diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index 78e1a47d7..cdeec88d3 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -20,4 +20,4 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20  # v9.2.0
         with:
-          version: v2.7.2
+          version: v2.9.0
diff --git a/.go-version b/.go-version
index f1968aa88..5ff8c4f5d 100644
--- a/.go-version
+++ b/.go-version
@@ -1 +1 @@
-1.25.7
+1.26.0
diff --git a/plugin/file/tree/elem.go b/plugin/file/tree/elem.go
index 195e35a3e..2d0a40a52 100644
--- a/plugin/file/tree/elem.go
+++ b/plugin/file/tree/elem.go
@@ -49,7 +49,7 @@ func (e *Elem) TypeForWildcard(qtype uint16, qname string) []dns.RR {
 
 // All returns all RRs from e, regardless of type.
 func (e *Elem) All() []dns.RR {
-	list := []dns.RR{}
+	list := make([]dns.RR, 0, len(e.m))
 	for _, rrs := range e.m {
 		list = append(list, rrs...)
 	}
diff --git a/plugin/forward/policy.go b/plugin/forward/policy.go
index 3b62b1b49..ccd84113a 100644
--- a/plugin/forward/policy.go
+++ b/plugin/forward/policy.go
@@ -50,7 +50,8 @@ func (r *roundRobin) List(p []*proxy.Proxy) []*proxy.Proxy {
 	poolLen := uint32(len(p)) // #nosec G115 -- pool length is small
 	i := atomic.AddUint32(&r.robin, 1) % poolLen
 
-	robin := []*proxy.Proxy{p[i]}
+	robin := make([]*proxy.Proxy, 0, len(p))
+	robin = append(robin, p[i])
 	robin = append(robin, p[:i]...)
 	robin = append(robin, p[i+1:]...)
 
diff --git a/plugin/grpc/policy.go b/plugin/grpc/policy.go
index a01364354..4d48b6a78 100644
--- a/plugin/grpc/policy.go
+++ b/plugin/grpc/policy.go
@@ -54,7 +54,8 @@ func (r *roundRobin) List(p []*Proxy) []*Proxy {
 	poolLen := uint32(len(p)) // #nosec G115 -- pool length is small
 	i := atomic.AddUint32(&r.robin, 1) % poolLen
 
-	robin := []*Proxy{p[i]}
+	robin := make([]*Proxy, 0, len(p))
+	robin = append(robin, p[i])
 	robin = append(robin, p[:i]...)
 	robin = append(robin, p[i+1:]...)
 
diff --git a/plugin/k8s_external/external_test.go b/plugin/k8s_external/external_test.go
index ae265e955..fd0b43eea 100644
--- a/plugin/k8s_external/external_test.go
+++ b/plugin/k8s_external/external_test.go
@@ -298,7 +298,7 @@ func (external) EpIndex(s string) []*object.Endpoints {
 }
 
 func (external) EndpointsList() []*object.Endpoints {
-	var eps []*object.Endpoints
+	eps := make([]*object.Endpoints, 0, len(epIndexExternal))
 	for _, ep := range epIndexExternal {
 		eps = append(eps, ep...)
 	}
@@ -416,7 +416,7 @@ var svcIndexExternal = map[string][]*object.Service{
 }
 
 func (external) ServiceList() []*object.Service {
-	var svcs []*object.Service
+	svcs := make([]*object.Service, 0, len(svcIndexExternal))
 	for _, svc := range svcIndexExternal {
 		svcs = append(svcs, svc...)
 	}
diff --git a/plugin/k8s_external/transfer_test.go b/plugin/k8s_external/transfer_test.go
index 26642bb54..934d58ac0 100644
--- a/plugin/k8s_external/transfer_test.go
+++ b/plugin/k8s_external/transfer_test.go
@@ -38,7 +38,7 @@ func TestTransferAXFR(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Unexpected error: %v", err)
 	}
-	var records []dns.RR
+	var records []dns.RR //nolint:prealloc // records are read from a channel
 	for rrs := range ch {
 		records = append(records, rrs...)
 	}
@@ -104,7 +104,7 @@ func TestTransferIXFR(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Unexpected error: %v", err)
 	}
-	var records []dns.RR
+	var records []dns.RR //nolint:prealloc // records are read from a channel
 	for rrs := range ch {
 		records = append(records, rrs...)
 	}
diff --git a/plugin/kubernetes/external_test.go b/plugin/kubernetes/external_test.go
index b584cabef..825d7758c 100644
--- a/plugin/kubernetes/external_test.go
+++ b/plugin/kubernetes/external_test.go
@@ -105,7 +105,7 @@ func (external) EpIndex(s string) []*object.Endpoints {
 }
 
