diff --git a/.github/workflows/backend-ci.yml b/.github/workflows/backend-ci.yml
index 4fd22aff..ff991154 100644
--- a/.github/workflows/backend-ci.yml
+++ b/.github/workflows/backend-ci.yml
@@ -43,5 +43,5 @@ jobs:
         uses: golangci/golangci-lint-action@v9
         with:
           version: v2.7
-          args: --timeout=5m
+          args: --timeout=30m
           working-directory: backend
\ No newline at end of file
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 7c59b074..cc2631ec 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -29,12 +29,6 @@ jobs:
         run: |
           go install golang.org/x/vuln/cmd/govulncheck@latest
           govulncheck ./...
-      - name: Run gosec
-        working-directory: backend
-        run: |
-          go install github.com/securego/gosec/v2/cmd/gosec@latest
-          # exclude ent/ — auto-generated ORM code, not subject to manual security review
-          gosec -conf .gosec.json -severity high -confidence high -exclude-generated -exclude-dir=ent ./...
 
   frontend-security:
     runs-on: ubuntu-latest
diff --git a/backend/.golangci.yml b/backend/.golangci.yml
index 3ec692a8..68b76751 100644
--- a/backend/.golangci.yml
+++ b/backend/.golangci.yml
@@ -5,6 +5,7 @@ linters:
   enable:
     - depguard
     - errcheck
+    - gosec
     - govet
     - ineffassign
     - staticcheck
@@ -42,6 +43,22 @@ linters:
               desc: "handler must not import gorm"
             - pkg: github.com/redis/go-redis/v9
               desc: "handler must not import redis"
+    gosec:
+      excludes:
+        - G101
+        - G103
+        - G104
+        - G109
+        - G115
+        - G201
+        - G202
+        - G301
+        - G302
+        - G304
+        - G306
+        - G404
+      severity: high
+      confidence: high
     errcheck:
       # Report about not checking of errors in type assertions: `a := b.(MyStruct)`.
       # Such cases aren't reported by default.
diff --git a/backend/.gosec.json b/backend/.gosec.json
deleted file mode 100644
index 7a8ccb6a..00000000
--- a/backend/.gosec.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "global": {
-    "exclude": "G704,G101,G103,G104,G109,G115,G201,G202,G301,G302,G304,G306,G404"
-  }
-}