diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7e10edb44..fe48db7cb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -43,7 +43,7 @@ jobs:
     - name: Install Go
       uses: actions/setup-go@v6
       with:
-        go-version: '1.25'
+        go-version-file: 'go.mod'
         check-latest: true
     - name: Calculate changed plugins and set PLUGINS env var from last successful commit push
       if: ${{ inputs.plugins == '' }}
diff --git a/.github/workflows/fetch_versions.yml b/.github/workflows/fetch_versions.yml
index e810a4b33..72445a11b 100644
--- a/.github/workflows/fetch_versions.yml
+++ b/.github/workflows/fetch_versions.yml
@@ -31,7 +31,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.25'
+          go-version-file: 'go.mod'
           check-latest: true
       - name: Get buf version
         shell: bash
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 91d579127..975daba44 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -37,7 +37,7 @@ jobs:
     - name: Install Go
       uses: actions/setup-go@v6
       with:
-        go-version: '1.25'
+        go-version-file: 'go.mod'
         check-latest: true
     - name: Calculate changed plugins and set PLUGINS env var from base branch
       if: ${{ inputs.plugins == '' }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 309ce9634..56bd112f3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -33,7 +33,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.25'
+          go-version-file: 'go.mod'
           check-latest: true
       - name: Create Release
         env:
diff --git a/.github/workflows/restore-release.yml b/.github/workflows/restore-release.yml
index bccc8128f..cfdebee08 100644
--- a/.github/workflows/restore-release.yml
+++ b/.github/workflows/restore-release.yml
@@ -32,7 +32,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.25'
+          go-version-file: 'go.mod'
           check-latest: true
       - name: Restore Release
         env:
diff --git a/.github/workflows/upload.yml b/.github/workflows/upload.yml
index 2a517889f..ec0f9f2d5 100644
--- a/.github/workflows/upload.yml
+++ b/.github/workflows/upload.yml
@@ -32,7 +32,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.25'
+          go-version-file: 'go.mod'
           check-latest: true
         # uses https://cloud.google.com/iam/docs/workload-identity-federation to
         # swap a GitHub OIDC token for GCP service account credentials, allowing
diff --git a/.golangci.yml b/.golangci.yml
index ab889827f..4c21d71a9 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -67,6 +67,11 @@ linters:
           - gosec
           - prealloc
         path: _test\.go
+      # internal/plugin predates this rule; renaming would be disruptive
+      - linters:
+          - revive
+        path: internal/plugin/
+        text: "var-naming: avoid package names"
 formatters:
   enable:
     - gci
diff --git a/Makefile b/Makefile
index 4e7b0940d..298ddd48d 100644
--- a/Makefile
+++ b/Makefile
@@ -8,7 +8,7 @@ DOCKER_BUILD_EXTRA_ARGS ?=
 DOCKER_BUILDER := bufbuild-plugins
 DOCKER_CACHE_DIR ?= $(TMP)/dockercache
 GO ?= go
-GOLANGCI_LINT_VERSION ?= v2.8.0
+GOLANGCI_LINT_VERSION ?= v2.9.0
 GOLANGCI_LINT := $(TMP)/golangci-lint-$(GOLANGCI_LINT_VERSION)
 
 GO_TEST_FLAGS ?= -race -count=1
diff --git a/go.mod b/go.mod
index 5562f25c4..b1fe1f836 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/bufbuild/plugins
 
-go 1.25.0
+go 1.26.0
 
 require (
 	aead.dev/minisign v0.3.0
diff --git a/internal/cmd/release/main.go b/internal/cmd/release/main.go
index 99493c724..beb8f3f9f 100644
--- a/internal/cmd/release/main.go
+++ b/internal/cmd/release/main.go
@@ -236,9 +236,7 @@ func (c *command) calculateNewReleasePlugins(ctx context.Context, currentRelease
 		return nil, nil
 	}
 
-	plugins := make([]release.PluginRelease, 0, len(newPlugins)+len(existingPlugins))
-	plugins = append(plugins, newPlugins...)
-	plugins = append(plugins, existingPlugins...)
+	plugins := slices.Concat(newPlugins, existingPlugins)
 	sortPluginsByNameVersion(plugins)
 	return plugins, nil
 }
@@ -286,20 +284,20 @@ func sortPluginsByNameVersion(plugins []release.PluginRelease) {
 }
 
