diff --git a/.github/jsonnetfile.json b/.github/jsonnetfile.json
index e5c6335a2c9ec..e276e88059b27 100644
--- a/.github/jsonnetfile.json
+++ b/.github/jsonnetfile.json
@@ -8,7 +8,7 @@
           "subdir": "workflows"
         }
       },
-      "version": "1dd22f1dbfa671ac40e4a92f1a56bd9821871d44"
+      "version": "6c4953b6960ddbed8db8c9b05dd34fc04777615d"
     }
   ],
   "legacyImports": true
diff --git a/.github/jsonnetfile.lock.json b/.github/jsonnetfile.lock.json
index 1bb9b61b157a0..e2725da876be8 100644
--- a/.github/jsonnetfile.lock.json
+++ b/.github/jsonnetfile.lock.json
@@ -8,8 +8,8 @@
           "subdir": "workflows"
         }
       },
-      "version": "1dd22f1dbfa671ac40e4a92f1a56bd9821871d44",
-      "sum": "/Gk8/aqedF23h3wjwG05d8rJJiTMVWHqfceXDOboJBg="
+      "version": "6c4953b6960ddbed8db8c9b05dd34fc04777615d",
+      "sum": "cmCJspuBE+wmv0wm94z1sZPTPrs0pdkJ63IDEgTxKUE="
     }
   ],
   "legacyImports": false
diff --git a/.github/release-workflows.jsonnet b/.github/release-workflows.jsonnet
index 4f15de0cd3ad9..fd8f52194e79a 100644
--- a/.github/release-workflows.jsonnet
+++ b/.github/release-workflows.jsonnet
@@ -7,7 +7,7 @@ local checkTemplate = 'grafana/loki-release/.github/workflows/check.yml@%s' % re
 local buildImageVersion = std.extVar('BUILD_IMAGE_VERSION');
 local goVersion = std.extVar('GO_VERSION');
 local buildImage = 'grafana/loki-build-image:%s' % buildImageVersion;
-local golangCiLintVersion = 'v1.64.5';
+local golangCiLintVersion = 'v2.3.0';
 local imageBuildTimeoutMin = 60;
 local imagePrefix = 'grafana';
 local dockerPluginDir = 'clients/cmd/docker-driver';
diff --git a/.github/vendor/github.com/grafana/loki-release/workflows/main.jsonnet b/.github/vendor/github.com/grafana/loki-release/workflows/main.jsonnet
index 6b4e09fcb7bcd..d21321af91e6c 100644
--- a/.github/vendor/github.com/grafana/loki-release/workflows/main.jsonnet
+++ b/.github/vendor/github.com/grafana/loki-release/workflows/main.jsonnet
@@ -16,7 +16,7 @@
     distMakeTargets=['dist', 'packages'],
     dryRun=false,
     dockerUsername='grafana',
-    golangCiLintVersion='v1.64.5',
+    golangCiLintVersion='v2.3.0',
     imageBuildTimeoutMin=25,
     imageJobs={},
     imagePrefix='grafana',
@@ -178,7 +178,7 @@
             type: 'boolean',
           },
           golang_ci_lint_version: {
-            default: 'v1.64.5',
+            default: 'v2.3.0',
             description: 'version of golangci-lint to use',
             required: false,
             type: 'string',
@@ -228,7 +228,7 @@
             type: 'boolean',
           },
           golang_ci_lint_version: {
-            default: 'v1.64.5',
+            default: 'v2.3.0',
             description: 'version of golangci-lint to use',
             required: false,
             type: 'string',
diff --git a/.github/vendor/github.com/grafana/loki-release/workflows/validate-gel.libsonnet b/.github/vendor/github.com/grafana/loki-release/workflows/validate-gel.libsonnet
index ba59986bdde4d..27cd796bfbd52 100644
--- a/.github/vendor/github.com/grafana/loki-release/workflows/validate-gel.libsonnet
+++ b/.github/vendor/github.com/grafana/loki-release/workflows/validate-gel.libsonnet
@@ -53,7 +53,7 @@ local validationJob = _validationJob(false);
     validationJob
     + job.withSteps(
       [
-        step.new('golangci-lint', 'golangci/golangci-lint-action@08e2f20817b15149a52b5b3ebe7de50aff2ba8c5')
+        step.new('golangci-lint', 'golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9')
         + step.withIf('${{ !fromJSON(env.SKIP_VALIDATION) }}')
         + step.with({
           version: '${{ inputs.golang_ci_lint_version }}',
