diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index ab8c4e2538a..58e7828bdd9 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -41,7 +41,7 @@ jobs:
           sudo apt -qy install libseccomp-dev
       - uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.6
+          version: v2.9
           skip-cache: true
       # Extra linters, only checking new code from a pull request to main.
       - name: lint-extra
diff --git a/.golangci.yml b/.golangci.yml
index c5ed654c715..d239551ddda 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -16,6 +16,7 @@ linters:
     - errorlint
     - forbidigo
     - nolintlint
+    - prealloc
     - unconvert
     - unparam
   settings:
@@ -46,9 +47,10 @@ linters:
       analyze-types: true
   exclusions:
     rules:
-      # forbidigo lints are only relevant for main code.
+      # forbidigo and prealloc lints are only relevant for main code.
       - path: '(.+)_test\.go'
         linters:
           - forbidigo
+          - prealloc
     presets:
       - std-error-handling
diff --git a/events.go b/events.go
index 53e8c028f72..28d324984dc 100644
--- a/events.go
+++ b/events.go
@@ -199,7 +199,7 @@ func convertMemoryEntry(c cgroups.MemoryData) types.MemoryEntry {
 }
 
 func convertBlkioEntry(c []cgroups.BlkioStatEntry) []types.BlkioEntry {
-	var out []types.BlkioEntry
+	out := make([]types.BlkioEntry, 0, len(c))
 	for _, e := range c {
 		out = append(out, types.BlkioEntry(e))
 	}
diff --git a/libcontainer/internal/userns/usernsfd_linux.go b/libcontainer/internal/userns/usernsfd_linux.go
index a1151a3fb35..35ac373cd45 100644
--- a/libcontainer/internal/userns/usernsfd_linux.go
+++ b/libcontainer/internal/userns/usernsfd_linux.go
@@ -41,10 +41,11 @@ func (m Mapping) toSys() (uids, gids []syscall.SysProcIDMap) {
 // the uid and gid mappings (because the order doesn't matter to the kernel).
 // The set of userns handles is indexed using this ID.
 func (m Mapping) id() string {
-	var uids, gids []string
+	uids := make([]string, 0, len(m.UIDMappings))
 	for _, idmap := range m.UIDMappings {
 		uids = append(uids, fmt.Sprintf("%d:%d:%d", idmap.ContainerID, idmap.HostID, idmap.Size))
 	}
+	gids := make([]string, 0, len(m.GIDMappings))
 	for _, idmap := range m.GIDMappings {
 		gids = append(gids, fmt.Sprintf("%d:%d:%d", idmap.ContainerID, idmap.HostID, idmap.Size))
 	}
diff --git a/libcontainer/specconv/spec_linux.go b/libcontainer/specconv/spec_linux.go
index 162195d8e4e..c90f68fbd69 100644
--- a/libcontainer/specconv/spec_linux.go
+++ b/libcontainer/specconv/spec_linux.go
@@ -174,7 +174,7 @@ func initMaps() {
 // Used by `runc features`.
 func KnownNamespaces() []string {
 	initMaps()
-	var res []string
+	var res []string //nolint:prealloc
 	for k := range namespaceMapping {
 		res = append(res, string(k))
 	}
@@ -186,7 +186,7 @@ func KnownNamespaces() []string {
 // Used by `runc features`.
 func KnownMountOptions() []string {
 	initMaps()
-	var res []string
+	var res []string //nolint:prealloc
 	for k := range mountFlags {
 		res = append(res, k)
 	}