 func (c *command) createRelease(ctx context.Context, client *release.Client, releaseName string, plugins []release.PluginRelease, tmpDir string, privateKey minisign.PrivateKey) error {
-	releaseBody, err := c.createReleaseBody(releaseName, plugins, privateKey)
+	releaseBody, err := c.createReleaseBody(releaseName, plugins, privateKey) //nolint:staticcheck // SA4006 false positive with Go 1.26 new(value)
 	if err != nil {
 		return err
 	}
 	// Create GitHub release
 	repositoryReleaseParams := &github.RepositoryRelease{
-		TagName: github.Ptr(releaseName),
-		Name:    github.Ptr(releaseName),
-		Body:    github.Ptr(releaseBody),
+		TagName: new(releaseName),
+		Name:    new(releaseName),
+		Body:    new(releaseBody),
 		// Start release as a draft until all assets are uploaded
-		Draft: github.Ptr(true),
+		Draft: new(true),
 	}
 	if c.githubCommit != "" {
-		repositoryReleaseParams.TargetCommitish = github.Ptr(c.githubCommit)
+		repositoryReleaseParams.TargetCommitish = new(c.githubCommit)
 	}
 	repositoryRelease, err := client.CreateRelease(ctx, c.githubReleaseOwner, release.GithubRepoPlugins, repositoryReleaseParams)
 	if err != nil {
@@ -319,7 +317,7 @@ func (c *command) createRelease(ctx context.Context, client *release.Client, rel
 	}
 	// Publish release
 	if _, err := client.EditRelease(ctx, c.githubReleaseOwner, release.GithubRepoPlugins, repositoryRelease.GetID(), &github.RepositoryRelease{
-		Draft: github.Ptr(false),
+		Draft: new(false),
 	}); err != nil {
 		return err
 	}
diff --git a/internal/cmd/restore-release/main.go b/internal/cmd/restore-release/main.go
index d5e74f968..87d7c4eee 100644
--- a/internal/cmd/restore-release/main.go
+++ b/internal/cmd/restore-release/main.go
@@ -19,6 +19,7 @@ import (
 	"log"
 	"os"
 	"os/exec"
+	"slices"
 	"strings"
 
 	"buf.build/go/interrupt"
@@ -111,9 +112,7 @@ func pushImage(ctx context.Context, name string) error {
 }
 
 func dockerCmd(ctx context.Context, command string, args ...string) *exec.Cmd {
-	commandArgs := make([]string, 0, len(args)+1)
-	commandArgs = append(commandArgs, command)
-	commandArgs = append(commandArgs, args...)
+	commandArgs := slices.Concat([]string{command}, args)
 	cmd := exec.CommandContext(ctx, "docker", commandArgs...)
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
diff --git a/internal/plugin/plugin.go b/internal/plugin/plugin.go
index 3fced5611..7b56b6cc3 100644
--- a/internal/plugin/plugin.go
+++ b/internal/plugin/plugin.go
@@ -117,8 +117,7 @@ func Walk(dir string, f func(plugin *Plugin) error) error {
 // sortByDependencyOrder sorts the passed in plugins such that each dependency comes before a plugin with dependencies.
 func sortByDependencyOrder(original []*Plugin) ([]*Plugin, error) {
 	// Make a defensive copy of the original list
-	plugins := make([]*Plugin, len(original))
-	copy(plugins, original)
+	plugins := slices.Clone(original)
 	resolved := make([]*Plugin, 0, len(plugins))
 	resolvedMap := make(map[string]struct{}, len(plugins))
 	for len(plugins) > 0 {
diff --git a/internal/release/release.go b/internal/release/release.go
index eea37da54..6c2d28b43 100644
--- a/internal/release/release.go
+++ b/internal/release/release.go
@@ -7,6 +7,7 @@ import (
 	"io"
 	"log"
 	"os"
+	"slices"
 	"strings"
 	"time"
 )
@@ -68,8 +69,7 @@ func CalculateDigest(path string) (string, error) {
 // The original slice is unmodified - it returns a copy in sorted order, or an error if there is a cycle or unmet dependency.
 func SortReleasesInDependencyOrder(original []PluginRelease) ([]PluginRelease, error) {
 	// Make a defensive copy of the original list
-	plugins := make([]PluginRelease, len(original))
-	copy(plugins, original)
+	plugins := slices.Clone(original)
 	resolved := make([]PluginRelease, 0, len(plugins))
 	resolvedMap := make(map[string]struct{}, len(plugins))
 	for len(plugins) > 0 {
diff --git a/tests/plugins_test.go b/tests/plugins_test.go
index a8973cb59..f0dd876bf 100644
--- a/tests/plugins_test.go
+++ b/tests/plugins_test.go
@@ -511,10 +511,7 @@ func createProtocGenPlugin(t *testing.T, basedir string, plugin *plugin.Plugin)
 	if len(fields) != 3 {
 		return fmt.Errorf("invalid plugin name: %v", plugin.Name)
 	}
-	dockerOrg := os.Getenv("DOCKER_ORG")
-	if len(dockerOrg) == 0 {
-		dockerOrg = "bufbuild"
-	}
+	dockerOrg := cmp.Or(os.Getenv("DOCKER_ORG"), "bufbuild")
 	return protocGenPluginTemplate.Execute(protocGenPlugin, map[string]any{
 		"ImageName": fmt.Sprintf("%s/plugins-%s-%s", dockerOrg, fields[1], fields[2]),
 		"Version":   plugin.PluginVersion,