tlsChecker.certs["93.184.216.34:example.com"] = &tlscheck.CertificateInfo{
-		CommonName: "example.com",
-		Issuer:     "DigiCert",
+		CommonName: testDomain,
+		Issuer:     testIssuer,
 		NotAfter:   time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
-			"example.com",
+			testDomain,
 		},
 	}
 }
@@ -348,24 +359,24 @@ func TestDomainPortAndTLSChecks(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{"example.com"}
+	cfg.Domains = []string{testDomain}
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.nsRecords["example.com"] = []string{
-		"ns1.example.com.",
+	deps.resolver.nsRecords[testDomain] = []string{
+		testNS1,
 	}
-	deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
-		"ns1.example.com.": {"A": {"93.184.216.34"}},
+	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
+		testNS1: {"A": {testIPv4}},
 	}
 	deps.portChecker.results["93.184.216.34:80"] = true
 	deps.portChecker.results["93.184.216.34:443"] = true
 	deps.tlsChecker.certs["93.184.216.34:example.com"] = &tlscheck.CertificateInfo{
-		CommonName: "example.com",
-		Issuer:     "DigiCert",
+		CommonName: testDomain,
+		Issuer:     testIssuer,
 		NotAfter:   time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
-			"example.com",
+			testDomain,
 		},
 	}
 
@@ -406,17 +417,17 @@ func TestNSChangeDetection(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{"example.com"}
+	cfg.Domains = []string{testDomain}
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.nsRecords["example.com"] = []string{
-		"ns1.example.com.",
-		"ns2.example.com.",
+	deps.resolver.nsRecords[testDomain] = []string{
+		testNS1,
+		testNS2,
 	}
-	deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
-		"ns1.example.com.": {"A": {"1.2.3.4"}},
-		"ns2.example.com.": {"A": {"1.2.3.4"}},
+	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
+		testNS1: {"A": {testIP}},
+		testNS2: {"A": {testIP}},
 	}
 	deps.portChecker.results["1.2.3.4:80"] = false
 	deps.portChecker.results["1.2.3.4:443"] = false
@@ -425,13 +436,13 @@ func TestNSChangeDetection(t *testing.T) {
 	w.RunOnce(ctx)
 
 	deps.resolver.mu.Lock()
-	deps.resolver.nsRecords["example.com"] = []string{
-		"ns1.example.com.",
+	deps.resolver.nsRecords[testDomain] = []string{
+		testNS1,
 		"ns3.example.com.",
 	}
-	deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
-		"ns1.example.com.": {"A": {"1.2.3.4"}},
-		"ns3.example.com.": {"A": {"1.2.3.4"}},
+	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
+		testNS1:            {"A": {testIP}},
+		"ns3.example.com.": {"A": {testIP}},
 	}
 	deps.resolver.mu.Unlock()
 
@@ -459,15 +470,15 @@ func TestRecordChangeDetection(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Hostnames = []string{"www.example.com"}
+	cfg.Hostnames = []string{testHost}
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
-		"ns1.example.com.": {"A": {"93.184.216.34"}},
+	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
+		testNS1: {"A": {testIPv4}},
 	}
-	deps.resolver.ipAddresses["www.example.com"] = []string{
-		"93.184.216.34",
+	deps.resolver.ipAddresses[testHost] = []string{
+		testIPv4,
 	}
 	deps.portChecker.results["93.184.216.34:80"] = false
 	deps.portChecker.results["93.184.216.34:443"] = false
@@ -476,10 +487,10 @@ func TestRecordChangeDetection(t *testing.T) {
 	w.RunOnce(ctx)
 
 	deps.resolver.mu.Lock()
-	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
-		"ns1.example.com.": {"A": {"93.184.216.35"}},
+	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
+		testNS1: {"A": {"93.184.216.35"}},
 	}
-	deps.resolver.ipAddresses["www.example.com"] = []string{
+	deps.resolver.ipAddresses[testHost] = []string{
 		"93.184.216.35",
 	}
 	deps.resolver.mu.Unlock()
@@ -501,24 +512,24 @@ func TestPortStateChange(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Hostnames = []string{"www.example.com"}
+	cfg.Hostnames = []string{testHost}
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
-		"ns1.example.com.": {"A": {"1.2.3.4"}},
+	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
+		testNS1: {"A": {testIP}},
 	}
-	deps.resolver.ipAddresses["www.example.com"] = []string{
-		"1.2.3.4",
+	deps.resolver.ipAddresses[testHost] = []string{
+		testIP,
 	}
 	deps.portChecker.results["1.2.3.4:80"] = true
 	deps.portChecker.results["1.2.3.4:443"] = true
 	deps.tlsChecker.certs["1.2.3.4:www.example.com"] = &tlscheck.CertificateInfo{
-		CommonName: "www.example.com",
-		Issuer:     "DigiCert",
+		CommonName: testHost,
+		Issuer:     testIssuer,
 		NotAfter:   time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
-			"www.example.com",
+			testHost,
 		},
 	}
 
