diff --git a/.github/workflows/go-ci.yml b/.github/workflows/go-ci.yml
index 17e8ae6926..5f7d9e63c8 100644
--- a/.github/workflows/go-ci.yml
+++ b/.github/workflows/go-ci.yml
@@ -3,10 +3,6 @@ name: Go CI
 on:
   workflow_dispatch:
   push:
-env:
-  GOPRIVATE: "github.com/sourcegraph/*"
-  PRIVATE_TOKEN: "${{ secrets.PRIVATE_SG_ACCESS_TOKEN }}"
-
 jobs:
   go-test:
     strategy:
@@ -21,15 +17,9 @@ jobs:
         run: echo "go-version=$(grep 'golang' mise.toml | cut -d'"' -f2)" >> $GITHUB_OUTPUT
         shell: bash
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: sourcegraph/actions/go-setup@main
         with:
           go-version: ${{ steps.mise.outputs.go-version }}
-      - name: (Windows) Enable pulling Go modules from private sourcegraph/sourcegraph
-        if: runner.os == 'Windows'
-        run: git config --global url."https://$env:PRIVATE_TOKEN@github.com/sourcegraph/".insteadOf "https://github.com/sourcegraph/"
-      - name: (Default) Enable pulling Go modules from private sourcegraph/sourcegraph
-        if: runner.os != 'Windows'
-        run: git config --global url."https://${PRIVATE_TOKEN}@github.com/sourcegraph/".insteadOf "https://github.com/sourcegraph/"
       - run: |
           go test -race -v ./...
           go test -v ./...
diff --git a/.github/workflows/go-lint.yml b/.github/workflows/go-lint.yml
index d4a8ee3847..2a851b2a1b 100644
--- a/.github/workflows/go-lint.yml
+++ b/.github/workflows/go-lint.yml
@@ -3,9 +3,6 @@ name: Go Lint
 on:
   workflow_dispatch:
   push:
-env:
-  GOPRIVATE: "github.com/sourcegraph/*"
-  PRIVATE_TOKEN: "${{ secrets.PRIVATE_SG_ACCESS_TOKEN }}"
 
 jobs:
   go-lint:
@@ -17,9 +14,7 @@ jobs:
         id: mise
         run: echo "go-version=$(grep 'golang' mise.toml | cut -d'"' -f2)" >> $GITHUB_OUTPUT
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: sourcegraph/actions/go-setup@main
         with:
           go-version: ${{ steps.mise.outputs.go-version }}
-      - name: Enable pulling Go modules from private sourcegraph/sourcegraph
-        run: git config --global url."https://${PRIVATE_TOKEN}@github.com/sourcegraph/".insteadOf "https://github.com/sourcegraph/"
       - run: ./dev/go-lint.sh
diff --git a/.github/workflows/goreleaser-check.yml b/.github/workflows/goreleaser-check.yml
index 547e6a554c..780a6ba76b 100644
--- a/.github/workflows/goreleaser-check.yml
+++ b/.github/workflows/goreleaser-check.yml
@@ -3,10 +3,6 @@ name: GoReleaser check
 on:
   push:
   workflow_dispatch:
-env:
-  GOPRIVATE: "github.com/sourcegraph/*"
-  PRIVATE_TOKEN: "${{ secrets.PRIVATE_SG_ACCESS_TOKEN }}"
-
 jobs:
   goreleaser:
     name: check
@@ -20,11 +16,9 @@ jobs:
         id: mise
         run: echo "go-version=$(grep 'golang' mise.toml | cut -d'"' -f2)" >> $GITHUB_OUTPUT
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: sourcegraph/actions/go-setup@main
         with:
           go-version: ${{ steps.mise.outputs.go-version }}
-      - name: Enable pulling Go modules from private sourcegraph/sourcegraph
-        run: git config --global url."https://${PRIVATE_TOKEN}@github.com/sourcegraph/".insteadOf "https://github.com/sourcegraph/"
       - name: Check GoReleaser config
         uses: goreleaser/goreleaser-action@v5
         with:
diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml
index 8f305d36a7..e7231900b5 100644
--- a/.github/workflows/goreleaser.yml
+++ b/.github/workflows/goreleaser.yml
@@ -5,10 +5,6 @@ on:
   push:
     tags:
       - '*'
-env:
-  GOPRIVATE: "github.com/sourcegraph/*"
-  PRIVATE_TOKEN: "${{ secrets.PRIVATE_SG_ACCESS_TOKEN }}"
-
 # There are two cases where this GitHub action will run:
 #
 # 1. We are releasing a new latest version for src-cli, as a major, minor, or patch
@@ -182,11 +178,9 @@ jobs:
         id: mise
         run: echo "go-version=$(grep 'golang' mise.toml | cut -d'"' -f2)" >> $GITHUB_OUTPUT
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: sourcegraph/actions/go-setup@main
         with:
           go-version: ${{ steps.mise.outputs.go-version }}
-      - name: Enable pulling Go modules from private sourcegraph/sourcegraph
-        run: git config --global url."https://${PRIVATE_TOKEN}@github.com/sourcegraph/".insteadOf "https://github.com/sourcegraph/"
       - run: go test ./...
       - run: go test -race -v ./...
       - run: echo "${DOCKER_PASSWORD}" | docker login -u=$DOCKER_USERNAME --password-stdin
diff --git a/.github/workflows/scip.yml b/.github/workflows/scip.yml
index b546ea8bfa..91d467626a 100644
--- a/.github/workflows/scip.yml
+++ b/.github/workflows/scip.yml
@@ -2,9 +2,6 @@ name: SCIP
 on:
   workflow_dispatch:
   push:
-env:
-  GOPRIVATE: "github.com/sourcegraph/*"
-  PRIVATE_TOKEN: "${{ secrets.PRIVATE_SG_ACCESS_TOKEN }}"
 jobs:
   scip-go:
     runs-on: ubuntu-latest
@@ -15,7 +12,7 @@ jobs:
         id: mise
         run: echo "go-version=$(grep 'golang' mise.toml | cut -d'"' -f2)" >> $GITHUB_OUTPUT
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: sourcegraph/actions/go-setup@main
         with:
           go-version: ${{ steps.mise.outputs.go-version }}
 
