diff --git a/.golangci.yml b/.golangci.yml
index 25dc9e996..71e7ececc 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -95,6 +95,9 @@ linters:
     # against idiomatic Go programming, which encourages this approach - e.g.
     # to scope errors.
     - noinlineerr
+
+    # Deprecated in favour of gomodguard_v2, which is enabled by default: all
+    - gomodguard
   settings:
     depguard:
       rules:
@@ -117,6 +120,7 @@ linters:
     goconst:
       min-len: 3
       min-occurrences: 5
+      ignore-tests: true
     gocritic:
       enabled-tags:
         - performance
@@ -159,7 +163,6 @@ linters:
           - gochecknoglobals
           - gochecknoinits
           - gocognit
-          - goconst
           - gosec
           - scopelint
           - unparam
@@ -178,6 +181,14 @@ linters:
           - gochecknoinits
         path: apis/
 
+      # The xcrd package builds OpenAPI schemas, so it repeats schema
+      # vocabulary like "string", "object", and "apiVersion". Each literal
+      # mirrors the schema field it emits, which reads better than a named
+      # constant standing in for it.
+      - linters:
+          - goconst
+        path: pkg/xcrd/
+
       # These are performance optimisations rather than style issues per se.
       # They warn when function arguments or range values copy a lot of memory
       # rather than using a pointer.
diff --git a/apis/changelogs/proto/v1alpha1/changelog.pb.go b/apis/changelogs/proto/v1alpha1/changelog.pb.go
index afc0f0444..8ea19f8e2 100644
--- a/apis/changelogs/proto/v1alpha1/changelog.pb.go
+++ b/apis/changelogs/proto/v1alpha1/changelog.pb.go
@@ -12,7 +12,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: apis/changelogs/proto/v1alpha1/changelog.proto
 
diff --git a/apis/changelogs/proto/v1alpha1/changelog_grpc.pb.go b/apis/changelogs/proto/v1alpha1/changelog_grpc.pb.go
index 331c2ce10..b6a6921b6 100644
--- a/apis/changelogs/proto/v1alpha1/changelog_grpc.pb.go
+++ b/apis/changelogs/proto/v1alpha1/changelog_grpc.pb.go
@@ -12,7 +12,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.5.1
+// - protoc-gen-go-grpc v1.6.2
 // - protoc             (unknown)
 // source: apis/changelogs/proto/v1alpha1/changelog.proto
 
@@ -85,7 +85,7 @@ type ChangeLogServiceServer interface {
 type UnimplementedChangeLogServiceServer struct{}
 
 func (UnimplementedChangeLogServiceServer) SendChangeLog(context.Context, *SendChangeLogRequest) (*SendChangeLogResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method SendChangeLog not implemented")
+	return nil, status.Error(codes.Unimplemented, "method SendChangeLog not implemented")
 }
 func (UnimplementedChangeLogServiceServer) mustEmbedUnimplementedChangeLogServiceServer() {}
 func (UnimplementedChangeLogServiceServer) testEmbeddedByValue()                          {}
@@ -98,7 +98,7 @@ type UnsafeChangeLogServiceServer interface {
 }
 
 func RegisterChangeLogServiceServer(s grpc.ServiceRegistrar, srv ChangeLogServiceServer) {
-	// If the following call pancis, it indicates UnimplementedChangeLogServiceServer was
+	// If the following call panics, it indicates UnimplementedChangeLogServiceServer was
 	// embedded by pointer and is nil.  This will cause panics if an
 	// unimplemented method is ever invoked, so we test this at initialization
 	// time to prevent it from happening at runtime later due to I/O.
diff --git a/apis/pipelineinspector/proto/v1alpha1/pipeline_inspector.pb.go b/apis/pipelineinspector/proto/v1alpha1/pipeline_inspector.pb.go
index 9751df2ff..d8d9a52cc 100644
--- a/apis/pipelineinspector/proto/v1alpha1/pipeline_inspector.pb.go
+++ b/apis/pipelineinspector/proto/v1alpha1/pipeline_inspector.pb.go
@@ -15,7 +15,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: apis/pipelineinspector/proto/v1alpha1/pipeline_inspector.proto
 
