diff --git a/.golangci.yaml b/.golangci.yaml
index 442b1cc..9dbe8b8 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -89,6 +89,9 @@ linters-settings:
   goimports:
     # Put local imports after 3rd-party packages.
     local-prefixes: github.com/sapcc/go-pmtud
+    gomoddirectives:
+      toolchain-forbidden: true
+      go-version-pattern: '1\.\d+(\.0)?$'
   gosec:
     excludes:
       # gosec wants us to set a short ReadHeaderTimeout to avoid Slowloris attacks, but doing so would expose us to Keep-Alive race conditions (see https://iximiuz.com/en/posts/reverse-proxy-http-keep-alive-and-502s/)
@@ -116,6 +119,9 @@ linters-settings:
     time-month: true
     time-weekday: true
     tls-signature-scheme: true
+    usetesting:
+      os-setenv: true
+      os-temp-dir: true
   whitespace:
     # Enforce newlines (or comments) after multi-line function signatures.
     multi-func: true
@@ -134,6 +140,7 @@ linters:
     - errcheck
     - errname
     - errorlint
+    - exptostd
     - forbidigo
     - ginkgolinter
     - gocheckcompilerdirectives
@@ -141,6 +148,7 @@ linters:
     - gocritic
     - gofmt
     - goimports
+    - gomoddirectives
     - gosec
     - gosimple
     - govet
@@ -163,4 +171,5 @@ linters:
     - unparam
     - unused
     - usestdlibvars
+    - usetesting
     - whitespace