diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index f8b37df..bca9963 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -16,7 +16,8 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.25'
+          go-version-file: go.mod
+          cache: false
 
       - name: Verify go.mod is tidy
         run: |
@@ -30,12 +31,13 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
-          go-version: '1.24'
+          go-version-file: go.mod
+          cache: false
 
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v4
+        uses: golangci/golangci-lint-action@v9
         with:
           version: latest
 
@@ -46,9 +48,10 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
-          go-version: '1.24'
+          go-version-file: go.mod
+          cache: false
 
       - name: Install govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@latest
@@ -63,9 +66,10 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
-          go-version: '1.24'
+          go-version-file: go.mod
+          cache: false
 
       - name: Run tests
         run: go test -v -race -coverprofile=coverage.out ./...
@@ -83,9 +87,10 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
-          go-version: '1.24'
+          go-version-file: go.mod
+          cache: false
 
       - name: Run fuzz tests
         run: |
@@ -113,9 +118,10 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
-          go-version: '1.24'
+          go-version-file: go.mod
+          cache: false
 
       - name: Build
         env:
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 050c495..9f2b3b3 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -15,7 +15,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           cache: false
@@ -38,9 +38,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
-          go-version: stable
+          go-version-file: go.mod
           cache: false
 
       - uses: actions/download-artifact@v4
diff --git a/go.mod b/go.mod
index b29e6e8..88e97f0 100644
--- a/go.mod
+++ b/go.mod
@@ -1,8 +1,6 @@
 module github.com/espebra/pastebin
 
-go 1.24.0
-
-toolchain go1.24.11
+go 1.25.7
 
 require (
 	github.com/aws/aws-sdk-go-v2 v1.41.1
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index 94acf78..a9533be 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -1,14 +1,13 @@
 package config
 
 import (
-	"os"
 	"testing"
 	"time"
 )
 
 func TestLoad_RequiredS3Bucket(t *testing.T) {
 	// Clear any existing PASTEBIN_S3_BUCKET
-	os.Unsetenv("PASTEBIN_S3_BUCKET")
+	t.Setenv("PASTEBIN_S3_BUCKET", "")
 
 	_, err := Load()
 	if err == nil {
@@ -17,8 +16,7 @@ func TestLoad_RequiredS3Bucket(t *testing.T) {
 }
 
 func TestLoad_Defaults(t *testing.T) {
-	os.Setenv("PASTEBIN_S3_BUCKET", "test-bucket")
-	defer os.Unsetenv("PASTEBIN_S3_BUCKET")
+	t.Setenv("PASTEBIN_S3_BUCKET", "test-bucket")
 
 	cfg, err := Load()
 	if err != nil {
@@ -77,8 +75,7 @@ func TestLoad_CustomValues(t *testing.T) {
 	}
 
 	for k, v := range envVars {
-		os.Setenv(k, v)
-		defer os.Unsetenv(k)
+		t.Setenv(k, v)
 	}
 
 	cfg, err := Load()
diff --git a/internal/storage/s3.go b/internal/storage/s3.go
index 9789d45..00f80b0 100644
--- a/internal/storage/s3.go
+++ b/internal/storage/s3.go
@@ -140,7 +140,7 @@ func (s *S3Storage) Get(ctx context.Context, checksum string) (*paste.Paste, *pa
 	if err != nil {
 		return nil, nil, fmt.Errorf("failed to get paste: %w", err)
 	}
-	defer pasteResult.Body.Close()
+	defer func() { _ = pasteResult.Body.Close() }()
 
 	content, err := io.ReadAll(pasteResult.Body)
 	if err != nil {
@@ -162,7 +162,7 @@ func (s *S3Storage) Get(ctx context.Context, checksum string) (*paste.Paste, *pa
 	if err != nil {
 		return nil, nil, fmt.Errorf("failed to get metadata: %w", err)
 	}
-	defer metaResult.Body.Close()
+	defer func() { _ = metaResult.Body.Close() }()
 
 	var meta paste.Meta
 	if err := json.NewDecoder(metaResult.Body).Decode(&meta); err != nil {
@@ -244,7 +244,7 @@ func (s *S3Storage) fetchMeta(ctx context.Context, key *string) (*paste.Meta, er
 	if err != nil {
 		return nil, err
 	}
-	defer result.Body.Close()
+	defer func() { _ = result.Body.Close() }()
 
 	var meta paste.Meta
 	if err := json.NewDecoder(result.Body).Decode(&meta); err != nil {