diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 1a8a86ad1b3..b4f0dae8b9c 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -57,7 +57,7 @@ jobs:
           fetch-depth: 2
       - uses: actions/setup-go@v6
         with:
-          go-version: "${{ env.GO_VERSION }}"
+          go-version: stable # modernize@latest may require latest Go.
       - name: install deps
         run: |
           sudo apt -q update
@@ -68,7 +68,7 @@ jobs:
           git diff --exit-code
       - name: run modernize
         run: |
-          go run golang.org/x/tools/gopls/internal/analysis/modernize/cmd/modernize@latest -fix -test ./...
+          go run golang.org/x/tools/go/analysis/passes/modernize/cmd/modernize@latest -fix ./...
           git diff --exit-code
 
   compile-buildtags:
diff --git a/libcontainer/integration/exec_test.go b/libcontainer/integration/exec_test.go
index a6bd389555b..e977b36a92d 100644
--- a/libcontainer/integration/exec_test.go
+++ b/libcontainer/integration/exec_test.go
@@ -1067,15 +1067,16 @@ func TestHook(t *testing.T) {
 	ok(t, err)
 
 	// e.g: 'ls /prestart ...'
-	cmd := "ls "
+	var cmd strings.Builder
+	cmd.WriteString("ls ")
 	for _, hook := range hookFiles {
-		cmd += "/" + hook + " "
+		cmd.WriteString("/" + hook + " ")
 	}
 
 	var stdout bytes.Buffer
 	pconfig := libcontainer.Process{
 		Cwd:    "/",
-		Args:   []string{"sh", "-c", cmd},
+		Args:   []string{"sh", "-c", cmd.String()},
 		Env:    standardEnvironment,
 		Stdin:  nil,
 		Stdout: &stdout,