diff --git a/hack/lib/lint-version.txt b/hack/lib/lint-version.txt
index 197c4d5c2..860487ca1 100644
--- a/hack/lib/lint-version.txt
+++ b/hack/lib/lint-version.txt
@@ -1 +1 @@
-2.4.0
+2.7.1
diff --git a/internal/controller/supervisorconfig/oidcclientwatcher/oidc_client_watcher.go b/internal/controller/supervisorconfig/oidcclientwatcher/oidc_client_watcher.go
index c57a1c6e5..8662ec965 100644
--- a/internal/controller/supervisorconfig/oidcclientwatcher/oidc_client_watcher.go
+++ b/internal/controller/supervisorconfig/oidcclientwatcher/oidc_client_watcher.go
@@ -1,4 +1,4 @@
-// Copyright 2022-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2022-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package oidcclientwatcher
@@ -146,7 +146,6 @@ func (c *oidcClientWatcherController) updateStatus(
 		updated.Status.Phase = supervisorconfigv1alpha1.OIDCClientPhaseError
 	}
 
-	//nolint:gosec // looks like we are willing to accept the risk that there are less than 2147483647 dynamic clients
 	updated.Status.TotalClientSecrets = int32(totalClientSecrets)
 
 	if equality.Semantic.DeepEqual(upstream, updated) {
diff --git a/internal/endpointaddr/endpointaddr.go b/internal/endpointaddr/endpointaddr.go
index b22dd849a..08b68c6da 100644
--- a/internal/endpointaddr/endpointaddr.go
+++ b/internal/endpointaddr/endpointaddr.go
@@ -73,7 +73,7 @@ func Parse(endpoint string, defaultPort uint16) (HostPort, error) {
 
 	return HostPort{
 		Host: host,
-		Port: uint16(integerPort), //nolint:gosec // this cast is checked by validation.IsValidPortNum above
+		Port: uint16(integerPort), // this cast is checked by validation.IsValidPortNum above
 	}, nil
 }
 
diff --git a/internal/plog/config.go b/internal/plog/config.go
index ae3686da5..95de96180 100644
--- a/internal/plog/config.go
+++ b/internal/plog/config.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package plog
@@ -57,7 +57,7 @@ func ValidateAndSetLogLevelAndFormatGlobally(ctx context.Context, spec LogSpec)
 	if _, err := logs.GlogSetter(strconv.Itoa(int(klogLevel))); err != nil {
 		panic(err) // programmer error
 	}
-	//nolint:gosec // the range for klogLevel is [0,108]
+	// the range for klogLevel is [0,108]
 	globalLevel.SetLevel(zapcore.Level(-klogLevel)) // klog levels are inverted when zap handles them
 
 	var encoding string
diff --git a/internal/plog/level.go b/internal/plog/level.go
index 56eb8483f..55c4641a5 100644
--- a/internal/plog/level.go
+++ b/internal/plog/level.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package plog
@@ -44,8 +44,7 @@ const (
 func Enabled(level LogLevel) bool {
 	l := klogLevelForPlogLevel(level)
 	// check that both our global level and the klog global level agree that the plog level is enabled
-	// klog levels are inverted when zap handles them
-	//nolint:gosec // the range for klogLevel is [0,108]
+	// klog levels are inverted when zap handles them. The range for klogLevel is [0,108].
 	return globalLevel.Enabled(zapcore.Level(-l)) && klog.V(l).Enabled()
 }
 
diff --git a/internal/testutil/totp/totp.go b/internal/testutil/totp/totp.go
index 9180dad6f..bb01bd6ea 100644
--- a/internal/testutil/totp/totp.go
+++ b/internal/testutil/totp/totp.go
@@ -1,4 +1,4 @@
-// Copyright 2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2024-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package totp
@@ -80,7 +80,7 @@ func GenerateOTPCode(t *testing.T, token string, when time.Time) (string, int64)
 		((int(sum[offset+2] & mask3)) << shift8) |
 		(int(sum[offset+3]) & mask3))
 
-	modulo := int32(value % int64(math.Pow10(length))) //nolint:gosec // the resulting number must be less than 10^6
+	modulo := int32(value % int64(math.Pow10(length))) // the resulting number must be less than 10^6
 
 	format := fmt.Sprintf("%%0%dd", length)
 
diff --git a/test/integration/limited_ciphers_utils_test.go b/test/integration/limited_ciphers_utils_test.go
index 10b79ce8d..ec07bcf1e 100644
--- a/test/integration/limited_ciphers_utils_test.go
+++ b/test/integration/limited_ciphers_utils_test.go
@@ -1,4 +1,4 @@
-// Copyright 2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2024-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package integration
@@ -115,7 +115,7 @@ func expectTLSConfigForServicePort(
 ) {
 	portAsInt, err := strconv.Atoi(localPortAsStr)
 	require.NoError(t, err)
-	portAsUint := uint16(portAsInt) //nolint:gosec // okay to cast because it will only be legal port numbers
+	portAsUint := uint16(portAsInt) // okay to cast because it will only be legal port numbers
 
 	startKubectlPortForward(ctx, t, localPortAsStr, "443", serviceName, serviceNamespace)