diff --git a/.github/vendor/github.com/grafana/loki-release/workflows/validate.libsonnet b/.github/vendor/github.com/grafana/loki-release/workflows/validate.libsonnet
index 5a17307b48201..0aae39f9eab4d 100644
--- a/.github/vendor/github.com/grafana/loki-release/workflows/validate.libsonnet
+++ b/.github/vendor/github.com/grafana/loki-release/workflows/validate.libsonnet
@@ -170,7 +170,7 @@ local validationJob = _validationJob(false);
     + job.withSteps(
       [
         common.checkout,
-        step.new('golangci-lint', 'golangci/golangci-lint-action@08e2f20817b15149a52b5b3ebe7de50aff2ba8c5')
+        step.new('golangci-lint', 'golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9')
         + step.withIf('${{ !fromJSON(env.SKIP_VALIDATION) }}')
         + step.with({
           version: '${{ inputs.golang_ci_lint_version }}',
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index a36ee83e84cde..0bfa4ee9d8c74 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -1,10 +1,10 @@
 "jobs":
   "check":
-    "uses": "grafana/loki-release/.github/workflows/check.yml@1dd22f1dbfa671ac40e4a92f1a56bd9821871d44"
+    "uses": "grafana/loki-release/.github/workflows/check.yml@6c4953b6960ddbed8db8c9b05dd34fc04777615d"
     "with":
       "build_image": "grafana/loki-build-image:0.34.6"
-      "golang_ci_lint_version": "v1.64.5"
-      "release_lib_ref": "1dd22f1dbfa671ac40e4a92f1a56bd9821871d44"
+      "golang_ci_lint_version": "v2.3.0"
+      "release_lib_ref": "6c4953b6960ddbed8db8c9b05dd34fc04777615d"
       "skip_validation": false
       "use_github_app_token": true
 "name": "check"
diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml
index 64ff1713bfb3c..8cc61aeebd92a 100644
--- a/.github/workflows/images.yml
+++ b/.github/workflows/images.yml
@@ -1,10 +1,10 @@
 "jobs":
   "check":
-    "uses": "grafana/loki-release/.github/workflows/check.yml@1dd22f1dbfa671ac40e4a92f1a56bd9821871d44"
+    "uses": "grafana/loki-release/.github/workflows/check.yml@6c4953b6960ddbed8db8c9b05dd34fc04777615d"
     "with":
       "build_image": "grafana/loki-build-image:0.34.6"
-      "golang_ci_lint_version": "v1.64.5"
-      "release_lib_ref": "1dd22f1dbfa671ac40e4a92f1a56bd9821871d44"
+      "golang_ci_lint_version": "v2.3.0"
+      "release_lib_ref": "6c4953b6960ddbed8db8c9b05dd34fc04777615d"
       "skip_validation": false
       "use_github_app_token": true
   "loki-canary-boringcrypto-image":
@@ -12,7 +12,7 @@
       "BUILD_TIMEOUT": 60
       "GO_VERSION": "1.24.6"
       "IMAGE_PREFIX": "grafana"
-      "RELEASE_LIB_REF": "1dd22f1dbfa671ac40e4a92f1a56bd9821871d44"
+      "RELEASE_LIB_REF": "6c4953b6960ddbed8db8c9b05dd34fc04777615d"
       "RELEASE_REPO": "grafana/loki"
     "needs":
     - "check"
@@ -135,7 +135,7 @@
       "BUILD_TIMEOUT": 60
       "GO_VERSION": "1.24.6"
       "IMAGE_PREFIX": "grafana"
-      "RELEASE_LIB_REF": "1dd22f1dbfa671ac40e4a92f1a56bd9821871d44"
+      "RELEASE_LIB_REF": "6c4953b6960ddbed8db8c9b05dd34fc04777615d"
       "RELEASE_REPO": "grafana/loki"
     "needs":
     - "check"
@@ -258,7 +258,7 @@
       "BUILD_TIMEOUT": 60
       "GO_VERSION": "1.24.6"
       "IMAGE_PREFIX": "grafana"
-      "RELEASE_LIB_REF": "1dd22f1dbfa671ac40e4a92f1a56bd9821871d44"
+      "RELEASE_LIB_REF": "6c4953b6960ddbed8db8c9b05dd34fc04777615d"
       "RELEASE_REPO": "grafana/loki"
     "needs":
     - "check"
@@ -381,7 +381,7 @@
       "BUILD_TIMEOUT": 60
       "GO_VERSION": "1.24.6"
       "IMAGE_PREFIX": "grafana"
-      "RELEASE_LIB_REF": "1dd22f1dbfa671ac40e4a92f1a56bd9821871d44"
+      "RELEASE_LIB_REF": "6c4953b6960ddbed8db8c9b05dd34fc04777615d"
       "RELEASE_REPO": "grafana/loki"
