diff --git a/.github/workflows/catalog-drift.yml b/.github/workflows/catalog-drift.yml
index 07332dc..555a501 100644
--- a/.github/workflows/catalog-drift.yml
+++ b/.github/workflows/catalog-drift.yml
@@ -45,7 +45,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@v7
         with:
-          go-version: '1.26.8'
+          go-version: '1.26.9'
           cache: true
 
       # The ref goes through the environment rather than straight into the run
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a139213..4830862 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -46,7 +46,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@v7
         with:
-          go-version: '1.26.8'
+          go-version: '1.26.9'
           cache: true
 
       - name: Build
@@ -138,7 +138,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@v7
         with:
-          go-version: '1.26.8'
+          go-version: '1.26.9'
           cache: true
       - name: Install govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@latest
diff --git a/.github/workflows/desktop-release.yml b/.github/workflows/desktop-release.yml
index 0466914..92c6079 100644
--- a/.github/workflows/desktop-release.yml
+++ b/.github/workflows/desktop-release.yml
@@ -34,7 +34,7 @@ jobs:
 
       - uses: actions/setup-go@v7
         with:
-          go-version: '1.26.8'
+          go-version: '1.26.9'
           cache: true
 
       - uses: actions/setup-node@v7
diff --git a/docs/SECURITY-NOTES.md b/docs/SECURITY-NOTES.md
index 5b92bc8..a72c820 100644
--- a/docs/SECURITY-NOTES.md
+++ b/docs/SECURITY-NOTES.md
@@ -7,7 +7,7 @@ present in the dependency tree. The job is a hard gate: a finding our code can r
 
 ## Go standard library
 
-The release and CI workflows pin an exact toolchain, `go-version: '1.26.8'`, so a release built today and one
+The release and CI workflows pin an exact toolchain, `go-version: '1.26.9'`, so a release built today and one
 rebuilt next month use the same compiler and standard library. The cost of an exact pin is that Go security
 releases do not arrive on their own: the workflows sat on `'1.26.5'` while go1.26.6 fixed five advisories our
 code actually calls (`GO-2026-6218` net/url, `GO-2026-6090` crypto/tls, `GO-2026-6089` and `GO-2026-5026`
@@ -15,7 +15,7 @@ net/http, `GO-2026-5972` encoding/asn1), and those shipped in release binaries u
 
 The `govulncheck` gate is what keeps the pin honest. It runs against the pinned toolchain, so a stdlib advisory
 our code can reach fails CI on the next pull request. When it does, or when a Go security release ships, bump
-the pin in all three places (`ci.yml` twice, `desktop-release.yml` once) to the latest 1.26.x and let the gate
+the pin in all four places (`ci.yml` twice, `desktop-release.yml` and `catalog-drift.yml` once each) to the latest 1.26.x and let the gate
 confirm it.
 
 If you build locally with an older toolchain you will see those findings. Update your Go toolchain.