diff --git a/.golangci.yml b/.golangci.yml
index 1b73eb9..32db9fe 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -25,6 +25,8 @@ linters:
     # silenced by disabling that name, not by enabling the successor.
     - wsl              # Deprecated, replaced by wsl_v5
     - gomodguard       # Deprecated, replaced by gomodguard_v2
+    # Misses findings at random in v2.14.0; back once a pinned release fixes it
+    - canonicalheader
   settings:
     lll:
       line-length: 88
diff --git a/TODO.md b/TODO.md
index 20c8a60..897d276 100644
--- a/TODO.md
+++ b/TODO.md
@@ -21,6 +21,11 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-10-06: The canonical `.golangci.yml` now disables `canonicalheader`
+  (issue 105). In golangci-lint v2.14.0 it misses findings at random in a
+  package that also calls `ResponseWriter.Header()`, so the same tree can fail
+  lint on one run and pass on the next. It comes back once a pinned
+  golangci-lint release fixes it.
 - 2026-10-05: `script/cibuild`, `script/docker`, `script/lint` and `script/test`
   now assign the image tag from `script/projectname` on its own line before the
   `docker build` (issue 101), so `set -e` stops the script where