diff --git a/.gds/bundle.lock.yaml b/.gds/bundle.lock.yaml
index 41daeeb..644b6ae 100644
--- a/.gds/bundle.lock.yaml
+++ b/.gds/bundle.lock.yaml
@@ -5,14 +5,14 @@ bundle:
   version: "0.4.0-dev"
   release_sequence: 0
   channel: "development"
-  source_tree_digest: "sha256:bf7a257336f1c018b8bd7011867436bd8a8c4475a6d310e3582d8c98f082e233"
-  digest: "sha256:9bfc33820323e40e0311de3ae9e275a7772f5f0d2d9be22234058f9bf13c6aa1"
+  source_tree_digest: "sha256:4983ada020ddf83bc417830cd692d0abc0c804bb00cd4da7e0bd3539699d3c6f"
+  digest: "sha256:3198ff9cf30f09b88230e9e5772e658760d1bce3f374914ba8cf80e0ca4b2c22"
 
 projection:
-  input_digest: "sha256:448c905f2539e97fbbdb4d2b1c2705cc6877af4e4294e2cd83aeb5ea21fa1df8"
-  output_digest: "sha256:436aec94157f56c95c8fca9474213778e50ff7d0202f61441f5c722aed6c5e3b"
+  input_digest: "sha256:70a05ee495fb5fc571db71d52f16739575e468def2c5bf13781438806b882c84"
+  output_digest: "sha256:58f8443e4b6dced0eb87255b17a207039b1bcc8dd86569c4cbfb0a14faa2ab37"
   files:
     - path: ".gds/compiled-policy.json"
       digest: "sha256:78d09606bb4168d74bce1f50ab62b46a7ded34652c6b23af1badfd26dd060e94"
     - path: ".github/workflows/gds-ci.yml"
-      digest: "sha256:c7ff431fead227cf4c2fef12ba937a816fc07380f28366e7ced6a79790ddb0e2"
+      digest: "sha256:57f868a1172afeaf4844d95fb9b0eece46bf07c3d3101cd9158f82e0692d3a37"
diff --git a/.gds/repository.yaml b/.gds/repository.yaml
index d0908b2..10eb547 100644
--- a/.gds/repository.yaml
+++ b/.gds/repository.yaml
@@ -76,7 +76,7 @@ git:
 
 ci:
   profile: "go"
-  go_version: "1.26.5"
+  go_version: "1.26.7"
   build_command: "go build -trimpath ./core/cmd/gds"
   test_command: "go test ./..."
   timeout_minutes: 30
@@ -107,8 +107,8 @@ verification:
     - "test"
     - "build"
   required_contexts:
-    - "GDS fast / go (1.26.5)"
-    - "GDS PR required / go (1.26.5)"
+    - "GDS fast / go (1.26.7)"
+    - "GDS PR required / go (1.26.7)"
 
 agent:
   context_profile: "project-default"
diff --git a/.github/rulesets/branch-main.json b/.github/rulesets/branch-main.json
index aec8246..ddbf71a 100644
--- a/.github/rulesets/branch-main.json
+++ b/.github/rulesets/branch-main.json
@@ -46,10 +46,10 @@
         "do_not_enforce_on_create": false,
         "required_status_checks": [
           {
-            "context": "GDS fast / go (1.26.5)"
+            "context": "GDS fast / go (1.26.7)"
           },
           {
-            "context": "GDS PR required / go (1.26.5)"
+            "context": "GDS PR required / go (1.26.7)"
           }
         ]
       }
diff --git a/.github/workflows/gds-ci.yml b/.github/workflows/gds-ci.yml
index e0da67b..76b4dff 100644
--- a/.github/workflows/gds-ci.yml
+++ b/.github/workflows/gds-ci.yml
@@ -1,9 +1,9 @@
 # GENERATED FILE - DO NOT EDIT DIRECTLY
 # generator: gds
 # bundle: 0.4.0-dev
-# source-tree-digest: sha256:bf7a257336f1c018b8bd7011867436bd8a8c4475a6d310e3582d8c98f082e233
-# input-digest: sha256:448c905f2539e97fbbdb4d2b1c2705cc6877af4e4294e2cd83aeb5ea21fa1df8
-# output-digest: sha256:c268237f2cffde69b7868265ba6ac331048c98036fb9030ee7b7b3a208a9ad49
+# source-tree-digest: sha256:4983ada020ddf83bc417830cd692d0abc0c804bb00cd4da7e0bd3539699d3c6f
+# input-digest: sha256:70a05ee495fb5fc571db71d52f16739575e468def2c5bf13781438806b882c84
+# output-digest: sha256:01fb4854784be9e4564bcc84e70786484b370879be5e5ab1dd49f8b73ea2dea4
 # edit-source:
 #   - .gds/repository.yaml
 #   - policies/base/repository-default.yaml
@@ -41,7 +41,7 @@ jobs:
       cache: true
 
       runner: "ubuntu-latest"
-      go_version: "1.26.5"
+      go_version: "1.26.7"
       test_command: "go test ./..."
