diff --git a/.github/workflows/ci-outpost.yml b/.github/workflows/ci-outpost.yml
index c7e3967d0b15..2afa670d94e8 100644
--- a/.github/workflows/ci-outpost.yml
+++ b/.github/workflows/ci-outpost.yml
@@ -38,11 +38,6 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v8
         with:
-          # latest (v2.13.0) bundles honnef.co/go/tools v0.8.0-rc.1, whose nilness
-          # analyzer panics on getsentry/sentry-go ("unhandled builtin recover",
-          # https://github.com/dominikh/go-tools/issues/1725). Unpin once a
-          # release with the fix ships.
-          version: v2.12.2
           args: --timeout 5000s --verbose
           skip-cache: true
   test-unittest:
diff --git a/go.mod b/go.mod
index 17c9d8130c59..c72598370b9d 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module goauthentik.io
 
-go 1.26.0
+go 1.27.0
 
 require (
 	beryju.io/ldap v0.2.1
diff --git a/internal/outpost/proxyv2/application/mode_proxy.go b/internal/outpost/proxyv2/application/mode_proxy.go
index 79126d0017a7..24e1ec7c1ed4 100644
--- a/internal/outpost/proxyv2/application/mode_proxy.go
+++ b/internal/outpost/proxyv2/application/mode_proxy.go
@@ -29,6 +29,8 @@ func (a *Application) configureProxy() error {
 	}
 	rsp := sentry.StartSpan(context.TODO(), "authentik.outposts.proxy.application_transport")
 	rp := &httputil.ReverseProxy{
+		// This code is deprecated/replaced on main anyways, so this is fine
+		//nolint:staticcheck
 		Director:       a.proxyModifyRequest(u),
 		Transport:      web.NewTracingTransport(rsp.Context(), a.getUpstreamTransport()),
 		ErrorHandler:   a.newProxyErrorHandler(),
diff --git a/internal/utils/tls.go b/internal/utils/tls.go
index fc55dccd7de4..29af98d0e960 100644
--- a/internal/utils/tls.go
+++ b/internal/utils/tls.go
@@ -7,7 +7,7 @@ import (
 
 func GetTLSConfig() *tls.Config {
 	// Based on
-	// https://ssl-config.mozilla.org/#server=go&version=1.25&config=intermediate&guideline=5.7
+	// https://configurator.tlsref.org/#server=go&version=1.27&config=intermediate&hsts&guideline=6.0
 	tlsConfig := &tls.Config{
 		MinVersion: tls.VersionTLS12,
 		CurvePreferences: []tls.CurveID{
@@ -15,8 +15,7 @@ func GetTLSConfig() *tls.Config {
 			tls.CurveP256,
 			tls.CurveP384,
 		},
-		PreferServerCipherSuites: true,
-		CipherSuites:             []uint16{},
+		CipherSuites: []uint16{},
 	}
 
 	excludedCiphers := []uint16{
diff --git a/internal/web/proxy.go b/internal/web/proxy.go
index fb6add10e645..625a26100a63 100644
--- a/internal/web/proxy.go
+++ b/internal/web/proxy.go
@@ -76,6 +76,8 @@ func (ws *WebServer) configureProxy() {
 		ws.log.WithField("url", req.URL.String()).WithField("headers", req.Header).Trace("tracing request to backend")
 	}
 	rp := &httputil.ReverseProxy{
+		// This code is deprecated/replaced on main anyways, so this is fine
+		//nolint:staticcheck
 		Director:  director,
 		Transport: ws.upstreamHttpClient().Transport,
 	}
diff --git a/locale/en/dictionaries/golang.txt b/locale/en/dictionaries/golang.txt
index 3c8b8b2efd3e..bb6c162cec7d 100644
--- a/locale/en/dictionaries/golang.txt
+++ b/locale/en/dictionaries/golang.txt
@@ -18,3 +18,4 @@ gorm
 gorm
 gorm*
 logger
+nolint