     "needs":
     - "check"
diff --git a/.github/workflows/minor-release-pr.yml b/.github/workflows/minor-release-pr.yml
index a3e92d660726a..90e301385b1f0 100644
--- a/.github/workflows/minor-release-pr.yml
+++ b/.github/workflows/minor-release-pr.yml
@@ -8,7 +8,7 @@ env:
   DRY_RUN: false
   GITHUB_APP: "loki-gh-app"
   IMAGE_PREFIX: "grafana"
-  RELEASE_LIB_REF: "1dd22f1dbfa671ac40e4a92f1a56bd9821871d44"
+  RELEASE_LIB_REF: "6c4953b6960ddbed8db8c9b05dd34fc04777615d"
   RELEASE_REPO: "grafana/loki"
   SKIP_VALIDATION: false
   USE_GITHUB_APP_TOKEN: true
@@ -19,11 +19,11 @@ jobs:
       contents: "write"
       id-token: "write"
       pull-requests: "write"
-    uses: "grafana/loki-release/.github/workflows/check.yml@1dd22f1dbfa671ac40e4a92f1a56bd9821871d44"
+    uses: "grafana/loki-release/.github/workflows/check.yml@6c4953b6960ddbed8db8c9b05dd34fc04777615d"
     with:
       build_image: "grafana/loki-build-image:0.34.6"
-      golang_ci_lint_version: "v1.64.5"
-      release_lib_ref: "1dd22f1dbfa671ac40e4a92f1a56bd9821871d44"
+      golang_ci_lint_version: "v2.3.0"
+      release_lib_ref: "6c4953b6960ddbed8db8c9b05dd34fc04777615d"
       skip_validation: false
       use_github_app_token: true
   create-release-pr:
diff --git a/.github/workflows/operator.yaml b/.github/workflows/operator.yaml
index 1cca514fba33e..9d1bb73257bba 100644
--- a/.github/workflows/operator.yaml
+++ b/.github/workflows/operator.yaml
@@ -47,9 +47,9 @@ jobs:
       with:
         go-version-file: ./operator/go.mod
     - name: Lint
-      uses: golangci/golangci-lint-action@1481404843c368bc19ca9406f87d6e0fc97bdcfd # v7
+      uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8
       with:
-        version: v2.0.2
+        version: v2.3.0
         args: --timeout=5m
         working-directory: ./operator
     - name: Check prometheus rules
diff --git a/.github/workflows/patch-release-pr.yml b/.github/workflows/patch-release-pr.yml
index dd353b48f9d4b..410fc05579bee 100644
--- a/.github/workflows/patch-release-pr.yml
+++ b/.github/workflows/patch-release-pr.yml
@@ -8,7 +8,7 @@ env:
   DRY_RUN: false
   GITHUB_APP: "loki-gh-app"
   IMAGE_PREFIX: "grafana"
-  RELEASE_LIB_REF: "1dd22f1dbfa671ac40e4a92f1a56bd9821871d44"
+  RELEASE_LIB_REF: "6c4953b6960ddbed8db8c9b05dd34fc04777615d"
   RELEASE_REPO: "grafana/loki"
   SKIP_VALIDATION: false
   USE_GITHUB_APP_TOKEN: true
@@ -19,11 +19,11 @@ jobs:
       contents: "write"
       id-token: "write"
       pull-requests: "write"
-    uses: "grafana/loki-release/.github/workflows/check.yml@1dd22f1dbfa671ac40e4a92f1a56bd9821871d44"
+    uses: "grafana/loki-release/.github/workflows/check.yml@6c4953b6960ddbed8db8c9b05dd34fc04777615d"
     with:
       build_image: "grafana/loki-build-image:0.34.6"
-      golang_ci_lint_version: "v1.64.5"
-      release_lib_ref: "1dd22f1dbfa671ac40e4a92f1a56bd9821871d44"
+      golang_ci_lint_version: "v2.3.0"
+      release_lib_ref: "6c4953b6960ddbed8db8c9b05dd34fc04777615d"
       skip_validation: false
       use_github_app_token: true
   create-release-pr:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 86a4d60fe2fa5..c04b9683d4224 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,7 +5,7 @@ env:
   GITHUB_APP: "loki-gh-app"
   IMAGE_PREFIX: "grafana"
   PUBLISH_TO_GCS: false
-  RELEASE_LIB_REF: "1dd22f1dbfa671ac40e4a92f1a56bd9821871d44"
+  RELEASE_LIB_REF: "6c4953b6960ddbed8db8c9b05dd34fc04777615d"
   RELEASE_REPO: "grafana/loki"
   USE_GITHUB_APP_TOKEN: true
 jobs:
diff --git a/.golangci.yml b/.golangci.yml
index 9da4ae0dc3d82..4e26ac2f078f6 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,104 +1,100 @@
