diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5f4b4be..be225a0 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -5,11 +5,15 @@ on:
   - push
   - pull_request
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - uses: dorny/paths-filter@v3
         name: check for changes
@@ -23,7 +27,7 @@ jobs:
 
       - if: steps.changes.outputs.src == 'true'
         name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
           check-latest: true
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index cfedbfd..753919c 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -27,12 +27,14 @@ jobs:
       - if: steps.changes.outputs.src == 'true'
         uses: actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version-file: go.mod
+          check-latest: true
+          cache: true
 
       - if: steps.changes.outputs.src == 'true'
         name: Lint
         uses: golangci/golangci-lint-action@v6
         with:
-          version: v1.58
+          version: v1.59.1
           args: --issues-exit-code=0
           only-new-issues: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d099d3a..9755723 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,12 +23,12 @@ jobs:
       packages: write
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
           check-latest: true
@@ -48,10 +48,10 @@ jobs:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v4
+        uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser
-          version: latest
+          version: "~> v2"
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 8818ec5..b433f6d 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -1,8 +1,10 @@
 ---
 version: 2
+
 before:
   hooks:
     - go mod tidy
+    - go mod download
 
 builds:
   - env:
@@ -20,6 +22,7 @@ builds:
       - -trimpath
     ldflags:
       - -s -w -X github.com/kgaughan/mercury/internal/version.Version={{.Version}}
+    mod_timestamp: "{{ .CommitTimestamp }}"
     tags:
       - netgo
 
@@ -66,7 +69,8 @@ dockers:
     dockerfile: Dockerfile
 
 checksum:
-  name_template: "checksums.txt"
+  algorithm: sha256
+  name_template: '{{ .ProjectName }}_{{ .Version }}_SHA256SUMS'
 
 snapshot:
   name_template: "{{ incpatch .Version }}-next"