       timeout_minutes: 30
   pr-required:
@@ -58,7 +58,7 @@ jobs:
       fetch_depth: 0
       cache: true
       runner: "ubuntu-latest"
-      go_version: "1.26.5"
+      go_version: "1.26.7"
       build_command: "go build -trimpath ./core/cmd/gds"
       test_command: "go test ./... && python3 -m pip install --quiet --require-hashes -r requirements/test.txt && python3 -m pytest"
       timeout_minutes: 30
diff --git a/.github/workflows/release-bundle.yml b/.github/workflows/release-bundle.yml
index 453b7cd..d9bf9d3 100644
--- a/.github/workflows/release-bundle.yml
+++ b/.github/workflows/release-bundle.yml
@@ -68,7 +68,7 @@ jobs:
     permissions:
       contents: read
     env:
-      GOTOOLCHAIN: go1.26.5
+      GOTOOLCHAIN: go1.26.7
       VERSION: ${{ inputs.version }}
       RELEASE_SEQUENCE: ${{ inputs.release_sequence }}
       CHANNEL: ${{ inputs.channel }}
@@ -86,7 +86,7 @@ jobs:
       - name: Install exact Go toolchain
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.5"
+          go-version: "1.26.7"
           cache: true
 
       - name: Run release gates
diff --git a/README.md b/README.md
index bf106d6..3dbf753 100644
--- a/README.md
+++ b/README.md
@@ -37,8 +37,8 @@ topology. Their migration evidence is retained in `docs/migration/`.
 ## Local development
 
 ```bash
-GOTOOLCHAIN=go1.26.5 go build -trimpath -o /tmp/gds ./core/cmd/gds
-GOTOOLCHAIN=go1.26.5 go build -trimpath -o /tmp/gds-codex-runtime-driver \
+GOTOOLCHAIN=go1.26.7 go build -trimpath -o /tmp/gds ./core/cmd/gds
+GOTOOLCHAIN=go1.26.7 go build -trimpath -o /tmp/gds-codex-runtime-driver \
   ./core/cmd/gds-codex-runtime-driver
 /tmp/gds --json context
 /tmp/gds --json status
diff --git a/core/README.md b/core/README.md
index 4047a65..11ef4b7 100644
--- a/core/README.md
+++ b/core/README.md
@@ -132,7 +132,7 @@ Root pytest discovery is limited by `pytest.ini` to `tests/`; it never collects
 tests from independent workspace repositories. The full Go validator
 runs module integrity, vet, unit/integration/race tests, schemas, and CGo-free
 cross-builds for macOS and Linux on arm64 and amd64. It requires the exact
-source-registered release builder (`go1.26.5`). Quick validation may run on an
+source-registered release builder (`go1.26.7`). Quick validation may run on an
 older local toolchain but leaves release evidence `NOT_PROVEN`.
 
 `gds-assurance` is a separate release-gate binary. It requires a clean source
diff --git a/core/anchor/relationship_splice_test.go b/core/anchor/relationship_splice_test.go
index 2dac74a..19f7d38 100644
--- a/core/anchor/relationship_splice_test.go
+++ b/core/anchor/relationship_splice_test.go
@@ -54,7 +54,7 @@ git:
 
 ci:
   profile: "go"
-  go_version: "1.26.5"
+  go_version: "1.26.7"
   build_command: "go build ./..."
   test_command: "go test ./..."