 # This file contains all available configuration options
 # with their default values.
-
+version: "2"
 # options for analysis running
 run:
-  # define go version
-  go: "1.24"
-
   # default concurrency is a available CPU number
   concurrency: 16
-
-  # timeout for analysis, e.g. 30s, 5m, default is 1m
-  timeout: 10m
-
-  # exit code when at least one issue was found, default is 1
-  issues-exit-code: 1
-
-  # include test files or not, default is true
-  tests: true
-
+  # define go version
+  go: "1.24"
   # list of build tags, all linters use it. Default is empty list.
   build-tags:
     - cgo
     - integration
     - slicelabels
-
+  # exit code when at least one issue was found, default is 1
+  issues-exit-code: 1
+  # include test files or not, default is true
+  tests: true
 # output configuration options
 output:
   formats:
-    # colored-line-number|line-number|json|tab|checkstyle, default is "colored-line-number"
-    - format: colored-line-number
-
-  # print lines of code with issue, default is true
-  print-issued-lines: true
-
-  # print linter name in the end of issue text, default is true
-  print-linter-name: true
-
-linters-settings:
-  goimports:
-    local-prefixes: github.com/grafana/loki/pkg,github.com/grafana/loki/tools
-
-  depguard:
-    rules:
-      Main:
-        deny:
-          - desc: "Use github.com/go-kit/log instead of github.com/go-kit/kit/log"
-            pkg: github.com/go-kit/kit/log
-
-  misspell:
-    ignore-words:
-      - strat
-
+    text:
+      path: stdout
+      print-linter-name: true
+      print-issued-lines: true
+      colors: true
 linters:
   enable:
+    - copyloopvar
+    - depguard
     - errcheck
+    - gochecksumtype
     - goconst
-    - revive
+    - govet
     - ineffassign
     - misspell
-    - unconvert
-    - govet
-    - typecheck
-    - depguard
-    - copyloopvar
-    - gofmt
-    - goimports
-    - gosimple
+    - revive
     - staticcheck
-    - gochecksumtype
+    - unconvert
   disable:
-    - unused
     - unparam
-
+    - unused
+  settings:
+    depguard:
+      rules:
+        Main:
+          deny:
+            - pkg: github.com/go-kit/kit/log
+              desc: Use github.com/go-kit/log instead of github.com/go-kit/kit/log
+    misspell:
+      ignore-rules:
+        - strat
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      - path: pkg/scheduler/scheduler.go
+        text: 'SA1019: msg.GetHttpRequest is deprecated: Do not use'
+      - linters:
+          - goconst
+        path: (.+)_test\.go
+      - path: (.+)\.go$
+        text: Error return value of .*log\.Logger\)\.Log\x60 is not checked
+      - path: (.+)\.go$
+        text: Error return value of .*.Log.* is not checked
+      - path: (.+)\.go$
+        text: Error return value of `` is not checked
+      - path: (.+)\.go$
+        text: Error return value of `.*WriteString` is not checked
+    paths:
+      - .*.pb.go
+      - .*.y.go
+      - .*.rl.go
+      - .*.deepcopy.go
+      - win_eventlog$
+      - operator
 issues:
-  exclude:
-    - Error return value of .*log\.Logger\)\.Log\x60 is not checked
-    - Error return value of .*.Log.* is not checked
-    - Error return value of `` is not checked
-    - Error return value of `.*WriteString` is not checked
-  exclude-rules:
-    - path: pkg/scheduler/scheduler.go
-      text: 'SA1019: msg.GetHttpRequest is deprecated: Do not use'
-    - path: '(.+)_test\.go'
-      linters:
-        - goconst
   fix: true
-  # which dirs to skip: they won't be analyzed;
-  # can use regexp here: generated.*, regexp is applied on full path;
-  # default value is empty list, but next dirs are always skipped independently
-  # from this option's value:
-  #   	vendor$, third_party$, testdata$, examples$, Godeps$, builtin$
-  exclude-dirs:
-    - win_eventlog$
-    - operator
-  # which files to skip: they will be analyzed, but issues from them
-  # won't be reported. Default value is empty list, but there is
-  # no need to include all autogenerated files, we confidently recognize
-  # autogenerated files. If it's not please let us know.
