diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 44c8afa..e385cc7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,7 +38,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           # Keep CI on the patched standard library release reported by govulncheck.
-          go-version: '1.26.6'
+          go-version: '1.26.9'
           cache: true
 
       - name: Check formatting
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index fb73fe1..e2e142b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -37,18 +37,18 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: '1.26.6'
+          go-version: '1.26.9'
           cache: true
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.38.2
+        uses: github/codeql-action/init@v4.38.3
         with:
           languages: go
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4.38.2
+        uses: github/codeql-action/autobuild@v4.38.3
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@v4.38.2
+        uses: github/codeql-action/analyze@v4.38.3
         with:
           category: /language:go
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index d42864d..8388db2 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -13,7 +13,8 @@ review and maintain.
 
 ## Local checks
 
-GoBot currently targets Go `1.26.6` or newer. Before opening a pull request:
+GoBot targets Go `1.26.9+` (or `1.27.2+` for the Go 1.27 series).
+Before opening a pull request:
 
 ```sh
 go test ./...
diff --git a/Dockerfile b/Dockerfile
index 7969e51..f0f6f6a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM golang:1.26.6-alpine AS builder
+FROM golang:1.26.9-alpine AS builder
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN --mount=type=cache,target=/go/pkg/mod \
diff --git a/README.md b/README.md
index 479a9bd..d5e37e6 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@
 
 [![GoBot CI](https://github.com/variablenix/GoBot/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/variablenix/GoBot/actions/workflows/ci.yml)
 [![CodeQL](https://github.com/variablenix/GoBot/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/variablenix/GoBot/actions/workflows/codeql.yml)
-[![Go 1.26.6+](https://img.shields.io/badge/Go-1.26.6%2B-00ADD8?logo=go&logoColor=white)](go.mod)
+[![Go 1.26.9+](https://img.shields.io/badge/Go-1.26.9%2B-00ADD8?logo=go&logoColor=white)](go.mod)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 
 GoBot is an extensible Go IRC bot for long-running use on one or more IRC
@@ -53,7 +53,7 @@ are also persisted so they survive restarts.
 
 Requirements:
 
-- Go `1.26.6+` or a newer supported release
+- Go `1.26.9+` (or `1.27.2+` when using the Go 1.27 series)
 - IRC network access
 - a writable data directory
 
diff --git a/docs/deployment.md b/docs/deployment.md
index c1fd13a..e5333de 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -5,7 +5,7 @@ systemd service, and using Docker.
 
 ## Requirements
 
-- Go `1.26.6+` or a newer supported release
+- Go `1.26.9+` (or `1.27.2+` when using the Go 1.27 series)
 - a writable filesystem for the BoltDB database
 - network access to the IRC servers
 - optionally, Docker and Docker Compose
@@ -42,6 +42,11 @@ make test
 Configuration-only changes require a restart. Code changes require a new
 build before restarting.
 
+Use a patched Go toolchain when rebuilding: Go 1.26.9 and 1.27.2 contain
+standard-library security fixes that are not supplied by updating modules
+alone. An existing binary retains its old standard library until it is rebuilt
+and the service is restarted. CI and the Docker builder use Go 1.26.9.
+
 ## First-run workflow
 
 There is no setup wizard yet. GoBot is configuration-first:
diff --git a/go.mod b/go.mod
index 1fd5989..0f511db 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/variablenix/GoBot
 
-go 1.26.6
+go 1.26.9
 
 require (
 	github.com/agnivade/levenshtein v1.2.1
@@ -8,7 +8,7 @@ require (
 	github.com/spf13/viper v1.21.0
 	go.etcd.io/bbolt v1.5.0
 	go.uber.org/zap v1.28.0
-	golang.org/x/net v0.59.0
+	golang.org/x/net v0.60.0
 	golang.org/x/text v0.42.0
 	gopkg.in/irc.v3 v3.1.4
 )
diff --git a/go.sum b/go.sum
index 0abfc78..96b259a 100644
--- a/go.sum
+++ b/go.sum
@@ -71,8 +71,8 @@ go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo=
 go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
-golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
 golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=