@@ -25,9 +22,6 @@ jobs:
       - name: Build src-cli
         run: go build -o ./src-cli ./cmd/src
 
-      - name: Enable pulling Go modules from private sourcegraph/sourcegraph
-        run: git config --global url."https://${PRIVATE_TOKEN}@github.com/sourcegraph/".insteadOf "https://github.com/sourcegraph/"
-
       - name: Generate SCIP data
         run: scip-go
 
diff --git a/dev/golangci-lint.sh b/dev/golangci-lint.sh
index dffeb31b2f..e7adad08b2 100755
--- a/dev/golangci-lint.sh
+++ b/dev/golangci-lint.sh
@@ -6,7 +6,7 @@ pushd "$(dirname "${BASH_SOURCE[0]}")/.." >/dev/null
 
 mkdir -p dev/.bin
 
-version="2.6.1"
+version="2.10.1"
 suffix="${version}-$(go env GOOS)-$(go env GOARCH)"
 target="$PWD/dev/.bin/golangci-lint-${suffix}"
 url="https://github.com/golangci/golangci-lint/releases/download/v${version}/golangci-lint-${suffix}.tar.gz"
diff --git a/internal/batches/executor/run_steps.go b/internal/batches/executor/run_steps.go
index 92d1966dd7..97e952be71 100644
--- a/internal/batches/executor/run_steps.go
+++ b/internal/batches/executor/run_steps.go
@@ -660,7 +660,7 @@ func (e stepFailedErr) Error() string {
 		return lines[0] + fmt.Sprintf("\n\t(... and %d more lines)", len(lines)-1)
 	}
 
-	out.WriteString(fmt.Sprintf("run: %s\ncontainer: %s\n", fmtRun(e.Run), e.Container))
+	fmt.Fprintf(&out, "run: %s\ncontainer: %s\n", fmtRun(e.Run), e.Container)
 
 	printOutput := func(output string) {
 		for line := range strings.SplitSeq(output, "\n") {
@@ -682,9 +682,9 @@ func (e stepFailedErr) Error() string {
 	}
 
 	if e.ExitCode != -1 {
-		out.WriteString(fmt.Sprintf("\nCommand failed with exit code %d.", e.ExitCode))
+		fmt.Fprintf(&out, "\nCommand failed with exit code %d.", e.ExitCode)
 	} else {
-		out.WriteString(fmt.Sprintf("\nCommand failed: %s", e.Err))
+		fmt.Fprintf(&out, "\nCommand failed: %s", e.Err)
 	}
 
 	return out.String()
diff --git a/mise.toml b/mise.toml
index a1f15d3c03..74bb884ee3 100644
--- a/mise.toml
+++ b/mise.toml
@@ -1,4 +1,4 @@
 [tools]
-golang = "1.25.4"
+golang = "1.26.0"
 shfmt = "3.8.0"
 shellcheck = "0.10.0"