diff --git a/.golangci.yml b/.golangci.yml
index d5075d45..192eaa26 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -6,6 +6,13 @@ linters:
     - misspell
     - modernize
     - revive
+    # Correctness linters (low-noise, no findings on the current tree).
+    - copyloopvar
+    - durationcheck
+    - gocritic
+    - makezero
+    - unconvert
+    - wastedassign
   exclusions:
     generated: strict
     presets:
@@ -23,6 +30,13 @@ linters:
       exclude-functions:
         # Used in HTTP handlers, any error is handled by the server itself.
         - (net/http.ResponseWriter).Write
+    govet:
+      enable-all: true
+      disable:
+        # Struct field ordering is not worth the churn/readability cost.
+        - fieldalignment
+        # err shadowing is idiomatic and used throughout the codebase.
+        - shadow
     revive:
       rules:
         # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#unused-parameter
diff --git a/web/tls_config.go b/web/tls_config.go
index 7245f741..2cdaef09 100644
--- a/web/tls_config.go
+++ b/web/tls_config.go
@@ -106,7 +106,7 @@ func (t *TLSConfig) VerifyPeerCertificate(rawCerts [][]byte, _ [][]*x509.Certifi
 	}
 
 	// Build up a slice of strings with all Subject Alternate Name values
-	sanValues := append(cert.DNSNames, cert.EmailAddresses...)
+	sanValues := slices.Concat(cert.DNSNames, cert.EmailAddresses)
 
 	for _, ip := range cert.IPAddresses {
 		sanValues = append(sanValues, ip.String())