diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 09cd03d..71c4779 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -35,7 +35,7 @@ jobs:
       # Runs inside the toolchain image rather than installing Go per job. Note this puts
       # the job on the dind bridge, which cannot reach github.com or get.helm.sh --
       # proxy.golang.org and git.ryuvia.com are reachable, which is all this job needs.
-      image: golang:1.26.9-bookworm
+      image: golang:1.26.10-bookworm
       # act_runner destroys a job's own volumes when it finishes, so without these every
       # run re-downloads the whole module graph. The names must appear in the runner's
       # container.valid_volumes allowlist (charts/act-runner in the k8s repo); unlisted
@@ -101,7 +101,7 @@ jobs:
   security:
     runs-on: ubuntu-latest
     container:
-      image: golang:1.26.9-bookworm
+      image: golang:1.26.10-bookworm
       volumes:
         - go-mod-cache:/go/pkg/mod
         - go-build-cache:/root/.cache/go-build
diff --git a/.gitea/workflows/release.yaml b/.gitea/workflows/release.yaml
index c4ded87..e00847e 100644
--- a/.gitea/workflows/release.yaml
+++ b/.gitea/workflows/release.yaml
@@ -30,7 +30,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     container:
-      image: golang:1.26.9-bookworm
+      image: golang:1.26.10-bookworm
       volumes:
         - go-mod-cache:/go/pkg/mod
         - go-build-cache:/root/.cache/go-build
@@ -71,7 +71,7 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     container:
-      image: golang:1.26.9-bookworm
+      image: golang:1.26.10-bookworm
       volumes:
         - go-mod-cache:/go/pkg/mod
         - go-build-cache:/root/.cache/go-build
diff --git a/Dockerfile b/Dockerfile
index 4f5623e..724ac0f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,7 +4,7 @@
 # in per platform. The CI runner has no binfmt registration and no way to get one (the
 # JS action that used to install it cannot run there), so this is not just an
 # optimisation -- it is what makes the arm64 image buildable at all.
-FROM --platform=$BUILDPLATFORM golang:1.26.9-alpine AS builder
+FROM --platform=$BUILDPLATFORM golang:1.26.10-alpine AS builder
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download