@@ -541,24 +552,24 @@ func TestTLSExpiryWarning(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Hostnames = []string{"www.example.com"}
+	cfg.Hostnames = []string{testHost}
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
-		"ns1.example.com.": {"A": {"1.2.3.4"}},
+	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
+		testNS1: {"A": {testIP}},
 	}
-	deps.resolver.ipAddresses["www.example.com"] = []string{
-		"1.2.3.4",
+	deps.resolver.ipAddresses[testHost] = []string{
+		testIP,
 	}
 	deps.portChecker.results["1.2.3.4:80"] = true
 	deps.portChecker.results["1.2.3.4:443"] = true
 	deps.tlsChecker.certs["1.2.3.4:www.example.com"] = &tlscheck.CertificateInfo{
-		CommonName: "www.example.com",
-		Issuer:     "DigiCert",
+		CommonName: testHost,
+		Issuer:     testIssuer,
 		NotAfter:   time.Now().Add(3 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
-			"www.example.com",
+			testHost,
 		},
 	}
 
@@ -592,25 +603,25 @@ func TestTLSExpiryWarningDedup(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Hostnames = []string{"www.example.com"}
+	cfg.Hostnames = []string{testHost}
 	cfg.TLSInterval = 24 * time.Hour
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
-		"ns1.example.com.": {"A": {"1.2.3.4"}},
+	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
+		testNS1: {"A": {testIP}},
 	}
-	deps.resolver.ipAddresses["www.example.com"] = []string{
-		"1.2.3.4",
+	deps.resolver.ipAddresses[testHost] = []string{
+		testIP,
 	}
 	deps.portChecker.results["1.2.3.4:80"] = true
 	deps.portChecker.results["1.2.3.4:443"] = true
 	deps.tlsChecker.certs["1.2.3.4:www.example.com"] = &tlscheck.CertificateInfo{
-		CommonName: "www.example.com",
-		Issuer:     "DigiCert",
+		CommonName: testHost,
+		Issuer:     testIssuer,
 		NotAfter:   time.Now().Add(3 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
-			"www.example.com",
+			testHost,
 		},
 	}
 
@@ -647,17 +658,17 @@ func TestGracefulShutdown(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{"example.com"}
+	cfg.Domains = []string{testDomain}
 	cfg.DNSInterval = 100 * time.Millisecond
 	cfg.TLSInterval = 100 * time.Millisecond
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.nsRecords["example.com"] = []string{
-		"ns1.example.com.",
+	deps.resolver.nsRecords[testDomain] = []string{
+		testNS1,
 	}
-	deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
-		"ns1.example.com.": {"A": {"1.2.3.4"}},
+	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
+		testNS1: {"A": {testIP}},
 	}
 	deps.portChecker.results["1.2.3.4:80"] = false
 	deps.portChecker.results["1.2.3.4:443"] = false
@@ -687,13 +698,13 @@ func setupHostnameIP(
 	hostname, ip string,
 ) {
 	deps.resolver.allRecords[hostname] = map[string]map[string][]string{
-		"ns1.example.com.": {"A": {ip}},
+		testNS1: {"A": {ip}},
 	}
 	deps.portChecker.results[ip+":80"] = true
 	deps.portChecker.results[ip+":443"] = true
 	deps.tlsChecker.certs[ip+":"+hostname] = &tlscheck.CertificateInfo{
 		CommonName:              hostname,
-		Issuer:                  "DigiCert",
+		Issuer:                  testIssuer,
 		NotAfter:                time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{hostname},
 	}
@@ -702,7 +713,7 @@ func setupHostnameIP(
 func updateHostnameIP(deps *testDeps, hostname, ip string) {
 	deps.resolver.mu.Lock()
 	deps.resolver.allRecords[hostname] = map[string]map[string][]string{
-		"ns1.example.com.": {"A": {ip}},
+		testNS1: {"A": {ip}},
 	}
 	deps.resolver.mu.Unlock()
 
