diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6654a2e..1f81fac 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,7 +25,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24.18.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
diff --git a/.go-version b/.go-version
index f250c8f..3cd33cd 100644
--- a/.go-version
+++ b/.go-version
@@ -1 +1 @@
-1.26.6
+1.26.9
diff --git a/README.md b/README.md
index b94a514..be181c3 100644
--- a/README.md
+++ b/README.md
@@ -62,7 +62,7 @@ commands inward and immutable snapshots and committed events travel outward.
 
 ## Build and inspect
 
-Go 1.26.6 is required.
+Go 1.26.9 is required.
 
 ```sh
 go build ./cmd/atrinik-server
diff --git a/go.mod b/go.mod
index a046e5c..e1d5e4f 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/atrinik/server
 
-go 1.26.6
+go 1.26.9
 
 require (
 	github.com/atrinik/protocol v1.5.5
diff --git a/policy/dependencies.json b/policy/dependencies.json
index 31b88c7..fa5f748 100644
--- a/policy/dependencies.json
+++ b/policy/dependencies.json
@@ -23,7 +23,7 @@
     "validation": "go mod verify, Linux and Windows go list -deps, govulncheck, go-licenses, tests, Syft release SBOM"
   },
   "tools": [
-    {"name": "Go", "version": "1.26.6", "source": "https://go.dev/dl/", "license": "BSD-3-Clause"},
+    {"name": "Go", "version": "1.26.9", "source": "https://go.dev/dl/", "license": "BSD-3-Clause"},
     {"name": "staticcheck", "version": "0.7.0", "source": "https://pkg.go.dev/honnef.co/go/tools/cmd/staticcheck", "license": "MIT"},
     {"name": "govulncheck", "version": "1.6.0", "source": "https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck", "license": "BSD-3-Clause"},
     {"name": "go-licenses", "version": "1.6.0", "source": "https://github.com/google/go-licenses", "license": "Apache-2.0"},
diff --git a/tools/validate.sh b/tools/validate.sh
index ccfe5af..ad1b2b8 100755
--- a/tools/validate.sh
+++ b/tools/validate.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 repository=$(git rev-parse --show-toplevel)
 cd "${repository}"
 
-test "$(go version | awk '{print $3}')" = go1.26.6
+test "$(go version | awk '{print $3}')" = go1.26.9
 for command in go staticcheck govulncheck go-licenses jq syft; do
   command -v "${command}" >/dev/null || { echo "missing required tool: ${command}" >&2; exit 1; }
 done