   timeout_minutes: 30
diff --git a/core/cli/root_test.go b/core/cli/root_test.go
index 254e3f7..7752c89 100644
--- a/core/cli/root_test.go
+++ b/core/cli/root_test.go
@@ -58,7 +58,7 @@ func TestSourceStatusReportsControlPlaneSourcesCurrent(t *testing.T) {
 		t.Fatalf("exit = %d, stderr = %q, envelope = %#v", exitCode, stderr, envelope)
 	}
 	data, ok := envelope.Data.(map[string]any)
-	if !ok || data["count"] != float64(59) {
+	if !ok || data["count"] != float64(60) {
 		t.Fatalf("data = %#v", envelope.Data)
 	}
 	immutableSource := false
diff --git a/core/domain/repository.go b/core/domain/repository.go
index 88a4fd9..224936c 100644
--- a/core/domain/repository.go
+++ b/core/domain/repository.go
@@ -96,7 +96,7 @@ type VerificationPolicy struct {
 	// protected branch enforces, as the anchor claims them.
 	//
 	// It is a separate vocabulary from Commands on purpose. A required context
-	// is a check run name -- "govulncheck", "ci-gate", "GDS fast / go (1.26.5)"
+	// is a check run name -- "govulncheck", "ci-gate", "GDS fast / go (1.26.7)"
 	// -- and not a command, so no derivation connects the two. Stating the set
 	// is what makes it comparable with what the provider actually enforces; the
 	// alternative, inferring a gate from the commands beside it, would produce a
diff --git a/core/providers/github/ruleset_stage_test.go b/core/providers/github/ruleset_stage_test.go
index 4f81ffa..21f5790 100644
--- a/core/providers/github/ruleset_stage_test.go
+++ b/core/providers/github/ruleset_stage_test.go
@@ -38,7 +38,7 @@ func rulesetStageTestRepository(t *testing.T, server *httptest.Server) *Reposito
 func ownedRulesetRule() RulesetRule {
 	return RulesetRule{
 		Type:                 "required_status_checks",
-		RequiredStatusChecks: []RequiredStatusCheck{{Context: "GDS fast / go (1.26.5)"}},
+		RequiredStatusChecks: []RequiredStatusCheck{{Context: "GDS fast / go (1.26.7)"}},
 	}
 }
 
diff --git a/core/providers/github/testdata/live-branch-ruleset.json b/core/providers/github/testdata/live-branch-ruleset.json
index d5c7b26..7199afa 100644
--- a/core/providers/github/testdata/live-branch-ruleset.json
+++ b/core/providers/github/testdata/live-branch-ruleset.json
@@ -48,10 +48,10 @@
         "do_not_enforce_on_create": false,
         "required_status_checks": [
           {
-            "context": "GDS fast / go (1.26.5)"
+            "context": "GDS fast / go (1.26.7)"
           },
           {
-            "context": "GDS PR required / go (1.26.5)"
+            "context": "GDS PR required / go (1.26.7)"
           },
           {
             "context": "cross-platform smoke / smoke (ubuntu-latest)"
diff --git a/core/releasebuilder/builder.go b/core/releasebuilder/builder.go
index 5cb06eb..3b0a03a 100644
--- a/core/releasebuilder/builder.go
+++ b/core/releasebuilder/builder.go
@@ -539,7 +539,7 @@ func releaseEnvironment(goos string, goarch string, cache string, home string) [
 		"CGO_ENABLED=0", "GOAMD64=v1", "GOARM64=v8.0", "GOENV=off",
 		"GOCACHE="+cache, "GOMODCACHE="+filepath.Join(home, "go", "pkg", "mod"),
 		"GOPROXY=https://proxy.golang.org,direct", "GOSUMDB=sum.golang.org",
-		"GOTELEMETRY=off", "GOTOOLCHAIN=go1.26.5", "GOWORK=off",
+		"GOTELEMETRY=off", "GOTOOLCHAIN=go1.26.7", "GOWORK=off",
 		"GIT_CONFIG_GLOBAL=/dev/null", "GIT_CONFIG_NOSYSTEM=1", "GIT_TERMINAL_PROMPT=0",
 		"HOME="+home, "LANG=C", "LC_ALL=C", "TZ=UTC",
 	)
diff --git a/core/releasebuilder/types.go b/core/releasebuilder/types.go
index 469ebb4..10f741c 100644
--- a/core/releasebuilder/types.go
+++ b/core/releasebuilder/types.go
@@ -8,7 +8,7 @@ import (
 	"github.com/NDDev-OpenNetwork/github-device-sync/core/bundle"
 )
 
-const ExpectedGoVersion = "go1.26.5"
+const ExpectedGoVersion = "go1.26.7"
 
 type Target = bundle.ReleaseTarget
 
diff --git a/docs/adr/0014-go-production-core.md b/docs/adr/0014-go-production-core.md
index 16256e4..a4caa44 100644
--- a/docs/adr/0014-go-production-core.md
+++ b/docs/adr/0014-go-production-core.md
@@ -24,7 +24,7 @@ Implement the production `gds` CLI and portable control-plane core in Go.
