diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0e0cbd7..9f828c5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ jobs:
           go-version-file: go.mod
           cache: false  # golangci-lint manages its own cache
 
-      - uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee  # v9
+      - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a  # v9
         with:
           version: latest
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 59eee46..6afa4d4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,7 @@ under the affected version with a reference to the CVE or advisory.
 
 ### Changed
 - Bump `google.golang.org/grpc` from 1.81.1 to 1.82.0 (routine minor release; transitive bump to `google.golang.org/genproto/googleapis/rpc`)
+- Bump `golangci/golangci-lint-action` from 9.2.1 to 9.3.0 (CI: linter tooling update)
 
 ---