diff --git a/.github/workflows/cli.yml b/.github/workflows/cli.yml
index 61cd4505a3..aae99a842e 100644
--- a/.github/workflows/cli.yml
+++ b/.github/workflows/cli.yml
@@ -69,7 +69,7 @@ jobs:
         uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
         with:
           # renovate: datasource=github-releases depName=golangci/golangci-lint
-          version: v2.11.4
+          version: v2.12.1
           working-directory: cli
 
   # ── Test (multi-platform) ──
diff --git a/cli/go.mod b/cli/go.mod
index 43ac9c3ad5..158fc76a62 100644
--- a/cli/go.mod
+++ b/cli/go.mod
@@ -9,7 +9,7 @@ require (
 	charm.land/lipgloss/v2 v2.0.3
 	github.com/charmbracelet/x/ansi v0.11.7
 	github.com/google/go-containerregistry v0.21.5
-	github.com/mattn/go-isatty v0.0.21
+	github.com/mattn/go-isatty v0.0.22
 	github.com/mattn/go-runewidth v0.0.23
 	github.com/sigstore/protobuf-specs v0.5.1
 	github.com/sigstore/sigstore-go v1.1.4
diff --git a/cli/go.sum b/cli/go.sum
index c99e522b4e..8ea12a04fe 100644
--- a/cli/go.sum
+++ b/cli/go.sum
@@ -289,6 +289,8 @@ github.com/lucasb-eyer/go-colorful v1.4.0 h1:UtrWVfLdarDgc44HcS7pYloGHJUjHV/4FwW
 github.com/lucasb-eyer/go-colorful v1.4.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/mattn/go-isatty v0.0.21 h1:xYae+lCNBP7QuW4PUnNG61ffM4hVIfm+zUzDuSzYLGs=
 github.com/mattn/go-isatty v0.0.21/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
+github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4=
+github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
 github.com/mattn/go-runewidth v0.0.23 h1:7ykA0T0jkPpzSvMS5i9uoNn2Xy3R383f9HDx3RybWcw=
 github.com/mattn/go-runewidth v0.0.23/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
diff --git a/scripts/install_cli_tools.sh b/scripts/install_cli_tools.sh
index 76c2961233..9621ba32b5 100644
--- a/scripts/install_cli_tools.sh
+++ b/scripts/install_cli_tools.sh
@@ -52,7 +52,7 @@ if command -v golangci-lint >/dev/null 2>&1; then
 fi
 
 echo "Installing golangci-lint ${GOLANGCI_LINT_VERSION}..."
-go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.11.4
+go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.1
 
 # `go install` writes to GOBIN if set, otherwise GOPATH/bin. Record the actual
 # install target so the PATH-error and version-check branches below can both