 
 - Set the module language baseline to Go 1.25 so the two currently supported
   Go release families can build it. Pin the release builder separately to the
-  exact verified toolchain, initially Go 1.26.5. A builder older than Go 1.26.5
+  exact verified toolchain, currently Go 1.26.7. A builder older than Go 1.26.7
   is release-blocked; accepting a later builder requires a source-register
   update and the same release gates.
 - Build release artifacts with `CGO_ENABLED=0` for macOS and Linux on amd64 and
diff --git a/docs/contracts/bundle-release-v1.md b/docs/contracts/bundle-release-v1.md
index 90c55aa..2342728 100644
--- a/docs/contracts/bundle-release-v1.md
+++ b/docs/contracts/bundle-release-v1.md
@@ -27,7 +27,7 @@ markers, and unexpected executable content fail closed.
 ## Reproducible release unit
 
 `gds-release-builder` requires a fully tracked clean Git worktree, exact source
-ref resolving to `HEAD`, Go `1.26.5`, read-only modules, CGO disabled, portable
+ref resolving to `HEAD`, Go `1.26.7`, read-only modules, CGO disabled, portable
 CPU baselines, and an isolated build environment without ambient credentials or
 Git configuration. Stable and frozen channels require
 `refs/tags/gds-v<version>`; canary accepts only `refs/heads/main` or that exact
diff --git a/docs/migration/phase-03-security-review.md b/docs/migration/phase-03-security-review.md
index 3344c31..74e0ba8 100644
--- a/docs/migration/phase-03-security-review.md
+++ b/docs/migration/phase-03-security-review.md
@@ -1,5 +1,15 @@
 # Phase 03 security review
 
+## 2026-08-28 release-builder refresh
+
+The stable 0.7.0 review reran `govulncheck v1.6.0` against the complete module.
+Go 1.26.5 exposed reachable standard-library paths for GO-2026-6218,
+GO-2026-6090, GO-2026-6089, GO-2026-5972, and GO-2026-5026. The exact release
+builder and minimum security floor are therefore Go 1.26.7. Full, PR-required,
+and release validation now execute the pinned vulnerability scanner instead of
+relying on a historical evidence record. Device bootstrap verifies the official
+archive SHA-256 before extracting the toolchain.
+
 Status: implementation accepted for development; release evidence blocked.
 
 Date: 2026-07-11.
diff --git a/docs/runbooks/bootstrap-device.md b/docs/runbooks/bootstrap-device.md
index 0261753..de0e017 100644
--- a/docs/runbooks/bootstrap-device.md
+++ b/docs/runbooks/bootstrap-device.md
@@ -61,7 +61,7 @@ Verifies the host OS/arch, the control-plane root, the bootstrap submodule, and
 
 ### Phase 1 — seed Go + build gds
 
-Installs the pinned Go toolchain (`go1.26.5`, the security floor) into
+Installs the pinned Go toolchain (`go1.26.7`, the security floor) into
 `~/sdk/go<version>` (the `GOTOOLCHAIN` pattern) and builds the `gds` CLI from
 the control-plane source into `~/.local/bin/gds`. The source build carries the
 nearest release version plus the exact source commit (for example,
diff --git a/docs/runbooks/controller-operations.md b/docs/runbooks/controller-operations.md
index 0c03202..2e82f2d 100644
--- a/docs/runbooks/controller-operations.md
+++ b/docs/runbooks/controller-operations.md
@@ -23,10 +23,10 @@ this document.