 func (external) EndpointsList() []*object.Endpoints {
-	var eps []*object.Endpoints
+	eps := make([]*object.Endpoints, 0, len(epIndexExternal))
 	for _, ep := range epIndexExternal {
 		eps = append(eps, ep...)
 	}
@@ -189,7 +189,7 @@ var svcIndexExternal = map[string][]*object.Service{
 }
 
 func (external) ServiceList() []*object.Service {
-	var svcs []*object.Service
+	svcs := make([]*object.Service, 0, len(svcIndexExternal))
 	for _, svc := range svcIndexExternal {
 		svcs = append(svcs, svc...)
 	}
diff --git a/plugin/kubernetes/handler_test.go b/plugin/kubernetes/handler_test.go
index 28ba5af28..ad5aae6a5 100644
--- a/plugin/kubernetes/handler_test.go
+++ b/plugin/kubernetes/handler_test.go
@@ -835,7 +835,7 @@ var svcIndex = map[string][]*object.Service{
 func (APIConnServeTest) SvcIndex(s string) []*object.Service { return svcIndex[s] }
 
 func (APIConnServeTest) ServiceList() []*object.Service {
-	var svcs []*object.Service
+	svcs := make([]*object.Service, 0, len(svcIndex))
 	for _, svc := range svcIndex {
 		svcs = append(svcs, svc...)
 	}
@@ -1012,7 +1012,7 @@ var svcImportIndex = map[string][]*object.ServiceImport{
 func (APIConnServeTest) SvcImportIndex(s string) []*object.ServiceImport { return svcImportIndex[s] }
 
 func (APIConnServeTest) ServiceImportList() []*object.ServiceImport {
-	var svcs []*object.ServiceImport
+	svcs := make([]*object.ServiceImport, 0, len(svcImportIndex))
 	for _, svc := range svcImportIndex {
 		svcs = append(svcs, svc...)
 	}
@@ -1118,7 +1118,7 @@ func (APIConnServeTest) McEpIndex(s string) []*object.MultiClusterEndpoints {
 }
 
 func (APIConnServeTest) MultiClusterEndpointsList() []*object.MultiClusterEndpoints {
-	var eps []*object.MultiClusterEndpoints
+	eps := make([]*object.MultiClusterEndpoints, 0, len(mcEpsIndex))
 	for _, ep := range mcEpsIndex {
 		eps = append(eps, ep...)
 	}
@@ -1126,7 +1126,7 @@ func (APIConnServeTest) MultiClusterEndpointsList() []*object.MultiClusterEndpoi
 }
 
 func (APIConnServeTest) EndpointsList() []*object.Endpoints {
-	var eps []*object.Endpoints
+	eps := make([]*object.Endpoints, 0, len(epsIndex))
 	for _, ep := range epsIndex {
 		eps = append(eps, ep...)
 	}
diff --git a/plugin/kubernetes/xfr_test.go b/plugin/kubernetes/xfr_test.go
index ebc876e33..95e89b216 100644
--- a/plugin/kubernetes/xfr_test.go
+++ b/plugin/kubernetes/xfr_test.go
@@ -88,7 +88,7 @@ func TestKubernetesIXFRCurrent(t *testing.T) {
 		t.Error(err)
 	}
 
-	var gotRRs []dns.RR
+	var gotRRs []dns.RR //nolint:prealloc // records are read from a channel
 	for rrs := range ch {
 		gotRRs = append(gotRRs, rrs...)
 	}
diff --git a/plugin/loadbalance/prefer_test.go b/plugin/loadbalance/prefer_test.go
index 12537c2f8..28bf49aa3 100644
--- a/plugin/loadbalance/prefer_test.go
+++ b/plugin/loadbalance/prefer_test.go
@@ -23,8 +23,8 @@ func TestSortPreferred(t *testing.T) {
 		test.CNAME("example.org. 300 IN CNAME alias.example.org."),
 	}
 
-	subnets := []*net.IPNet{}
 	cidrs := []string{"2001:db8::/32", "10.9.20.0/24", "10.9.30.0/24"}
+	subnets := make([]*net.IPNet, 0, len(cidrs))
 	for _, cidr := range cidrs {
 		_, subnet, err := net.ParseCIDR(cidr)
 		if err != nil {
diff --git a/plugin/metadata/metadata_test.go b/plugin/metadata/metadata_test.go
index 6b8da6d00..aaaab4003 100644
--- a/plugin/metadata/metadata_test.go
+++ b/plugin/metadata/metadata_test.go
@@ -34,7 +34,7 @@ func TestMetadataServeDNS(t *testing.T) {
 		{"test/key2": func() string { return "two" }, "test/key3": func() string { return "testvalue3" }},
 	}
 	// Create fake Providers based on expectedMetadata
-	providers := []Provider{}
+	providers := make([]Provider, 0, len(expectedMetadata))
 	for _, e := range expectedMetadata {
 		providers = append(providers, e)
 	}
diff --git a/plugin/metrics/metrics.go b/plugin/metrics/metrics.go
index 129561e0a..9ebb4a5aa 100644
--- a/plugin/metrics/metrics.go
+++ b/plugin/metrics/metrics.go
@@ -142,7 +142,7 @@ func (m *Metrics) stopServer() error {
 func (m *Metrics) OnFinalShutdown() error { return m.stopServer() }
 
