diff --git a/.golangci.yaml b/.golangci.yaml
index b1e5385..75cbd1c 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -37,10 +37,8 @@ linters-settings:
     forbid:
       # ioutil package has been deprecated: https://github.com/golang/go/issues/42026
       - ^ioutil\..*$
-      # Using http.DefaultServeMux is discouraged because it's a global variable
-      # that some packages silently and magically add handlers to (esp. net/http/pprof).
-      # Applications wishing to use http.ServeMux should obtain local instances
-      # through http.NewServeMux() instead of using the global default instance.
+      # Using http.DefaultServeMux is discouraged because it's a global variable that some packages silently and magically add handlers to (esp. net/http/pprof).
+      # Applications wishing to use http.ServeMux should obtain local instances through http.NewServeMux() instead of using the global default instance.
       - ^http.DefaultServeMux$
       - ^http.Handle(?:Func)?$
   gocritic:
@@ -73,9 +71,7 @@ linters-settings:
     local-prefixes: github.com/sapcc/go-bits
   gosec:
     excludes:
-      # gosec wants us to set a short ReadHeaderTimeout to avoid Slowloris attacks,
-      # but doing so would expose us to Keep-Alive race conditions.
-      # See: https://iximiuz.com/en/posts/reverse-proxy-http-keep-alive-and-502s/
+      # gosec wants us to set a short ReadHeaderTimeout to avoid Slowloris attacks, but doing so would expose us to Keep-Alive race conditions (see https://iximiuz.com/en/posts/reverse-proxy-http-keep-alive-and-502s/)
       - G112
       # created file permissions are restricted by umask if necessary
       - G306