 ## Build and local validation
 
 ```bash
-GOTOOLCHAIN=go1.26.5 go build -trimpath -o /tmp/gds-controller ./core/cmd/gds-controller
+GOTOOLCHAIN=go1.26.7 go build -trimpath -o /tmp/gds-controller ./core/cmd/gds-controller
 /tmp/gds-controller --version
 python3 scripts/validate_gds_schemas.py --root . --json
-GOTOOLCHAIN=go1.26.5 go test ./core/controller ./core/webhooks ./core/state -race -count=1
+GOTOOLCHAIN=go1.26.7 go test ./core/controller ./core/webhooks ./core/state -race -count=1
 ```
 
 ## Start
diff --git a/docs/runbooks/release-promotion-policy.md b/docs/runbooks/release-promotion-policy.md
index 0b968e3..2dc2c92 100644
--- a/docs/runbooks/release-promotion-policy.md
+++ b/docs/runbooks/release-promotion-policy.md
@@ -38,7 +38,7 @@ Authority: `docs/migration/gds-completion-plan.md`. Release mechanics:
 `release.mode: bundle` (`.gds/repository.yaml`). A release identity is coherent
 only when all of these agree and are recorded together:
 
-- source commit (fully tracked clean worktree, reproducible `go1.26.5` build);
+- source commit (fully tracked clean worktree, reproducible `go1.26.7` build);
 - monotonic release sequence (the anti-rollback floor);
 - artifact digests over the exact six-file release directory;
 - SPDX SBOM and Sigstore provenance in the offline evidence directory;
diff --git a/docs/runbooks/seed-clean-device.md b/docs/runbooks/seed-clean-device.md
index 373b47e..09dfa41 100644
--- a/docs/runbooks/seed-clean-device.md
+++ b/docs/runbooks/seed-clean-device.md
@@ -142,7 +142,7 @@ Use exactly one of the two mechanisms, in trust order. Both end with an absolute
 
    ```bash
    SEED_VERSION=0.1.0        # >= the target release manifest's minimum_cli_version
-   GOTOOLCHAIN=go1.26.5 go build -trimpath \
+   GOTOOLCHAIN=go1.26.7 go build -trimpath \
      -ldflags "-X github.com/NDDev-OpenNetwork/github-device-sync/core/cli.Version=$SEED_VERSION" \
      -o gds ./core/cmd/gds
    shasum -a 256 gds          # record; this is the seed digest
diff --git a/docs/source-register/README.md b/docs/source-register/README.md
index afda24b..81b16b0 100644
--- a/docs/source-register/README.md
+++ b/docs/source-register/README.md
@@ -10,7 +10,7 @@ the source-maintenance phase. Until then, missing content digests are
 `NOT_PROVEN`, not implied verification.
 
 The currently installed `go1.26.4` toolchain is explicitly development-only.
-The register pins `go1.26.5` as the initial release builder because official
+The register pins `go1.26.7` as the current release builder because official
 Go advisories identify security fixes in that release. The full Go validation
 gate fails closed until the exact registered builder is available.
 
diff --git a/docs/source-register/sources.yaml b/docs/source-register/sources.yaml
index ba7a56f..60e242d 100644
--- a/docs/source-register/sources.yaml
+++ b/docs/source-register/sources.yaml
@@ -266,10 +266,10 @@ sources:
     authority: official
     url: https://go.dev/doc/devel/release
     volatility: medium
-    verified_at: "2026-07-12"
-    next_review: "2026-10-12"
+    verified_at: "2026-08-28"
+    next_review: "2026-09-28"
     status: current-release-builder-pinned
-    content_digest: sha256:b9beb140c44dd686007db7c147d07b13f64fc89450223e5fefce1457c6d05a86
+    content_digest: sha256:4c9ddc4b23faefa2fd1c9d97f7a175251e408591cecf58bce4a2612113f01b6e
     governs:
       - go.supported-releases
       - go.release-builder
@@ -305,6 +305,17 @@ sources:
     governs:
       - go.release-builder
       - security.transport
+  - id: go-2026-6218
+    authority: official-vulnerability-database
+    url: https://pkg.go.dev/vuln/GO-2026-6218
+    volatility: critical
+    verified_at: "2026-08-28"
+    next_review: "2026-09-28"
+    status: mitigated-by-release-builder
+    content_digest: sha256:de05a77cf80fd7d66bd2ebad31692e0b07f960c747b6b106e57e2c4ba81205e5
+    governs:
+      - go.release-builder
+      - security.path-boundary
   - id: pytest-release
     authority: official-package-index
     url: https://pypi.org/project/pytest/
diff --git a/go.mod b/go.mod
index be14467..a99b79b 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/NDDev-OpenNetwork/github-device-sync
 
-go 1.26.5
+go 1.26.7
 
 require (
 	github.com/dlclark/regexp2 v1.12.0
diff --git a/scripts/bootstrap-device.sh b/scripts/bootstrap-device.sh
index 6d99e40..76bd237 100755
--- a/scripts/bootstrap-device.sh
+++ b/scripts/bootstrap-device.sh
@@ -46,7 +46,7 @@ SCRIPT_DIR=$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 ROOT=$(CDPATH='' cd -- "$SCRIPT_DIR/.." && pwd)
 
