diff --git a/.golangci.yml b/.golangci.yml
index 26b1610..08a1e63 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,9 +1,5 @@
 version: "2"
 
-# Config schema uses the golangci-lint v2 layout (settings live under
-# linters.settings, not top-level linters-settings) so that the
-# thresholds below are actually applied by golangci-lint >= v2.
-
 run:
   timeout: 5m
   modules-download-mode: readonly
@@ -16,6 +12,7 @@ linters:
     - depguard         # Dependency allow/block lists
     - godot            # Requires comments to end with periods
     - wsl              # Deprecated, replaced by wsl_v5
+    - gomodguard       # Deprecated, replaced by gomodguard_v2
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
   settings:
@@ -28,7 +25,25 @@ linters:
       max-complexity: 15
     dupl:
       threshold: 100
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
 
 issues:
   max-issues-per-linter: 0
   max-same-issues: 0
+
+formatters:
+  enable:
+    - gofmt
+    - gofumpt
+    - goimports
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
diff --git a/TODO.md b/TODO.md
index 4f82be5..3f05c3c 100644
--- a/TODO.md
+++ b/TODO.md
@@ -22,8 +22,10 @@ fmt-check, and commit.
 # Completed Steps
 
 - 2026-08-07: Migrated the canonical `.golangci.yml` to the golangci-lint v2
-  config layout (settings under `linters.settings`, dropped
-  `exclude-use-default`).
+  schema via `golangci-lint migrate` under v2.12.2 (settings under
+  `linters.settings`, explicit `exclusions` and `formatters` blocks,
+  `gomodguard` disabled in favor of `gomodguard_v2`; `gci` intentionally not
+  enabled).
 - 2026-03-20: Strengthened constructor naming and Params struct rules in the Go
   styleguide.
 - 2026-03-18: Documented fail-fast Dockerfile lint stage and conditional -v test