diff --git a/.golangci.yml b/.golangci.yml
index 1b73eb9..32db9fe 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -25,6 +25,8 @@ linters:
     # silenced by disabling that name, not by enabling the successor.
     - wsl              # Deprecated, replaced by wsl_v5
     - gomodguard       # Deprecated, replaced by gomodguard_v2
+    # Misses findings at random in v2.14.0; back once a pinned release fixes it
+    - canonicalheader
   settings:
     lll:
       line-length: 88
diff --git a/TODO.md b/TODO.md
index 1434757..d3ce5de 100644
--- a/TODO.md
+++ b/TODO.md
@@ -21,6 +21,11 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-10-06: The canonical `.golangci.yml` now disables `canonicalheader`
+  (issue 105). In golangci-lint v2.14.0 it misses findings at random in a
+  package that also calls `ResponseWriter.Header()`, so the same tree can fail
+  lint on one run and pass on the next. It comes back once a pinned
+  golangci-lint release fixes it.
 - 2026-10-04: Went through the fleet findings recorded on 2026-08-09 (issue 62)
   and added the two rules `REPO_POLICIES.md` did not yet state: a new or changed
   check is proven by planting a defect it must catch; and a change to a separate