 # Pinned toolchain (the security floor enforced by validate_go_core.sh).
-GO_VERSION="1.26.5"
+GO_VERSION="1.26.7"
 SDK_ROOT="${HOME}/sdk"
 GO_HOME="${SDK_ROOT}/go${GO_VERSION}"
 GDS_BIN_TARGET="${HOME}/.local/bin/gds"
@@ -340,14 +340,30 @@ phase_1() {
     ok "Go ${GO_VERSION} already installed at ${GO_HOME}"
   else
     [ "$APPLY" -eq 1 ] || { info "PLAN: install Go ${GO_VERSION} to ${GO_HOME}"; return 0; }
-    local goos goarch tarball
+    local goos goarch tarball expected_sha
     goos=$(uname -s | tr '[:upper:]' '[:lower:]')
     goarch=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
     tarball="go${GO_VERSION}.${goos}-${goarch}.tar.gz"
+    case "${goos}-${goarch}" in
+      linux-amd64) expected_sha="ffb5f8de10c62550dfddab66b36b57030721e0a44a3218e9e1181d7b59f121ca" ;;
+      linux-arm64) expected_sha="5a4ec883379d51ee9ce1040d5e87f8d35e20387574dd8c947feb01eabc3c1b37" ;;
+      darwin-arm64) expected_sha="020a1e8224811be75163e920bc77e0926a1390a6aeea19bdcf23f74b9d749f6d" ;;
+      *) die "no reviewed Go ${GO_VERSION} archive digest for ${goos}-${goarch}" ;;
+    esac
     local url="https://go.dev/dl/${tarball}"
     info "Downloading ${url}"
     local tmp; tmp=$(mktemp)
     wget -nv -O "$tmp" "$url"
+    local observed_sha
+    if command -v sha256sum >/dev/null 2>&1; then
+      observed_sha=$(sha256sum "$tmp" | awk '{print $1}')
+    else
+      observed_sha=$(shasum -a 256 "$tmp" | awk '{print $1}')
+    fi
+    [ "$observed_sha" = "$expected_sha" ] || {
+      rm -f -- "$tmp"
+      die "Go ${GO_VERSION} archive digest verification failed"
+    }
     rm -rf "$GO_HOME"
     mkdir -p "$GO_HOME"
     tar -xzf "$tmp" -C "$GO_HOME" --strip-components=1
diff --git a/scripts/validate_assurance.sh b/scripts/validate_assurance.sh
index 12e2016..cebc85f 100755
--- a/scripts/validate_assurance.sh
+++ b/scripts/validate_assurance.sh
@@ -17,7 +17,7 @@ BUILD_DIR=$(mktemp -d "${TMPDIR:-/tmp}/gds-assurance-gate.XXXXXX")
 trap 'rm -rf -- "$BUILD_DIR"' EXIT INT TERM
 
 cd "$ROOT"
-export GOTOOLCHAIN=${GOTOOLCHAIN:-go1.26.5}
+export GOTOOLCHAIN=${GOTOOLCHAIN:-go1.26.7}
 export GOWORK=off
 export GOFLAGS=-mod=readonly
 if [ "$RUN_TESTS" = true ]; then
diff --git a/scripts/validate_ci_tier.sh b/scripts/validate_ci_tier.sh
index 639fd0c..429fac3 100755
--- a/scripts/validate_ci_tier.sh
+++ b/scripts/validate_ci_tier.sh
@@ -9,7 +9,7 @@ if [ "$#" -ne 1 ]; then
 fi
 
 cd "$ROOT"
-export GOTOOLCHAIN=${GOTOOLCHAIN:-go1.26.5}
+export GOTOOLCHAIN=${GOTOOLCHAIN:-go1.26.7}
 export GOWORK=off
 export GOFLAGS=-mod=readonly
 
diff --git a/scripts/validate_go_core.sh b/scripts/validate_go_core.sh
index bd86e8e..ca2693a 100755
--- a/scripts/validate_go_core.sh
+++ b/scripts/validate_go_core.sh
@@ -3,8 +3,9 @@ set -euo pipefail
 
 ROOT=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
 MODE=full
-MINIMUM_SECURE_GO_VERSION=go1.26.5
-RELEASE_GO_VERSION=${GDS_RELEASE_GO_VERSION:-go1.26.5}
+MINIMUM_SECURE_GO_VERSION=go1.26.7
+RELEASE_GO_VERSION=${GDS_RELEASE_GO_VERSION:-go1.26.7}
+GOVULNCHECK_VERSION=v1.6.0
 
 if [ "${1:-}" = "--quick" ]; then
   MODE=quick
@@ -101,6 +102,7 @@ run_json_validator "$BUILD_DIR/generate-repository.json" \
   "$GDS_BIN" --json generate repository --check
 
 if [ "$MODE" = "full" ]; then
+  go run "golang.org/x/vuln/cmd/govulncheck@${GOVULNCHECK_VERSION}" ./...
   go test -race ./...
   mkdir -p "$BUILD_DIR/cross"
   for TARGET in darwin/arm64 darwin/amd64 linux/arm64 linux/amd64; do
diff --git a/scripts/validate_release.sh b/scripts/validate_release.sh
index 54778c9..fb80bec 100755
--- a/scripts/validate_release.sh
+++ b/scripts/validate_release.sh
@@ -6,7 +6,7 @@ BUILD_DIR=$(mktemp -d "${TMPDIR:-/tmp}/gds-release-gate.XXXXXX")
 trap 'rm -rf -- "$BUILD_DIR"' EXIT INT TERM
 
 cd "$ROOT"
-export GOTOOLCHAIN=${GOTOOLCHAIN:-go1.26.5}
+export GOTOOLCHAIN=${GOTOOLCHAIN:-go1.26.7}
 export GOWORK=off
 export GOFLAGS=-mod=readonly
 
diff --git a/tests/fixtures/schemas/v1/valid-assurance-report.json b/tests/fixtures/schemas/v1/valid-assurance-report.json
index 382cadf..b619c7b 100644
--- a/tests/fixtures/schemas/v1/valid-assurance-report.json
+++ b/tests/fixtures/schemas/v1/valid-assurance-report.json
@@ -6,7 +6,7 @@
   "environment": {
     "os": "macos",
     "architecture": "arm64",
-    "go_version": "go1.26.5",
+    "go_version": "go1.26.7",
     "cpu_count": 12
   },
   "source": {
diff --git a/tests/golden/projections/control-plane/.claude/CLAUDE.md b/tests/golden/projections/control-plane/.claude/CLAUDE.md
index a9f2e29..75cf770 100644
--- a/tests/golden/projections/control-plane/.claude/CLAUDE.md
+++ b/tests/golden/projections/control-plane/.claude/CLAUDE.md
@@ -3,7 +3,7 @@ GENERATED FILE - DO NOT EDIT DIRECTLY
 generator: gds
 bundle: 0.4.0-dev
 source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-input-digest: sha256:be7ce80717d8e8e28bbffc2ea3931b68812b418199ba818a047cd035f16daf04
+input-digest: sha256:68bb64d7bf23cbfbe3e1d2865285306c1198e556420ecbd3e7284873ab0de762
 output-digest: sha256:88cb57297d8d713287872a8afaca8d42f7146ecf7a091e4996e65eee8f962665
 edit-source:
   - .gds/repository.yaml
diff --git a/tests/golden/projections/control-plane/.gds/bundle.lock.yaml b/tests/golden/projections/control-plane/.gds/bundle.lock.yaml
index 56d9d9f..249fd7b 100644
--- a/tests/golden/projections/control-plane/.gds/bundle.lock.yaml
+++ b/tests/golden/projections/control-plane/.gds/bundle.lock.yaml
@@ -9,14 +9,14 @@ bundle:
   digest: "sha256:d4645c8b942733304420ab2b92860914887b2cf90ea41dc6a836ac870a4b3182"
 
 projection:
-  input_digest: "sha256:be7ce80717d8e8e28bbffc2ea3931b68812b418199ba818a047cd035f16daf04"
-  output_digest: "sha256:7c66a9eea5408ed8ec767d386d4376fbd5b986bf72bebaca9493bd27ffa1f72e"
+  input_digest: "sha256:68bb64d7bf23cbfbe3e1d2865285306c1198e556420ecbd3e7284873ab0de762"
+  output_digest: "sha256:5d8ae23fa17b98ebc32d062fc3c0b2db38b9c235bfe76aaba77b7d73ffe71466"
   files:
     - path: ".claude/CLAUDE.md"
-      digest: "sha256:85b693a48df9b21e7ba80aa5bbf203e76ace83bd125ec1c25dd308d7e16c3b38"
+      digest: "sha256:d44c29db06429be314480b8b013872c1b4df3c146c1b2aa31a57ffa2d89e3cf4"
     - path: ".gds/compiled-policy.json"
       digest: "sha256:09752cc0cbe57dc3097f884927e2089a9730b9ebcf86ac27228812d54c5760f8"
     - path: ".github/workflows/gds-ci.yml"
-      digest: "sha256:7b244b9e8d470f3780de8e5213e9056a81f070a2db66fe92cba3d9224319339f"
+      digest: "sha256:c3172226c6544ad5c99d25004b504c9be51fdc58ce27f062653313d9e4d56b99"
     - path: "AGENTS.md"
-      digest: "sha256:4c7367a8bc2fdba3a4a96554ae3d7d687c6326df2170b957c77372f816fcd94c"
+      digest: "sha256:1b95a1c220648598dbad21f13ef947ea5881759f13276a9920350864b7600cc7"
diff --git a/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml b/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml
index 824ad45..a2fddf0 100644
--- a/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml
+++ b/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml
@@ -2,8 +2,8 @@
 # generator: gds
 # bundle: 0.4.0-dev
 # source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-# input-digest: sha256:be7ce80717d8e8e28bbffc2ea3931b68812b418199ba818a047cd035f16daf04
-# output-digest: sha256:c268237f2cffde69b7868265ba6ac331048c98036fb9030ee7b7b3a208a9ad49
+# input-digest: sha256:68bb64d7bf23cbfbe3e1d2865285306c1198e556420ecbd3e7284873ab0de762
+# output-digest: sha256:01fb4854784be9e4564bcc84e70786484b370879be5e5ab1dd49f8b73ea2dea4
 # edit-source:
 #   - .gds/repository.yaml
 #   - policies/base/repository-default.yaml
@@ -41,7 +41,7 @@ jobs:
       cache: true
 
       runner: "ubuntu-latest"
-      go_version: "1.26.5"
+      go_version: "1.26.7"
       test_command: "go test ./..."
       timeout_minutes: 30
   pr-required:
@@ -58,7 +58,7 @@ jobs:
       fetch_depth: 0
       cache: true
       runner: "ubuntu-latest"
-      go_version: "1.26.5"
+      go_version: "1.26.7"
       build_command: "go build -trimpath ./core/cmd/gds"
       test_command: "go test ./... && python3 -m pip install --quiet --require-hashes -r requirements/test.txt && python3 -m pytest"
       timeout_minutes: 30
diff --git a/tests/golden/projections/control-plane/AGENTS.md b/tests/golden/projections/control-plane/AGENTS.md
index 8c39552..7e7a593 100644
--- a/tests/golden/projections/control-plane/AGENTS.md
+++ b/tests/golden/projections/control-plane/AGENTS.md
@@ -3,7 +3,7 @@ GENERATED FILE - DO NOT EDIT DIRECTLY
 generator: gds
 bundle: 0.4.0-dev
 source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-input-digest: sha256:be7ce80717d8e8e28bbffc2ea3931b68812b418199ba818a047cd035f16daf04
+input-digest: sha256:68bb64d7bf23cbfbe3e1d2865285306c1198e556420ecbd3e7284873ab0de762
 output-digest: sha256:670970518bda1458ad0fb14b276a6ba9add2ef7491ba406774e7094d159b7109
 edit-source:
   - .gds/repository.yaml