-  exclude-files:
-    - .*.pb.go
-    - .*.y.go
-    - .*.rl.go
-    - .*.deepcopy.go
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  settings:
+    goimports:
+      local-prefixes:
+        - github.com/grafana/loki/pkg
+        - github.com/grafana/loki/tools
+  exclusions:
+    generated: lax
+    paths:
+      - .*.pb.go
+      - .*.y.go
+      - .*.rl.go
+      - .*.deepcopy.go
+      - win_eventlog$
+      - operator
diff --git a/operator/.bingo/Variables.mk b/operator/.bingo/Variables.mk
index e26c15deae09b..51e8a7fe19ab4 100644
--- a/operator/.bingo/Variables.mk
+++ b/operator/.bingo/Variables.mk
@@ -41,11 +41,11 @@ $(GOFUMPT): $(BINGO_DIR)/gofumpt.mod
 	@echo "(re)installing $(GOBIN)/gofumpt-v0.7.0"
 	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=gofumpt.mod -o=$(GOBIN)/gofumpt-v0.7.0 "mvdan.cc/gofumpt"
 
-GOLANGCI_LINT := $(GOBIN)/golangci-lint-v2.0.2
+GOLANGCI_LINT := $(GOBIN)/golangci-lint-v2.3.0
 $(GOLANGCI_LINT): $(BINGO_DIR)/golangci-lint.mod
 	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
-	@echo "(re)installing $(GOBIN)/golangci-lint-v2.0.2"
-	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=golangci-lint.mod -o=$(GOBIN)/golangci-lint-v2.0.2 "github.com/golangci/golangci-lint/v2/cmd/golangci-lint"
+	@echo "(re)installing $(GOBIN)/golangci-lint-v2.3.0"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=golangci-lint.mod -o=$(GOBIN)/golangci-lint-v2.3.0 "github.com/golangci/golangci-lint/v2/cmd/golangci-lint"
 
 HUGO := $(GOBIN)/hugo-v0.80.0
 $(HUGO): $(BINGO_DIR)/hugo.mod
diff --git a/operator/.bingo/golangci-lint.mod b/operator/.bingo/golangci-lint.mod
index c90aa1d27bc1d..9e4a828dd589f 100644
--- a/operator/.bingo/golangci-lint.mod
+++ b/operator/.bingo/golangci-lint.mod
@@ -2,4 +2,4 @@ module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
 
 go 1.23.6
 
-require github.com/golangci/golangci-lint/v2 v2.0.2 // cmd/golangci-lint
+require github.com/golangci/golangci-lint/v2 v2.3.0 // cmd/golangci-lint
diff --git a/operator/.bingo/variables.env b/operator/.bingo/variables.env
index fd52b7fa7d3f2..61194326e2bdd 100644
--- a/operator/.bingo/variables.env
+++ b/operator/.bingo/variables.env
@@ -16,7 +16,7 @@ GEN_CRD_API_REFERENCE_DOCS="${GOBIN}/gen-crd-api-reference-docs-v0.0.3"
 
 GOFUMPT="${GOBIN}/gofumpt-v0.7.0"
 
-GOLANGCI_LINT="${GOBIN}/golangci-lint-v2.0.2"
+GOLANGCI_LINT="${GOBIN}/golangci-lint-v2.3.0"
 
 HUGO="${GOBIN}/hugo-v0.80.0"