diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a9c7dd69..75c0b465 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,12 +27,20 @@ jobs:
           echo "Installing cue version $CUE_VERSION"
           curl -L https://github.com/cuelang/cue/releases/download/${CUE_VERSION}/${CUE_TARBALL} | sudo tar zxf - -C /usr/local/bin
 
-          # golangci
-          curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sudo sh -s -- -b /usr/local/bin v1.23.8
+      - name: Go Lint
+        uses: golangci/golangci-lint-action@v2
+        with:
+          version: v1.39
+          skip-go-installation: true
+          args: --timeout=3m
+
+      - name: Cue Lint
+        run: |
+          make cuelint
 
       - name: Lint
         run: |
-          make lint
+          make check-buildkit-version
 
   test:
     name: Test
diff --git a/.golangci.yml b/.golangci.yml
index 2a3a2233..3e2d26a7 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -26,7 +26,7 @@ linters:
     - nakedret
     - prealloc
     - rowserrcheck
-    - scopelint
+    - exportloopref
     - staticcheck
     - structcheck
     - stylecheck
diff --git a/Makefile b/Makefile
index 50814200..5c9341d1 100644
--- a/Makefile
+++ b/Makefile
@@ -13,17 +13,23 @@ dagger-debug:
 test:
 	go test -race -v ./...
 
+.PHONY: golint
+golint:
+	golangci-lint run --timeout 3m
+
 .PHONY: cuefmt
 cuefmt:
 	@(cue fmt -s ./stdlib/...)
 	@(cue fmt -s ./examples/*/)
 	@(cue fmt -s ./tests/...)
 
-.PHONY: lint
-lint: cuefmt check-buildkit-version
-	golangci-lint run --timeout 3m
+.PHONY: cuelint
+cuelint: cuefmt
 	@test -z "$$(git status -s . | grep -e "^ M"  | grep .cue | cut -d ' ' -f3 | tee /dev/stderr)"
 
+.PHONY: lint
+lint: cuelint golint check-buildkit-version
+
 .PHONY: check-buildkit-version
 check-buildkit-version:
 	@test \
diff --git a/dagger/store.go b/dagger/store.go
index 96f1bbbb..3847d362 100644
--- a/dagger/store.go
+++ b/dagger/store.go
@@ -103,7 +103,7 @@ func (s *Store) syncDeployment(r *DeploymentState) error {
 		return err
 	}
 
-	if err := os.WriteFile(p, data, 0644); err != nil {
+	if err := os.WriteFile(p, data, 0600); err != nil {
 		return err
 	}