diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index c6675888ffb2..b3c273adb4f9 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -20,21 +20,10 @@ jobs:
         with:
           go-version: "1.24"
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v7
         with:
-          # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
-          version: latest
-          # Optional: working directory, useful for monorepos
-          # working-directory: somedir
-
-          # Optional: golangci-lint command line arguments.
-          args: --enable bodyclose --enable copyloopvar --enable misspell --timeout 10m
-
-          # Optional: if set to true then the action don't cache or restore ~/go/pkg.
-          # skip-pkg-cache: true
-
-          # Optional: if set to true then the action don't cache or restore ~/.cache/go-build.
-          # skip-build-cache: true
+          version: v2.11.4
+          args: --disable errcheck,staticcheck --enable bodyclose,copyloopvar,misspell --timeout 10m
   semgrep:
     name: semgrep
     runs-on: ubuntu-latest
diff --git a/Makefile b/Makefile
index b0c875900bb1..140e6fc1cb6d 100644
--- a/Makefile
+++ b/Makefile
@@ -22,7 +22,7 @@ check:
 	go vet $(shell go list ./... | grep -v /vendor/)
 
 lint:
-	golangci-lint run --enable bodyclose --enable copyloopvar --enable misspell --out-format=colored-line-number --timeout 10m
+	./scripts/lint.sh
 
 test-failing:
 	CGO_ENABLED=0 go test -timeout=5m $(shell go list ./... | grep -v /vendor/) | grep FAIL
diff --git a/scripts/lint.sh b/scripts/lint.sh
new file mode 100755
index 000000000000..f9487de7cb18
--- /dev/null
+++ b/scripts/lint.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+GOLANGCI_LINT_VERSION="v2.11.4"
+
+# TODO: Re-enable errcheck and staticcheck once pre-existing issues are resolved.
+LINT_ARGS="--disable errcheck,staticcheck --enable bodyclose,copyloopvar,misspell --timeout 10m"
+
+GOBIN="$(go env GOPATH)/bin"
+GOLANGCI_LINT="${GOBIN}/golangci-lint"
+
+# Install the required version if missing or mismatched.
+if [[ -x "${GOLANGCI_LINT}" ]] && "${GOLANGCI_LINT}" version 2>&1 | grep -q "${GOLANGCI_LINT_VERSION#v}"; then
+    echo "golangci-lint ${GOLANGCI_LINT_VERSION} found"
+else
+    echo "Installing golangci-lint ${GOLANGCI_LINT_VERSION}..."
+    curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s -- -b "${GOBIN}" "${GOLANGCI_LINT_VERSION}"
+fi
+
+# shellcheck disable=SC2086
+"${GOLANGCI_LINT}" run ${LINT_ARGS}