diff --git a/docs/bumping-upstream.md b/docs/bumping-upstream.md
index 25fe9ea..1845cf2 100644
--- a/docs/bumping-upstream.md
+++ b/docs/bumping-upstream.md
@@ -46,6 +46,20 @@ gh api "repos/moby/moby/contents/go.mod?ref=docker-v29.8.0" --jq .content | base
 `GO_VERSION` in `versions.env` must be at or above that. It is pinned because
 the toolchain changes the output bytes, so raise it deliberately, not reflexively.
 
+**The floor is not the target.** `go.mod` says what moby *needs*; its
+`Dockerfile` (`ARG GO_VERSION`) says what moby *ships with*, and the release
+notes list the stdlib CVEs that Go version fixes in `dockerd`:
+
+```sh
+gh api "repos/moby/moby/contents/Dockerfile?ref=docker-v29.9.0" --jq .content | base64 -d | grep '^ARG GO_VERSION'
+```
+
+29.9.0 was bumped to the floor (1.26.8) while moby built with 1.26.9, which
+shipped `rootfs-v29.9.0-1` without five Go security fixes. Match moby's Go
+version unless there is a stated reason not to, and after building, confirm it
+rather than trusting the pin: `go version` on the extracted `dockerd` prints
+the toolchain that actually built it.
+
 ### 3. Decide about containerd, runc and buildkit — deliberately
 
 moby's own `Dockerfile` carries `ARG CONTAINERD_VERSION` / `ARG RUNC_VERSION`.
@@ -161,7 +175,7 @@ letting the two drift silently.
 ## Checklist
 
 - [ ] Tag and commit SHA resolved, and the method verified against the existing pin
-- [ ] Go floor checked against moby's `go.mod`
+- [ ] Go floor checked against moby's `go.mod`, and `GO_VERSION` matched to moby's `Dockerfile` (the floor is not the target)
 - [ ] containerd / runc / buildkit: moved with a stated reason, or deliberately left alone
 - [ ] `versions.env` updated, `ROOTFS_REVISION` reset to 1
 - [ ] `manifest.json`: new default entry with empty sha256, previous engine retained
diff --git a/guest/rootfs/versions.env b/guest/rootfs/versions.env
index a8f3c0b..fbabd0e 100644
--- a/guest/rootfs/versions.env
+++ b/guest/rootfs/versions.env
@@ -43,8 +43,11 @@ ALPINE_DIGEST=sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec4349
 
 # Toolchain used to build them; bumping this changes output, so it is pinned too.
 # Floor is set by moby's go.mod (docker-v29.9.0 requires >= 1.26.8, as do
-# containerd v2.3.6 and buildkit v0.33.1).
-GO_VERSION=1.26.8
+# containerd v2.3.6 and buildkit v0.33.1). The floor is not the target: moby
+# builds docker-v29.9.0 with Go 1.26.9, whose runtime fixes five stdlib CVEs
+# in dockerd (HTTP/2 DoS x4, a Windows junction escape) -- see moby's 29.9.0
+# notes. rootfs 29.9.0-1 was built with 1.26.8 and lacks them.
+GO_VERSION=1.26.9
 
 # Packaging revision of the rootfs itself. The tarball carries more than the
 # engine (the skrog-agent, config, Alpine userland), so it can change while
@@ -52,7 +55,7 @@ GO_VERSION=1.26.8
 # Debian-style. Bump this when rootfs contents change without an engine bump;
 # reset to 1 on an engine bump. (The first 29.7.2 release predates the scheme
 # and is tagged bare, as rootfs-v29.7.2.)
-ROOTFS_REVISION=1
+ROOTFS_REVISION=2
 
 # Bump to force CI to recompile the engine even when nothing above changed —
 # the escape hatch for a poisoned cache or a change to build.sh's docker
diff --git a/internal/release/manifest.json b/internal/release/manifest.json
index f9b3758..81028d0 100644
--- a/internal/release/manifest.json
+++ b/internal/release/manifest.json
@@ -42,12 +42,12 @@
       "default": true,
       "rootfs": {
         "amd64": {
-          "url": "https://github.com/wslkit/skrog/releases/download/rootfs-v29.9.0-1/skrog-rootfs-29.9.0-1-amd64.tar.gz",
-          "sha256": "bc219b98f770f0d9ebbfaa82154412a8f383f477877465e8c9818d00445272d0"
+          "url": "https://github.com/wslkit/skrog/releases/download/rootfs-v29.9.0-2/skrog-rootfs-29.9.0-2-amd64.tar.gz",
+          "sha256": "63158299a08924e80187f4effb1c039e351fbc2ec71ce8016146c97489b3a175"
         },
         "arm64": {
-          "url": "https://github.com/wslkit/skrog/releases/download/rootfs-v29.9.0-1/skrog-rootfs-29.9.0-1-arm64.tar.gz",
-          "sha256": "4b06bbd5ef479ea0e8a8f2208a55643d0f5681db9263e5d078fca1f56909aff8"
+          "url": "https://github.com/wslkit/skrog/releases/download/rootfs-v29.9.0-2/skrog-rootfs-29.9.0-2-arm64.tar.gz",
+          "sha256": "9c09950241a96ae93845fdf683185b8c7666e0245aa2ef70e894336a248ea099"
         }
       },
       "components": {