 func keys(m map[string]struct{}) []string {
-	sx := []string{}
+	sx := make([]string, 0, len(m))
 	for k := range m {
 		sx = append(sx, k)
 	}
diff --git a/plugin/pkg/dnsutil/reverse.go b/plugin/pkg/dnsutil/reverse.go
index 72ce40f64..634e77338 100644
--- a/plugin/pkg/dnsutil/reverse.go
+++ b/plugin/pkg/dnsutil/reverse.go
@@ -60,7 +60,7 @@ func reverse6(slice []string) string {
 		j := len(slice) - i - 1
 		slice[i], slice[j] = slice[j], slice[i]
 	}
-	slice6 := []string{}
+	slice6 := make([]string, 0, len(slice)/4)
 	for i := range len(slice) / 4 {
 		slice6 = append(slice6, strings.Join(slice[i*4:i*4+4], ""))
 	}
diff --git a/plugin/pkg/fall/fall.go b/plugin/pkg/fall/fall.go
index b4b9329f2..db7b27fb1 100644
--- a/plugin/pkg/fall/fall.go
+++ b/plugin/pkg/fall/fall.go
@@ -32,7 +32,7 @@ func (f F) Through(qname string) bool {
 
 // setZones will set zones in f.
 func (f *F) setZones(zones []string) {
-	z := []string{}
+	z := make([]string, 0, len(zones))
 	for i := range zones {
 		z = append(z, plugin.Host(zones[i]).NormalizeExact()...)
 	}
diff --git a/plugin/pkg/parse/host.go b/plugin/pkg/parse/host.go
index 2b87c58fe..78f7cd93b 100644
--- a/plugin/pkg/parse/host.go
+++ b/plugin/pkg/parse/host.go
@@ -30,7 +30,7 @@ func stripZone(host string) string {
 // and in case of filename a resolv.conf like file is (assumed) and parsed and
 // the nameservers found are returned.
 func HostPortOrFile(s ...string) ([]string, error) {
-	var servers []string //nolint:prealloc // impossible to know the final length upfront
+	var servers []string
 	for _, h := range s {
 		trans, host := Transport(h)
 		if len(host) == 0 {
diff --git a/plugin/rewrite/cname_target_test.go b/plugin/rewrite/cname_target_test.go
index ff25e0217..653defc20 100644
--- a/plugin/rewrite/cname_target_test.go
+++ b/plugin/rewrite/cname_target_test.go
@@ -66,7 +66,6 @@ func (u *MockedUpstream) Lookup(ctx context.Context, state request.Request, name
 }
 
 func TestCNameTargetRewrite(t *testing.T) {
-	rules := []Rule{}
 	ruleset := []struct {
 		args         []string
 		expectedType reflect.Type
@@ -78,6 +77,7 @@ func TestCNameTargetRewrite(t *testing.T) {
 		{[]string{"continue", "cname", "regex", `(.*)\.web\.(.*)\.site\.`, `{1}.webapp.{2}.org.`}, reflect.TypeFor[*cnameTargetRule]()},
 		{[]string{"continue", "cname", "exact", "music.truncated.spotify.com.", "music.truncated.spotify.com."}, reflect.TypeFor[*cnameTargetRule]()},
 	}
+	rules := make([]Rule, 0, len(ruleset))
 	for i, r := range ruleset {
 		rule, err := newRule(r.args...)
 		if err != nil {
diff --git a/plugin/rewrite/reverter_test.go b/plugin/rewrite/reverter_test.go
index f249eba10..d15029915 100644
--- a/plugin/rewrite/reverter_test.go
+++ b/plugin/rewrite/reverter_test.go
@@ -31,13 +31,13 @@ var tests = []struct {
 }
 
 func TestResponseReverter(t *testing.T) {
-	rules := []Rule{}
+	rules := make([]Rule, 0, 1)
 	r, _ := newNameRule("stop", "regex", `(core)\.(dns)\.(rocks)`, "{2}.{1}.{3}", "answer", "name", `(dns)\.(core)\.(rocks)`, "{2}.{1}.{3}")
 	rules = append(rules, r)
 
 	doReverterTests(t, rules)
 
