diff --git a/.circleci/config.yml b/.circleci/config.yml
deleted file mode 100644
index 27675f5..0000000
--- a/.circleci/config.yml
+++ /dev/null
@@ -1,11 +0,0 @@
-version: 2
-
-jobs:
-  build:
-    working_directory: /go/src/github.com/gudtech/dbr-go
-    docker:
-      - image: circleci/golang:1.10.3
-    steps:
-      - checkout
-      - run: dep ensure -vendor-only
-      - run: go test -v -race ./...
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a88ed6e..f7c3798 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -17,3 +17,15 @@ jobs:
         run: go vet ./...
       - name: Test
         run: go test ./...
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.26'
+      - name: Lint
+        uses: golangci/golangci-lint-action@v8
+        with:
+          version: v2.12.2
diff --git a/account.go b/account.go
index f46b7e3..c3d1e0d 100644
--- a/account.go
+++ b/account.go
@@ -118,7 +118,7 @@ func (a *Account) DB() (*sql.DB, error) {
 }
 
 func (a *Account) QueryPrep(query string) string {
-	return strings.Replace(strings.Replace(query, "{config}", a.config.dbname, -1), "{ops}", a.ops.dbname, -1)
+	return strings.ReplaceAll(strings.ReplaceAll(query, "{config}", a.config.dbname), "{ops}", a.ops.dbname)
 }
 
 func (a *Account) ExecContext(ctx context.Context, query string, args ...interface{}) (sql.Result, error) {
diff --git a/common.go b/common.go
index 4e70511..01741b2 100644
--- a/common.go
+++ b/common.go
@@ -5,7 +5,7 @@ import (
 	"database/sql"
 	"errors"
 	"fmt"
-	"io/ioutil"
+	"os"
 	"strconv"
 	"strings"
 	"sync"
@@ -13,7 +13,11 @@ import (
 	_ "github.com/go-sql-driver/mysql"
 )
 
-var RestrictedReadAccounts = fmt.Errorf("common database config does not allow reading accounts")
+// RestrictedReadAccounts is part of the public API; renaming to the ErrFoo
+// convention would be a breaking change for consumers, so ST1012 is suppressed.
+//
+//nolint:staticcheck // ST1012: exported identifier kept stable for API compatibility
+var RestrictedReadAccounts = errors.New("common database config does not allow reading accounts")
 
 type Common struct {
 	config     OpenConfig
@@ -51,7 +55,7 @@ func DefaultOpenConfig() OpenConfig {
 }
 
 func Open(ctx context.Context, config OpenConfig) (*Common, error) {
-	conftext, err := ioutil.ReadFile(config.ConfigPath)
+	conftext, err := os.ReadFile(config.ConfigPath)
 	if err != nil {
 		return nil, fmt.Errorf("cannot read %s: %s", config.ConfigPath, err)
 	}
@@ -70,7 +74,7 @@ func Open(ctx context.Context, config OpenConfig) (*Common, error) {
 	for _, line := range strings.Split(string(conftext), "\n") {
 		nocomment := strings.TrimSpace(strings.Split(line, "#")[0])
 		if strings.HasPrefix(nocomment, "---") {
-			return nil, errors.New("Multi-section DBR configs not supported")
+			return nil, errors.New("multi-section DBR configs not supported")
 		}
 
 		for _, part := range strings.Split(nocomment, ";") {
@@ -121,7 +125,7 @@ func Open(ctx context.Context, config OpenConfig) (*Common, error) {
 }
 
 func ReadGtutilConfig(filename string) (map[string]string, error) {
-	text, err := ioutil.ReadFile(filename)
+	text, err := os.ReadFile(filename)
 	if err != nil {
 		return nil, fmt.Errorf("cannot read %s: %s", filename, err)
 	}
@@ -187,7 +191,7 @@ func (p *Common) OpenInstance(i *DbrInstance) (*sql.DB, error) {
 	defer p.accountDBLock.Unlock()
 
 	if p.closing {
-		return nil, errors.New("Pool being closed")
+		return nil, errors.New("pool being closed")
 	}
 
 	if db := p.accountDB[dsn]; db != nil {