diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2dac121..ca702b7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -37,7 +37,7 @@ jobs:
         with:
           go-version-file: go.mod
 
-      - uses: golangci/golangci-lint-action@v6
+      - uses: golangci/golangci-lint-action@v9
         with:
           version: latest
 
diff --git a/Dockerfile b/Dockerfile
index cbe555c..2f108c1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1
 
 # ── Stage 1: Build ───────────────────────────────────────────────────
-FROM golang:1.24-alpine AS builder
+FROM golang:1.25-alpine AS builder
 
 ARG VERSION=dev
 
diff --git a/cmd/coldkey/main.go b/cmd/coldkey/main.go
index e044f3a..0834099 100644
--- a/cmd/coldkey/main.go
+++ b/cmd/coldkey/main.go
@@ -7,8 +7,8 @@ import (
 	"path/filepath"
 
 	"github.com/pike00/coldkey/internal/backup"
-	"github.com/pike00/coldkey/internal/keygen"
 	"github.com/pike00/coldkey/internal/keyfile"
+	"github.com/pike00/coldkey/internal/keygen"
 	"github.com/pike00/coldkey/internal/prompt"
 	"github.com/pike00/coldkey/internal/secure"
 )
@@ -85,7 +85,9 @@ func cmdGenerate(args []string) {
 
 	if *output == "" {
 		// Write key to stdout
-		os.Stdout.Write(keyData)
+		if _, err := os.Stdout.Write(keyData); err != nil {
+			fatalf("writing key to stdout: %v", err)
+		}
 		if !*noBackup {
 			fmt.Fprintln(os.Stderr, "coldkey: hint: use -o PATH to also generate an HTML backup")
 		}
diff --git a/go.mod b/go.mod
index 3064857..0a08c9a 100644
--- a/go.mod
+++ b/go.mod
@@ -1,16 +1,14 @@
 module github.com/pike00/coldkey
 
-go 1.24.0
-
-toolchain go1.24.13
+go 1.25.0
 
 require (
 	filippo.io/age v1.3.1
 	github.com/piglig/go-qr v0.2.4
-	golang.org/x/sys v0.38.0
+	golang.org/x/sys v0.45.0
 )
 
 require (
 	filippo.io/hpke v0.4.0 // indirect
-	golang.org/x/crypto v0.45.0 // indirect
+	golang.org/x/crypto v0.52.0 // indirect
 )
diff --git a/go.sum b/go.sum
index 411be95..1d44aed 100644
--- a/go.sum
+++ b/go.sum
@@ -12,9 +12,9 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
-golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
-golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
-golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
+golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/internal/secure/file.go b/internal/secure/file.go
index fccec6e..3d418b1 100644
--- a/internal/secure/file.go
+++ b/internal/secure/file.go
@@ -26,11 +26,11 @@ func WriteFileForce(path string, data []byte) error {
 
 func syncAndClose(f *os.File, data []byte) error {
 	if _, err := f.Write(data); err != nil {
-		f.Close()
+		_ = f.Close()
 		return err
 	}
 	if err := f.Sync(); err != nil {
-		f.Close()
+		_ = f.Close()
 		return err
 	}
 	return f.Close()
@@ -53,18 +53,20 @@ func Shred(path string) error {
 	defer Zero(buf)
 	for pass := 0; pass < 3; pass++ {
 		if _, err := rand.Read(buf); err != nil {
-			f.Close()
+			_ = f.Close()
 			return err
 		}
 		if _, err := f.WriteAt(buf, 0); err != nil {
-			f.Close()
+			_ = f.Close()
 			return err
 		}
 		if err := f.Sync(); err != nil {
-			f.Close()
+			_ = f.Close()
 			return err
 		}
 	}
-	f.Close()
+	if err := f.Close(); err != nil {
+		return err
+	}
 	return os.Remove(path)
 }