@@ -714,7 +725,7 @@ func updateHostnameIP(deps *testDeps, hostname, ip string) {
 	deps.tlsChecker.mu.Lock()
 	deps.tlsChecker.certs[ip+":"+hostname] = &tlscheck.CertificateInfo{
 		CommonName:              hostname,
-		Issuer:                  "DigiCert",
+		Issuer:                  testIssuer,
 		NotAfter:                time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{hostname},
 	}
@@ -725,11 +736,11 @@ func TestDNSRunsBeforePortAndTLSChecks(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Hostnames = []string{"www.example.com"}
+	cfg.Hostnames = []string{testHost}
 
 	w, deps := newTestWatcher(t, cfg)
 
-	setupHostnameIP(deps, "www.example.com", "10.0.0.1")
+	setupHostnameIP(deps, testHost, "10.0.0.1")
 
 	ctx := t.Context()
 	w.RunOnce(ctx)
@@ -740,7 +751,7 @@ func TestDNSRunsBeforePortAndTLSChecks(t *testing.T) {
 	}
 
 	// DNS changes to a new IP; port and TLS must pick it up.
-	updateHostnameIP(deps, "www.example.com", "10.0.0.2")
+	updateHostnameIP(deps, testHost, "10.0.0.2")
 
 	w.RunOnce(ctx)
 
@@ -760,8 +771,8 @@ func TestSendTestNotification_Enabled(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{"example.com"}
-	cfg.Hostnames = []string{"www.example.com"}
+	cfg.Domains = []string{testDomain}
+	cfg.Hostnames = []string{testHost}
 	cfg.SendTestNotification = true
 
 	w, deps := newTestWatcher(t, cfg)
@@ -786,8 +797,8 @@ func TestSendTestNotification_ViaRun(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{"example.com"}
-	cfg.Hostnames = []string{"www.example.com"}
+	cfg.Domains = []string{testDomain}
+	cfg.Hostnames = []string{testHost}
 	cfg.SendTestNotification = true
 	cfg.DNSInterval = 24 * time.Hour
 	cfg.TLSInterval = 24 * time.Hour
@@ -833,8 +844,8 @@ func TestSendTestNotification_Disabled(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{"example.com"}
-	cfg.Hostnames = []string{"www.example.com"}
+	cfg.Domains = []string{testDomain}
+	cfg.Hostnames = []string{testHost}
 	cfg.SendTestNotification = false
 	cfg.DNSInterval = 24 * time.Hour
 	cfg.TLSInterval = 24 * time.Hour
@@ -871,16 +882,16 @@ func TestNSFailureAndRecovery(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Hostnames = []string{"www.example.com"}
+	cfg.Hostnames = []string{testHost}
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
-		"ns1.example.com.": {"A": {"1.2.3.4"}},
-		"ns2.example.com.": {"A": {"1.2.3.4"}},
+	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
+		testNS1: {"A": {testIP}},
+		testNS2: {"A": {testIP}},
 	}
-	deps.resolver.ipAddresses["www.example.com"] = []string{
-		"1.2.3.4",
+	deps.resolver.ipAddresses[testHost] = []string{
+		testIP,
 	}
 	deps.portChecker.results["1.2.3.4:80"] = false
 	deps.portChecker.results["1.2.3.4:443"] = false
@@ -890,8 +901,8 @@ func TestNSFailureAndRecovery(t *testing.T) {
 	w.RunOnce(ctx)
 
 	deps.resolver.mu.Lock()
-	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
-		"ns1.example.com.": {"A": {"1.2.3.4"}},
+	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
+		testNS1: {"A": {testIP}},
 	}
 	deps.resolver.mu.Unlock()
 
diff --git a/script/bootstrap b/script/bootstrap
index ffcb29a..129cc77 100755
--- a/script/bootstrap
+++ b/script/bootstrap
@@ -9,9 +9,9 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# Pinned versions, 2026-07-07 (same pins as the Dockerfile)
-# golangci-lint v2.10.1
-GOLANGCI_LINT_REF="github.com/golangci/golangci-lint/v2/cmd/golangci-lint@5d1e709b7be35cb2025444e19de266b056b7b7ee"
+# Pinned versions, 2026-08-07 (same pins as the Dockerfile)
+# golangci-lint v2.12.2
+GOLANGCI_LINT_REF="github.com/golangci/golangci-lint/v2/cmd/golangci-lint@c0d3ddc9cf3faa61a4e378e879ece580256d76e5"
 # goimports v0.42.0
 GOIMPORTS_REF="golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0"