diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 7628ed0..842b713 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -26,7 +26,7 @@ repos:
       - id: gofumpt
         name: gofumpt
         description: Format Go files with gofumpt (stricter superset of gofmt)
-        entry: gofumpt -l -w
+        entry: bash -c 'PATH="$(go env GOPATH)/bin:$PATH" exec gofumpt -l -w "$@"' --
         language: system
         types: [go]
         pass_filenames: true
@@ -42,7 +42,7 @@ repos:
       - id: golangci-lint
         name: golangci-lint
         description: Run golangci-lint against the whole module (matches CI)
-        entry: golangci-lint run ./...
+        entry: bash -c 'PATH="$(go env GOPATH)/bin:$PATH" exec golangci-lint run ./...'
         language: system
         types: [go]
         pass_filenames: false
diff --git a/Makefile b/Makefile
index 9a1f472..b24798f 100644
--- a/Makefile
+++ b/Makefile
@@ -60,7 +60,7 @@ lint: ## Run golangci-lint
 
 setup: hooks ## One-time per-clone setup (Go tools + git hooks)
 	@command -v gofumpt >/dev/null 2>&1 || go install mvdan.cc/gofumpt@latest
-	@command -v golangci-lint >/dev/null 2>&1 || go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6
+	@command -v golangci-lint >/dev/null 2>&1 || go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.5.0
 	@echo "==> setup complete: gofumpt, golangci-lint, pre-commit hooks installed"
 
 hooks: ## Install the pre-commit hooks defined in .pre-commit-config.yaml
diff --git a/internal/server/http/p2r01_ws_test.go b/internal/server/http/p2r01_ws_test.go
index ed53847..bc3c57a 100644
--- a/internal/server/http/p2r01_ws_test.go
+++ b/internal/server/http/p2r01_ws_test.go
@@ -102,7 +102,7 @@ func enrolHostForWS(t *testing.T, srv *Server, st *store.Store, name string) (ho
 	if err := st.SetHostCredentials(context.Background(), hostID, enc); err != nil {
 		t.Fatalf("set creds: %v", err)
 	}
-	return
+	return hostID, token
 }
 
 func sendHello(t *testing.T, c *websocket.Conn, hostname string) {
diff --git a/internal/server/ws/hub_test.go b/internal/server/ws/hub_test.go
index aa73a23..3753cc2 100644
--- a/internal/server/ws/hub_test.go
+++ b/internal/server/ws/hub_test.go
@@ -47,7 +47,7 @@ func setupTestHub(t *testing.T) (url string, token string, hostID string, st *st
 		t.Fatalf("enroll: %v", err)
 	}
 	url = "ws" + strings.TrimPrefix(srv.URL, "http") + "/ws/agent"
-	return
+	return url, token, hostID, st, hub
 }
 
 func TestWSHelloAndHeartbeat(t *testing.T) {