diff --git a/cmd/commandfuncs.go b/cmd/commandfuncs.go
index 56cde4758..c27fdc634 100644
--- a/cmd/commandfuncs.go
+++ b/cmd/commandfuncs.go
@@ -836,7 +836,7 @@ func AdminAPIRequest(adminAddr, method, uri string, headers http.Header, body io
 		},
 	}
 
-	resp, err := client.Do(req) //nolint:gosec // the only SSRF here would be self-sabatoge I think
+	resp, err := client.Do(req) //nolint:gosec // the only SSRF here would be self-sabotage I think
 	if err != nil {
 		return nil, fmt.Errorf("performing request: %v", err)
 	}
diff --git a/modules/caddyhttp/staticresp.go b/modules/caddyhttp/staticresp.go
index 439ba4f1f..daf774f22 100644
--- a/modules/caddyhttp/staticresp.go
+++ b/modules/caddyhttp/staticresp.go
@@ -246,7 +246,7 @@ func (s StaticResponse) ServeHTTP(w http.ResponseWriter, r *http.Request, next H
 
 	// write response body
 	if statusCode != http.StatusEarlyHints && body != "" {
-		fmt.Fprint(w, body) //nolint:gosec // no XSS unless you sabatoge your own config
+		fmt.Fprint(w, body) //nolint:gosec // no XSS unless you sabotage your own config
 	}
 
 	// continue handling after Early Hints as they are not the final response