diff --git a/.golangci.yml b/.golangci.yml
index 8a06cb9aa8..0b0cf18466 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,8 +1,14 @@
----
+version: "2"
 run:
-  concurrency: 6
-  timeout: 5m
   modules-download-mode: readonly
+
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  exclusions:
+    generated: strict
+
 linters:
   enable:
     - asasalint
@@ -13,7 +19,6 @@ linters:
     - decorder
     - dogsled
     - durationcheck
-    - errcheck
     - errchkjson
     - exptostd
     - fatcontext
@@ -21,15 +26,10 @@ linters:
     - gocheckcompilerdirectives
     - gochecksumtype
     - gocritic
-    - gofmt
-    - goimports
     - goprintffuncname
-    - gosimple
-    - govet
     - grouper
     - iface
     - inamedparam
-    - ineffassign
     - interfacebloat
     - makezero
     - mirror
@@ -49,32 +49,34 @@ linters:
     - testableexamples
     - unconvert
     - unparam
-    - unused
     - usestdlibvars
     - usetesting
     - wastedassign
     - whitespace
-linters-settings:
-  errcheck:
-    check-blank: false
-  nolintlint:
-    require-specific: true
-  revive:
+  settings:
+    staticcheck:
+      checks:
+        - all
+        - -ST1003 # https://staticcheck.dev/docs/checks/#ST1003 Poorly chosen identifier.
+        - -QF1008 # https://staticcheck.dev/docs/checks/#QF1008 Omit embedded fields from selector expression.
+    nolintlint:
+      require-specific: true
+    revive:
+      rules:
+        - name: unused-parameter
+          disabled: true
+  exclusions:
+    generated: strict
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
     rules:
-    - name: unused-parameter
-      disabled: true
+      - linters:
+          - recvcheck
+        path: pkg/k8s.io/
 
 issues:
-  # Maximum issues count per one linter.
-  # Set to 0 to disable.
-  # Default: 50
   max-issues-per-linter: 0
-  # Maximum count of issues with the same text.
-  # Set to 0 to disable.
-  # Default: 3
   max-same-issues: 0
-  exclude-rules:
-    # Exclude recvcheck from running on the imported k8s files, to much failures
-    - path: pkg/k8s.io/
-      linters:
-        - recvcheck
diff --git a/Makefile b/Makefile
index d431bf7adf..3a172a28fd 100644
--- a/Makefile
+++ b/Makefile
@@ -61,7 +61,7 @@ BUILDTAGS += ${EXTRA_BUILDTAGS}
 # N/B: This value is managed by Renovate, manual changes are
 # possible, as long as they don't disturb the formatting
 # (i.e. DO NOT ADD A 'v' prefix!)
-GOLANGCI_LINT_VERSION := 1.64.4
+GOLANGCI_LINT_VERSION := 2.0.2
 PYTHON ?= $(shell command -v python3 python|head -n1)
 PKG_MANAGER ?= $(shell command -v dnf yum|head -n1)
 # ~/.local/bin is not in PATH on all systems
@@ -282,7 +282,7 @@ endif
 
 .PHONY: golangci-lint
 golangci-lint: .install.golangci-lint
-	hack/golangci-lint.sh run
+	hack/golangci-lint.sh
 
 .PHONY: test/checkseccomp/checkseccomp
 test/checkseccomp/checkseccomp: $(wildcard test/checkseccomp/*.go)
diff --git a/hack/golangci-lint.sh b/hack/golangci-lint.sh
index 17d1e00758..a7b11e5115 100755
--- a/hack/golangci-lint.sh
+++ b/hack/golangci-lint.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Need to run linter twice to cover all the build tags code paths
+# Run golangci-lint with different sets of build tags.
 set -e
 
 # WARNING: This script executes on multiple operating systems that
@@ -8,38 +8,23 @@ set -e
 # a very old version, where modern features (like `declare -A`) are
 # absent.
 
-# Makefile calls script with the 'run' argument, but developers may not.
-# Handle both cases transparently.
-[[ $1 == run ]] && shift
-
-BUILD_TAGS_DEFAULT="apparmor,seccomp,selinux"
-BUILD_TAGS_ABI="$BUILD_TAGS_DEFAULT,systemd"
-BUILD_TAGS_TUNNEL="$BUILD_TAGS_DEFAULT,remote"
-BUILD_TAGS_REMOTE="remote,containers_image_openpgp"
-
-SKIP_DIRS_ABI=""
-SKIP_DIRS_TUNNEL=""
-SKIP_DIRS_REMOTE="libpod/events,pkg/machine/qemu,pkg/machine/wsl,test"
-
-declare -a to_lint
-to_lint=(ABI TUNNEL)
-
-# Special-case, for Darwin and Windows only "remote" linting is possible and required.
-if [[ "$GOOS" == "windows" ]] || [[ "$GOOS" == "darwin" ]]; then
-  to_lint=(REMOTE)
+echo "Linting for GOOS=$GOOS"
+# Special case: for Darwin and Windows only "remote" linting is possible and required.
+if [[ "$GOOS" == "windows" || "$GOOS" == "darwin" ]]; then
+  (
+    set -x
+    ./bin/golangci-lint run --build-tags="remote,containers_image_openpgp" "$@"
+  )
+  exit 0
 fi
 
-for to_lint in "${to_lint[@]}"; do
-  tags_var="BUILD_TAGS_${to_lint}"
-  skip_var="SKIP_DIRS_${to_lint}"
-  echo ""
-  echo Running golangci-lint for "$to_lint"
-  echo Build Tags          "$to_lint": ${!tags_var}
-  echo Skipped directories "$to_lint": ${!skip_var}
+# Normal case (Linux): run linter for various sets of build tags.
+TAGS="apparmor,seccomp,selinux"
+for EXTRA_TAGS in "" ",systemd" ",remote"; do
   (
     # Make it really easy for a developer to copy-paste the command-line
     # to focus or debug a single, specific linting category.
     set -x
-    ./bin/golangci-lint run --timeout=10m --build-tags="${!tags_var}" --exclude-dirs="${!skip_var}" "$@"
+    ./bin/golangci-lint run --build-tags="${TAGS}${EXTRA_TAGS}" "$@"
   )
 done