diff --git a/README.md b/README.md
index 889a8f9..b9b3e05 100644
--- a/README.md
+++ b/README.md
@@ -52,7 +52,7 @@ Input and wire fields have package-owned per-field caps: passwords and party IDs
 
 ## Validation
 
-Install the repository-pinned Task 3.53.1 with `scripts/go-tool.sh install task` using Go 1.27.1, and put `$(go env GOPATH)/bin` (or your configured `GOBIN`) on `PATH`. Confirm the selected tools with `go version` and `task --version`.
+Install the repository-pinned Task 3.53.1 with `scripts/go-tool.sh install task` using Go 1.27.2, and put `$(go env GOPATH)/bin` (or your configured `GOBIN`) on `PATH`. Confirm the selected tools with `go version` and `task --version`.
 
 This repository uses `Taskfile.yml` as the local validation facade:
 
diff --git a/go.mod b/go.mod
index 43b4223..9ee4bf4 100644
--- a/go.mod
+++ b/go.mod
@@ -2,7 +2,7 @@ module github.com/the-sarge/cpace
 
 go 1.27
 
-toolchain go1.27.1
+toolchain go1.27.2
 
 require github.com/gtank/ristretto255 v0.2.0
 
diff --git a/scripts/go-tool-versions.sh b/scripts/go-tool-versions.sh
index f2200d4..70f1a2f 100644
--- a/scripts/go-tool-versions.sh
+++ b/scripts/go-tool-versions.sh
@@ -12,11 +12,11 @@ cpace_go_tool_resolve() {
       ;;
     gosec)
       cpace_go_tool_module=github.com/securego/gosec/v2/cmd/gosec
-      cpace_go_tool_version=v2.26.1
+      cpace_go_tool_version=v2.29.0
       ;;
     govulncheck)
       cpace_go_tool_module=golang.org/x/vuln/cmd/govulncheck
-      cpace_go_tool_version=v1.3.0
+      cpace_go_tool_version=v1.9.0
       ;;
     staticcheck)
       cpace_go_tool_module=honnef.co/go/tools/cmd/staticcheck
diff --git a/tools/evidencebaseline/go.mod b/tools/evidencebaseline/go.mod
index 7eea1ce..a66d192 100644
--- a/tools/evidencebaseline/go.mod
+++ b/tools/evidencebaseline/go.mod
@@ -2,4 +2,4 @@ module github.com/the-sarge/cpace/tools/evidencebaseline
 
 go 1.27
 
-toolchain go1.27.1
+toolchain go1.27.2
diff --git a/tools/releasepolicy/go.mod b/tools/releasepolicy/go.mod
index b9e9d33..2f8c767 100644
--- a/tools/releasepolicy/go.mod
+++ b/tools/releasepolicy/go.mod
@@ -2,6 +2,6 @@ module github.com/the-sarge/cpace/tools/releasepolicy
 
 go 1.27
 
-toolchain go1.27.1
+toolchain go1.27.2
 
 require gopkg.in/yaml.v3 v3.0.1