diff --git a/apis/pipelineinspector/proto/v1alpha1/pipeline_inspector_grpc.pb.go b/apis/pipelineinspector/proto/v1alpha1/pipeline_inspector_grpc.pb.go
index 2ed928321..cff7796a3 100644
--- a/apis/pipelineinspector/proto/v1alpha1/pipeline_inspector_grpc.pb.go
+++ b/apis/pipelineinspector/proto/v1alpha1/pipeline_inspector_grpc.pb.go
@@ -15,7 +15,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.5.1
+// - protoc-gen-go-grpc v1.6.2
 // - protoc             (unknown)
 // source: apis/pipelineinspector/proto/v1alpha1/pipeline_inspector.proto
 
@@ -109,10 +109,10 @@ type PipelineInspectorServiceServer interface {
 type UnimplementedPipelineInspectorServiceServer struct{}
 
 func (UnimplementedPipelineInspectorServiceServer) EmitRequest(context.Context, *EmitRequestRequest) (*EmitRequestResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method EmitRequest not implemented")
+	return nil, status.Error(codes.Unimplemented, "method EmitRequest not implemented")
 }
 func (UnimplementedPipelineInspectorServiceServer) EmitResponse(context.Context, *EmitResponseRequest) (*EmitResponseResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method EmitResponse not implemented")
+	return nil, status.Error(codes.Unimplemented, "method EmitResponse not implemented")
 }
 func (UnimplementedPipelineInspectorServiceServer) mustEmbedUnimplementedPipelineInspectorServiceServer() {
 }
@@ -126,7 +126,7 @@ type UnsafePipelineInspectorServiceServer interface {
 }
 
 func RegisterPipelineInspectorServiceServer(s grpc.ServiceRegistrar, srv PipelineInspectorServiceServer) {
-	// If the following call pancis, it indicates UnimplementedPipelineInspectorServiceServer was
+	// If the following call panics, it indicates UnimplementedPipelineInspectorServiceServer was
 	// embedded by pointer and is nil.  This will cause panics if an
 	// unimplemented method is ever invoked, so we test this at initialization
 	// time to prevent it from happening at runtime later due to I/O.
diff --git a/apis/proto/v1alpha1/ess.pb.go b/apis/proto/v1alpha1/ess.pb.go
index d6545fb63..cbd016c15 100644
--- a/apis/proto/v1alpha1/ess.pb.go
+++ b/apis/proto/v1alpha1/ess.pb.go
@@ -12,7 +12,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        (unknown)
 // source: apis/proto/v1alpha1/ess.proto
 
diff --git a/apis/proto/v1alpha1/ess_grpc.pb.go b/apis/proto/v1alpha1/ess_grpc.pb.go
index d4f5cd2f4..263aa2b22 100644
--- a/apis/proto/v1alpha1/ess_grpc.pb.go
+++ b/apis/proto/v1alpha1/ess_grpc.pb.go
@@ -12,7 +12,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.5.1
+// - protoc-gen-go-grpc v1.6.2
 // - protoc             (unknown)
 // source: apis/proto/v1alpha1/ess.proto
 
