diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 46b7fbf38..6c20581ce 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -21,7 +21,7 @@ on:
     - cron: "18 19 * * 6"
 
 env:
-  GOLANG_VERSION: "1.27"
+  GOLANG_VERSION: "1.27.3"
 
 jobs:
   analyze:
diff --git a/Dockerfile b/Dockerfile
index 2b1c39091..b2c1a028a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Container for building Go binary.
-FROM golang:1.27.2-trixie AS builder
+FROM golang:1.27.3-trixie AS builder
 # Install dependencies
 RUN apt-get update && apt-get install -y --no-install-recommends build-essential git
 
@@ -24,6 +24,11 @@ RUN echo "Built charon version=$(./charon version)"
 FROM debian:trixie-slim
 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates fio wget \
   && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+# Distrust the emSign ECC Root CA - G3 and AAA Certificate Services roots in the
+# system store (used by wget and other non-Go tools in the image) until Debian's
+# ca-certificates drops them. Remove once the base image ships the update.
+RUN sed -i -E 's#^(mozilla/(emSign_ECC_Root_CA_-_G3|Comodo_AAA_Services_root)\.crt)$#!\1#' /etc/ca-certificates.conf \
+  && update-ca-certificates --fresh
 ARG GITHUB_SHA=local
 ENV GITHUB_SHA=${GITHUB_SHA}
 
diff --git a/go.mod b/go.mod
index 03674087f..36768c274 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,8 @@ module github.com/obolnetwork/charon
 
 go 1.27
 
+toolchain go1.27.3
+
 require (
 	github.com/OffchainLabs/go-bitfield v0.0.0-20251031151322-f427d04d8506
 	github.com/attestantio/go-builder-client v0.8.0
diff --git a/testutil/promrated/Dockerfile b/testutil/promrated/Dockerfile
index 267a7f3b3..361867069 100644
--- a/testutil/promrated/Dockerfile
+++ b/testutil/promrated/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.27.2-alpine AS builder
+FROM golang:1.27.3-alpine AS builder
 
 # Install dependencies
 RUN apk add --no-cache build-base git