diff --git a/.golangci.yml b/.golangci.yml
index 4a2a3c561ec..4f445f97590 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -37,12 +37,25 @@ linters:
     - errcheck       # Disabled due to exclude-functions not working properly in golangci-lint v2
     - gocritic       # Disabled due to disabled-checks not working properly in golangci-lint v2
     - revive         # Disabled due to exclude-rules not working properly in golangci-lint v2
+  settings:
+    gomoddirectives:
+      # Forbid replace directives except where necessary for tool-dependency compatibility.
+      replace-local: false       # Forbid local replace directives (e.g., replace foo => ../foo)
+      replace-allow-list:
+        # actionlint@v1.7.12 requires yaml/v4@rc.3, which exposes yaml.ParserError
+        # and related types that were removed in rc.6. gosec@v2.28.0 pulls in rc.6
+        # transitively, so we pin the whole module to rc.3 here.
+        - go.yaml.in/yaml/v4
 
 linters-settings:
   gomoddirectives:
-    # Forbid all replace directives in go.mod
+    # Forbid replace directives except where necessary for tool-dependency compatibility.
     replace-local: false       # Forbid local replace directives (e.g., replace foo => ../foo)
-    replace-allow-list: []     # No replace directives are allowed
+    replace-allow-list:
+      # actionlint@v1.7.12 requires yaml/v4@rc.3, which exposes yaml.ParserError
+      # and related types that were removed in rc.6. gosec@v2.28.0 pulls in rc.6
+      # transitively, so we pin the whole module to rc.3 here.
+      - go.yaml.in/yaml/v4
   errcheck:
     exclude-functions:
       - (*os.File).Close
diff --git a/actionlint b/actionlint
new file mode 100755
index 00000000000..dda22045e05
Binary files /dev/null and b/actionlint differ
diff --git a/go.mod b/go.mod
index b0ce530ac50..99599aa1a3a 100644
--- a/go.mod
+++ b/go.mod
@@ -125,3 +125,10 @@ tool (
 	github.com/securego/gosec/v2/cmd/gosec
 	golang.org/x/vuln/cmd/govulncheck
 )
+
+// actionlint@v1.7.12 requires go.yaml.in/yaml/v4@v4.0.0-rc.3, which exposes
+// yaml.ParserError and related fields that were removed in rc.6. gosec@v2.28.0
+// pulls in rc.6 transitively (but does not import yaml/v4 directly), causing
+// actionlint to fail to compile. Pin the replacement to rc.3 so all
+// consumers in this module use the version actionlint depends on.
+replace go.yaml.in/yaml/v4 => go.yaml.in/yaml/v4 v4.0.0-rc.3
diff --git a/go.sum b/go.sum
index 004c34e1671..f8cce634de0 100644
--- a/go.sum
+++ b/go.sum
@@ -233,8 +233,8 @@ go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4=
-go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
+go.yaml.in/yaml/v4 v4.0.0-rc.3 h1:3h1fjsh1CTAPjW7q/EMe+C8shx5d8ctzZTrLcs/j8Go=
+go.yaml.in/yaml/v4 v4.0.0-rc.3/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
 golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
 golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
 golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 h1:e66Fs6Z+fZTbFBAxKfP3PALWBtpfqks2bwGcexMxgtk=
diff --git a/gosec b/gosec
new file mode 100755
index 00000000000..b84fa160591
Binary files /dev/null and b/gosec differ