-	rules = []Rule{}
+	rules = make([]Rule, 0, 1)
 	r, _ = newNameRule("continue", "regex", `(core)\.(dns)\.(rocks)`, "{2}.{1}.{3}", "answer", "name", `(dns)\.(core)\.(rocks)`, "{2}.{1}.{3}")
 	rules = append(rules, r)
 
@@ -98,7 +98,7 @@ var valueTests = []struct {
 }
 
 func TestValueResponseReverter(t *testing.T) {
-	rules := []Rule{}
+	rules := make([]Rule, 0, 1)
 	r, err := newNameRule("stop", "regex", `(.*)\.domain\.uk`, "{1}.cluster.local", "answer", "name", `(.*)\.cluster\.local`, "{1}.domain.uk", "answer", "value", `(.*)\.cluster\.local`, "{1}.domain.uk")
 	if err != nil {
 		t.Errorf("cannot parse rule: %s", err)
@@ -108,7 +108,7 @@ func TestValueResponseReverter(t *testing.T) {
 
 	doValueReverterTests(t, "stop", rules)
 
-	rules = []Rule{}
+	rules = make([]Rule, 0, 1)
 	r, err = newNameRule("continue", "regex", `(.*)\.domain\.uk`, "{1}.cluster.local", "answer", "name", `(.*)\.cluster\.local`, "{1}.domain.uk", "answer", "value", `(.*)\.cluster\.local`, "{1}.domain.uk")
 	if err != nil {
 		t.Errorf("cannot parse rule: %s", err)
@@ -118,7 +118,7 @@ func TestValueResponseReverter(t *testing.T) {
 
 	doValueReverterTests(t, "continue", rules)
 
-	rules = []Rule{}
+	rules = make([]Rule, 0, 1)
 	r, err = newNameRule("stop", "suffix", `.domain.uk`, ".cluster.local", "answer", "auto", "answer", "value", `(.*)\.cluster\.local`, "{1}.domain.uk")
 	if err != nil {
 		t.Errorf("cannot parse rule: %s", err)
@@ -129,7 +129,7 @@ func TestValueResponseReverter(t *testing.T) {
 	doValueReverterTests(t, "suffix", rules)
 
 	// multiple rules
-	rules = []Rule{}
+	rules = make([]Rule, 0, 1)
 	r, err = newNameRule("continue", "suffix", `.domain.uk`, ".domain.us", "answer", "auto")
 	if err != nil {
 		t.Errorf("cannot parse rule: %s", err)
diff --git a/plugin/rewrite/rewrite_test.go b/plugin/rewrite/rewrite_test.go
index b85a0161f..a9f61d1f4 100644
--- a/plugin/rewrite/rewrite_test.go
+++ b/plugin/rewrite/rewrite_test.go
@@ -191,7 +191,7 @@ func TestNewRule(t *testing.T) {
 }
 
 func TestRewriteDefaultRevertPolicy(t *testing.T) {
-	rules := []Rule{}
+	rules := make([]Rule, 0, 4)
 
 	r, _ := newNameRule("stop", "prefix", "prefix", "to")
 	rules = append(rules, r)
@@ -244,7 +244,7 @@ func TestRewriteDefaultRevertPolicy(t *testing.T) {
 }
 
 func TestRewrite(t *testing.T) {
-	rules := []Rule{}
+	rules := make([]Rule, 0, 12)
 	r, _ := newNameRule("stop", "from.nl.", "to.nl.")
 	rules = append(rules, r)
 	r, _ = newNameRule("stop", "regex", "(core)\\.(dns)\\.(rocks)\\.(nl)", "{2}.{1}.{3}.{4}", "answer", "name", "(dns)\\.(core)\\.(rocks)\\.(nl)", "{2}.{1}.{3}.{4}")
diff --git a/plugin/rewrite/ttl_test.go b/plugin/rewrite/ttl_test.go
index 7e3389d4c..1fe9f799f 100644
--- a/plugin/rewrite/ttl_test.go
+++ b/plugin/rewrite/ttl_test.go
@@ -74,7 +74,6 @@ func TestNewTTLRule(t *testing.T) {
 }
 
 func TestTtlRewrite(t *testing.T) {
-	rules := []Rule{}
 	ruleset := []struct {
 		args         []string
 		expectedType reflect.Type
@@ -90,6 +89,7 @@ func TestTtlRewrite(t *testing.T) {
 		{[]string{"stop", "ttl", "ceil.example.com.", "-11"}, reflect.TypeFor[*exactTTLRule]()},
 		{[]string{"stop", "ttl", "floor.example.com.", "5-"}, reflect.TypeFor[*exactTTLRule]()},
 	}
+	rules := make([]Rule, 0, len(ruleset))
 	for i, r := range ruleset {
 		rule, err := newRule(r.args...)
 		if err != nil {