diff --git a/.golangci.yml b/.golangci.yml
index f34797c85b..b9b87a40f0 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -19,6 +19,7 @@ linters:
   default: none
   enable:
     - depguard
+    - forbidigo
     - gosec
     - gocritic
     - nilnesserr
@@ -32,6 +33,20 @@ linters:
     - errcheck
     - staticcheck
   settings:
+    forbidigo:
+      forbid:
+        - pattern: "^print$"
+          msg: "use structured logging instead of built-in print"
+        - pattern: "^println$"
+          msg: "use structured logging instead of built-in println"
+        # slog: forbid non-context methods
+        - pattern: "^slog\\.(Debug|Info|Warn|Error)"
+          pkg: "^log/slog$"
+          msg: "Don't use the default logger. Use a specific *slog.Logger instance."
+        - pattern: "slog\\.Logger\\.(Debug|Info|Warn|Error)$"
+          msg: "use DebugContext/InfoContext/WarnContext/ErrorContext instead"
+      analyze-types: true
+
     depguard:
       rules:
         main:
@@ -218,6 +233,13 @@ linters:
       - path: server/datastore/mysql/migrations/[^/]+/[^/]+\.go
         linters:
           - depguard
+      # Legacy CLI tools that use slog without context
+      - path: cmd/cpe/generate.go
+        linters:
+          - forbidigo
+      - path: tools/mdm/migration/micromdm/main.go
+        linters:
+          - forbidigo
       # cmd gosec exclusions https://github.com/fleetdm/fleet/issues/4451
       - path: cmd/osquery-perf/agent.go
         linters: