diff --git a/.golangci.yml b/.golangci.yml
index 34a8e31..a27ba87 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -9,24 +9,26 @@ linters:
   disable:
     # Genuinely incompatible with project patterns
     - exhaustruct      # Requires all struct fields
+    - exhaustruct_v5   # Same linter, newer major version (since v2.13.0)
     - depguard         # Dependency allow/block lists
     - godot            # Requires comments to end with periods
     - wsl              # Deprecated, replaced by wsl_v5
+    - gomodguard       # Deprecated, replaced by gomodguard_v2
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
+  settings:
+    lll:
+      line-length: 88
+    funlen:
+      lines: 80
+      statements: 50
+    cyclop:
+      max-complexity: 15
+    dupl:
+      threshold: 100
 
-linters-settings:
-  lll:
-    line-length: 88
-  funlen:
-    lines: 80
-    statements: 50
-  cyclop:
-    max-complexity: 15
-  dupl:
-    threshold: 100
-
+# No default exclusions: v2 applies none unless linters.exclusions.presets
+# is set, which replaces v1's exclude-use-default: false.
 issues:
-  exclude-use-default: false
   max-issues-per-linter: 0
   max-same-issues: 0
diff --git a/Dockerfile b/Dockerfile
index 9fc066d..4d2deb3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,10 +9,8 @@
 # BuildKit cannot finish the build unless every check passed.
 
 # Lint stage: fast feedback on Go formatting and lint issues
-# golangci/golangci-lint:v2.12.2, 2026-05-06
-# Pinned below v2.13.0 until the canonical .golangci.yml disables
-# exhaustruct_v5 (see the TODO in README.md). Keep in sync with Makefile.
-FROM golangci/golangci-lint@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
+# golangci/golangci-lint:v2.15.0, 2026-10-16 (keep in sync with Makefile)
+FROM golangci/golangci-lint@sha256:fbfcfd12a6f8d7f1b97b3362ca80fc2a244d46863148c73cb88e7793af96c481 AS lint
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
diff --git a/Makefile b/Makefile
index e731973..04e9397 100644
--- a/Makefile
+++ b/Makefile
@@ -12,10 +12,8 @@ VERSION := $(shell git describe --always --dirty 2>/dev/null || echo dev)
 GOLDFLAGS := -X main.Version=$(VERSION)
 GO_DIRS := cmd internal pkg
 
-# golangci/golangci-lint:v2.12.2, 2026-05-06
-# Pinned below v2.13.0 until the canonical .golangci.yml disables
-# exhaustruct_v5 (see the TODO in README.md). Keep in sync with Dockerfile.
-GOLANGCI_LINT_IMAGE := golangci/golangci-lint@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240
+# golangci/golangci-lint:v2.15.0, 2026-10-16 (keep in sync with Dockerfile)
+GOLANGCI_LINT_IMAGE := golangci/golangci-lint@sha256:fbfcfd12a6f8d7f1b97b3362ca80fc2a244d46863148c73cb88e7793af96c481
 
 # flags are repeated here (also in .prettierrc) so this Makefile works
 # standalone when copied as a template
diff --git a/README.md b/README.md
index 2b56318..07a4e92 100644
--- a/README.md
+++ b/README.md
@@ -230,9 +230,10 @@ seconds, and the build stage, which runs the tests and compiles `sutil`, depends
 on both. The runtime image carries the binary and the source it was built from.
 Every external reference, from base images to the GitHub Action in
 `.gitea/workflows/check.yml`, is pinned by content hash with a version and date
-comment. `.golangci.yml` is the standard configuration and is never edited by
-hand here. cgo stays off: the Makefile exports `CGO_ENABLED=0` for every build
-and test, so binaries are static and no C toolchain is needed anywhere.
+comment. `.golangci.yml` is this repo's copy of the standard configuration, kept
+in the v2 layout with `exhaustruct_v5` and the deprecated `gomodguard` disabled.
+cgo stays off: the Makefile exports `CGO_ENABLED=0` for every build and test, so
+binaries are static and no C toolchain is needed anywhere.
 
 Version tags are created by the author alone, when the author decides. Tooling,
 contributors, and agents working in this repository do not propose, schedule, or
@@ -250,12 +251,7 @@ make docker     # the full CI build
 
 ## TODO
 
-- [ ] Bump the pinned `golangci/golangci-lint` image (in `Makefile` and
-      `Dockerfile`) past v2.12.2 once the canonical `.golangci.yml` disables
-      `exhaustruct_v5`, which v2.13.0 added alongside the already-disabled
-      `exhaustruct`, and replaces the deprecated `gomodguard` with
-      `gomodguard_v2`. With `default: all`, newer images enable `exhaustruct_v5`
-      and fail every partial struct literal.
+Nothing outstanding.
 
 ## License