diff --git a/CHANGELOG.md b/CHANGELOG.md
index df6061e6..5d46c50a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -26,6 +26,15 @@ exact tag (`ghcr.io/calnode/calnode:0.1.0`) if you need stability between upgrad
   key. Each invite gets a private reply address, and an answer only counts when Resend
   verified it came from that booking's booker.
 
+### Security
+- **Go toolchain 1.26.9, and the Docker image builds with Go 1.27.2.** Both close 12
+  published Go standard-library vulnerabilities that `govulncheck` reports as reachable
+  from Calnode: GO-2026-6599 and GO-2026-6600 (`html/template`); GO-2026-6603,
+  GO-2026-6610, GO-2026-6611, GO-2026-6612 and GO-2026-6617 (HTTP/2 in `net/http`);
+  GO-2026-6605, GO-2026-6609 and GO-2026-6613 (`net/http`); GO-2026-6607 (`crypto/tls`);
+  and GO-2026-6608 (`net/textproto`). `go.mod` moves from `toolchain go1.26.6` and the
+  builder image from `golang:1.27.1-alpine`. No code or dependency change.
+
 ## [0.10.1] - 2026-09-29
 
 ### Added
diff --git a/Dockerfile b/Dockerfile
index ddcf81c2..f5318f7d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -16,7 +16,7 @@ COPY frontend/ .
 RUN pnpm build
 
 # ── Go build stage ─────────────────────────────────────────────────────────────
-FROM golang:1.27.1-alpine AS builder
+FROM golang:1.27.2-alpine AS builder
 
 RUN apk add --no-cache ca-certificates wget
 
diff --git a/go.mod b/go.mod
index 19cefd72..ef47e3fc 100644
--- a/go.mod
+++ b/go.mod
@@ -2,7 +2,7 @@ module github.com/calnode/calnode
 
 go 1.26.0
 
-toolchain go1.26.6
+toolchain go1.26.9
 
 require (
 	github.com/disintegration/imaging v1.6.2