@@ -107,13 +107,13 @@ type ExternalSecretStorePluginServiceServer interface {
 type UnimplementedExternalSecretStorePluginServiceServer struct{}
 
 func (UnimplementedExternalSecretStorePluginServiceServer) GetSecret(context.Context, *GetSecretRequest) (*GetSecretResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetSecret not implemented")
+	return nil, status.Error(codes.Unimplemented, "method GetSecret not implemented")
 }
 func (UnimplementedExternalSecretStorePluginServiceServer) ApplySecret(context.Context, *ApplySecretRequest) (*ApplySecretResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ApplySecret not implemented")
+	return nil, status.Error(codes.Unimplemented, "method ApplySecret not implemented")
 }
 func (UnimplementedExternalSecretStorePluginServiceServer) DeleteKeys(context.Context, *DeleteKeysRequest) (*DeleteKeysResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method DeleteKeys not implemented")
+	return nil, status.Error(codes.Unimplemented, "method DeleteKeys not implemented")
 }
 func (UnimplementedExternalSecretStorePluginServiceServer) mustEmbedUnimplementedExternalSecretStorePluginServiceServer() {
 }
@@ -127,7 +127,7 @@ type UnsafeExternalSecretStorePluginServiceServer interface {
 }
 
 func RegisterExternalSecretStorePluginServiceServer(s grpc.ServiceRegistrar, srv ExternalSecretStorePluginServiceServer) {
-	// If the following call pancis, it indicates UnimplementedExternalSecretStorePluginServiceServer was
+	// If the following call panics, it indicates UnimplementedExternalSecretStorePluginServiceServer was
 	// embedded by pointer and is nil.  This will cause panics if an
 	// unimplemented method is ever invoked, so we test this at initialization
 	// time to prevent it from happening at runtime later due to I/O.
diff --git a/flake.lock b/flake.lock
index 9c01fc58b..e8971e0d5 100644
--- a/flake.lock
+++ b/flake.lock
@@ -42,16 +42,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1769598131,
-        "narHash": "sha256-e7VO/kGLgRMbWtpBqdWl0uFg8Y2XWFMdz0uUJvlML8o=",
+        "lastModified": 1785858998,
+        "narHash": "sha256-fKCq5jphd6l/Ms6gc3dptkw/TcKLYub9lQE5g6rbbkc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "fa83fd837f3098e3e678e6cf017b2b36102c7211",
+        "rev": "04607e1165ac22c5fde6dcc54c9e0b3c0487c555",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-25.11",
+        "ref": "nixos-26.05",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index fdd9f799f..0156ef96c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -5,7 +5,7 @@
   description = "Crossplane Runtime - Go library for building Crossplane providers and controllers";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
 
     # TODO(negz): Unpin once https://github.com/nix-community/gomod2nix/pull/231 is released.
@@ -99,7 +99,7 @@
               pkgs.kubernetes-controller-tools
 
               # Nix
-              pkgs.nixfmt-rfc-style
+              pkgs.nixfmt
             ];
 
             shellHook = ''
diff --git a/nix/checks.nix b/nix/checks.nix
index 982bb51a6..1ffb5d19f 100644
--- a/nix/checks.nix
+++ b/nix/checks.nix
@@ -120,7 +120,7 @@
         nativeBuildInputs = [
           pkgs.statix
           pkgs.deadnix
-          pkgs.nixfmt-rfc-style
+          pkgs.nixfmt
         ];
       }
       ''
diff --git a/pkg/fieldpath/fieldpath.go b/pkg/fieldpath/fieldpath.go
index 9049460d8..d32703d45 100644
--- a/pkg/fieldpath/fieldpath.go
+++ b/pkg/fieldpath/fieldpath.go
@@ -79,13 +79,13 @@ func (sg Segments) String() string {
 		switch s.Type {
 		case SegmentField:
 			if s.Field == wildcard || strings.ContainsRune(s.Field, period) {
-				b.WriteString(fmt.Sprintf("[%s]", s.Field))
+				fmt.Fprintf(&b, "[%s]", s.Field)
 				continue
 			}
 
