diff --git a/Taskfile.yml b/Taskfile.yml
index fea1449..2590476 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -55,13 +55,28 @@ tasks:
 
   staticcheck:
     desc: Run staticcheck (pinned version)
+    # staticcheck v0.7.0 is a Go 1.25-era release. Run as `go run …@v0.7.0`, its
+    # own go.mod makes the toolchain resolve to 1.25.x, and a 1.25-built
+    # staticcheck can't analyze this module's go1.26 code ("package requires
+    # newer Go version go1.26"). Force a floor of go1.26 (auto-upgrading if a
+    # newer toolchain is the default) so staticcheck is built by go1.26+. Drop
+    # this once staticcheck v0.8.0 ships stable — it requires and builds on 1.26.
+    env:
+      GOTOOLCHAIN: go1.26.0+auto
     cmds:
       - go run honnef.co/go/tools/cmd/staticcheck@v0.7.0 ./...
 
   lint:
-    desc: Run golangci-lint
+    desc: Run golangci-lint (pinned version)
+    # A golangci-lint binary built with an older Go toolchain refuses to target
+    # this module's go1.26 code. Run the pinned version via `go run` with the
+    # same go1.26 floor as staticcheck, so it is built by go1.26+ regardless of
+    # any locally installed golangci-lint. The version matches CI's pinned
+    # golangci-lint-action version.
+    env:
+      GOTOOLCHAIN: go1.26.0+auto
     cmds:
-      - golangci-lint run ./...
+      - go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2 run ./...
 
   fmt:
     desc: Format all Go code