diff --git a/.golangci.yml b/.golangci.yml
index 3bc2c1c..1d6b3c6 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -97,9 +97,11 @@ linters:
           reason: "Unmaintained fork; use go-udiff."
   exclusions:
     rules:
-      # homoicon keeps a local copy of the JavaScript engine (sneak's decision,
-      # https://git.eeqj.de/sneak/homoicon/issues/1759#issuecomment-153261).
-      # Excluded, as gomoddirectives' replace-allow-list skips local paths.
+      # homoicon keeps a local copy of sobek, its JavaScript engine, as sneak
+      # decided in
+      # https://git.eeqj.de/sneak/homoicon/issues/1759#issuecomment-153261.
+      # This is an exclusion because gomoddirectives does not check its
+      # replace-allow-list for a replace that points at a local path.
       - path: ^go\.mod$
         linters:
           - gomoddirectives
diff --git a/TODO.md b/TODO.md
index 3e81cc2..8c927fd 100644
--- a/TODO.md
+++ b/TODO.md
@@ -21,6 +21,14 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-10-21: The canonical `.golangci.yml` now accepts a local `replace` of
+  `github.com/grafana/sobek` in a repository's root `go.mod` (issue 134), for
+  homoicon, which keeps a local copy of sobek on sneak's decision in
+  https://git.eeqj.de/sneak/homoicon/issues/1759#issuecomment-153261. Every
+  other local `replace` is still refused. It is an exclusion rather than a
+  `replace-allow-list` entry because gomoddirectives does not check that list
+  for a `replace` that points at a local path. homoicon picks this up on its
+  next re-vendor.
 - 2026-10-18: Check builds may now also keep Go's downloaded modules,
   golangci-lint's cache and the layers that install system packages (issue 130),
   on sneak's ruling there. In each stage of the canonical Go `Dockerfile`, the