diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index c98226b..2e60f6a 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -45,6 +45,10 @@ jobs:
       - name: go vet
         run: go vet ./...
 
+      - name: Ensure base ref is available for lint
+        # golangci-lint's new-from-merge-base needs origin/master present.
+        run: git fetch --no-tags origin master
+
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v6
         with:
diff --git a/.golangci.yml b/.golangci.yml
index 2f16761..df7ead6 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,5 +1,4 @@
 # golangci-lint v2 configuration.
-# Baseline, low-noise gate for PRs. Tighten over time as the codebase is cleaned up.
 version: "2"
 
 linters:
@@ -9,3 +8,11 @@ linters:
 formatters:
   enable:
     - gofmt
+
+issues:
+  # Only report issues introduced since the merge-base with the target branch.
+  # The legacy kernel wrapper carries pre-existing findings (unchecked
+  # `defer Close()`, dead helpers) and is slated to move (#108) / be removed
+  # post-logos-delivery#3851 — gating it now would drown real signal. New code
+  # (e.g. the messaging package) gets the full linter set.
+  new-from-merge-base: origin/master