diff --git a/.golangci.yml b/.golangci.yml
index 8d05e483..ebbd1747 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,3 +1,11 @@
----
-run:
-  timeout: 5m
+version: "2"
+linters:
+  settings:
+    staticcheck:
+      checks: ["all", "-ST1000", "-ST1003", "-ST1016", "-ST1020", "-ST1021", "-ST1022", "-ST1005"] # golangci-lint's default, we add -ST1005
+  exclusions:
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
diff --git a/Makefile b/Makefile
index 3cf077f3..80d639c9 100644
--- a/Makefile
+++ b/Makefile
@@ -27,7 +27,7 @@ GOARCH ?= $(shell go env GOARCH)
 # N/B: This value is managed by Renovate, manual changes are
 # possible, as long as they don't disturb the formatting
 # (i.e. DO NOT ADD A 'v' prefix!)
-GOLANGCI_LINT_VERSION := 1.64.8
+GOLANGCI_LINT_VERSION := 2.0.0
 
 ifeq ($(GOBIN),)
 GOBIN := $(GOPATH)/bin
diff --git a/cmd/skopeo/utils.go b/cmd/skopeo/utils.go
index 5c9f397b..3008443b 100644
--- a/cmd/skopeo/utils.go
+++ b/cmd/skopeo/utils.go
@@ -200,8 +200,8 @@ func (opts *imageOptions) newSystemContext() (*types.SystemContext, error) {
 	ctx.AuthFilePath = opts.shared.authFilePath
 	ctx.DockerDaemonHost = opts.dockerDaemonHost
 	ctx.DockerDaemonCertPath = opts.dockerCertPath
-	if opts.dockerImageOptions.authFilePath.Present() {
-		ctx.AuthFilePath = opts.dockerImageOptions.authFilePath.Value()
+	if opts.authFilePath.Present() {
+		ctx.AuthFilePath = opts.authFilePath.Value()
 	}
 	if opts.deprecatedTLSVerify != nil && opts.deprecatedTLSVerify.tlsVerify.Present() {
 		// If both this deprecated option and a non-deprecated option is present, we use the latter value.
diff --git a/hack/validate-lint.sh b/hack/validate-lint.sh
index d3dc7d11..e1e339b2 100755
--- a/hack/validate-lint.sh
+++ b/hack/validate-lint.sh
@@ -2,7 +2,7 @@
 
 errors=$($GOBIN/golangci-lint run --build-tags "${BUILDTAGS}" 2>&1)
 
-if [ -z "$errors" ]; then
+if [ "$?" -eq 0 ]; then
 	echo 'Congratulations!  All Go source files have been linted.'
 else
 	{