-			b.WriteString(fmt.Sprintf(".%s", s.Field))
+			fmt.Fprintf(&b, ".%s", s.Field)
 		case SegmentIndex:
-			b.WriteString(fmt.Sprintf("[%d]", s.Index))
+			fmt.Fprintf(&b, "[%d]", s.Index)
 		}
 	}
 
diff --git a/pkg/fieldpath/merge.go b/pkg/fieldpath/merge.go
index fe7234e4f..14815eeba 100644
--- a/pkg/fieldpath/merge.go
+++ b/pkg/fieldpath/merge.go
@@ -84,11 +84,11 @@ func merge(dst, src any, mergeOptions *xpv1.MergeOptions) (any, error) {
 
 func removeSourceDuplicates(dst, src any) any {
 	sliceDst, sliceSrc := reflect.ValueOf(dst), reflect.ValueOf(src)
-	if sliceDst.Kind() == reflect.Ptr {
+	if sliceDst.Kind() == reflect.Pointer {
 		sliceDst = sliceDst.Elem()
 	}
 
-	if sliceSrc.Kind() == reflect.Ptr {
+	if sliceSrc.Kind() == reflect.Pointer {
 		sliceSrc = sliceSrc.Elem()
 	}
 
diff --git a/pkg/reconciler/managed/metrics.go b/pkg/reconciler/managed/metrics.go
index 747ce40d5..362722a4e 100644
--- a/pkg/reconciler/managed/metrics.go
+++ b/pkg/reconciler/managed/metrics.go
@@ -28,7 +28,10 @@ import (
 	"github.com/crossplane/crossplane-runtime/v2/pkg/resource"
 )
 
-const subSystem = "crossplane"
+const (
+	subSystem = "crossplane"
+	labelGVK  = "gvk"
+)
 
 // MetricRecorder records the managed resource metrics.
 type MetricRecorder interface { //nolint:interfacebloat // The first two methods are coming from Prometheus
@@ -61,25 +64,25 @@ func NewMRMetricRecorder() *MRMetricRecorder {
 			Name:      "managed_resource_first_time_to_reconcile_seconds",
 			Help:      "The time it took for a managed resource to be detected by the controller",
 			Buckets:   kmetrics.ExponentialBuckets(10e-9, 10, 10),
-		}, []string{"gvk"}),
+		}, []string{labelGVK}),
 		mrFirstTimeReady: prometheus.NewHistogramVec(prometheus.HistogramOpts{
 			Subsystem: subSystem,
 			Name:      "managed_resource_first_time_to_readiness_seconds",
 			Help:      "The time it took for a managed resource to become ready first time after creation",
 			Buckets:   []float64{1, 5, 10, 15, 30, 60, 120, 300, 600, 1800, 3600},
-		}, []string{"gvk"}),
+		}, []string{labelGVK}),
 		mrDeletion: prometheus.NewHistogramVec(prometheus.HistogramOpts{
 			Subsystem: subSystem,
 			Name:      "managed_resource_deletion_seconds",
 			Help:      "The time it took for a managed resource to be deleted",
 			Buckets:   []float64{1, 5, 10, 15, 30, 60, 120, 300, 600, 1800, 3600},
-		}, []string{"gvk"}),
+		}, []string{labelGVK}),
 		mrDrift: prometheus.NewHistogramVec(prometheus.HistogramOpts{
 			Subsystem: subSystem,
 			Name:      "managed_resource_drift_seconds",
 			Help:      "ALPHA: How long since the previous successful reconcile when a resource was found to be out of sync; excludes restart of the provider",
 			Buckets:   kmetrics.ExponentialBuckets(10e-9, 10, 10),
-		}, []string{"gvk"}),
+		}, []string{labelGVK}),
 	}
 }
 
@@ -176,6 +179,6 @@ func (r *NopMetricRecorder) recordFirstTimeReady(_ resource.Managed) {}
 
 func getLabels(r resource.Managed) prometheus.Labels {
 	return prometheus.Labels{
-		"gvk": r.GetObjectKind().GroupVersionKind().String(),
+		labelGVK: r.GetObjectKind().GroupVersionKind().String(),
 	}
 }