diff --git a/internal/config/config.go b/internal/config/config.go
index 00b1061..6a3af39 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -206,6 +206,7 @@ func (c *Config) ensureStateDirWritable() error {
 			"state_dir", probePath, err)
 	}
 
+	//nolint:gosec // G703: probePath comes from os.CreateTemp inside the just-validated StateDir
 	if err := os.Remove(probePath); err != nil {
 		return fmt.Errorf("config key %q: cannot remove probe file %q: %w",
 			"state_dir", probePath, err)