diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 57b0fac..7f857d7 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -41,7 +41,7 @@ repos:
     hooks:
       - id: gitleaks
   - repo: https://github.com/commitizen-tools/commitizen
-    rev: v4.17.1
+    rev: v4.19.2
     hooks:
       - id: commitizen
         stages: [commit-msg]
@@ -49,4 +49,6 @@ repos:
     rev: v2.12.2
     hooks:
       - id: golangci-lint
+        language_version: 1.26.8
       - id: golangci-lint-fmt
+        language_version: 1.26.8
diff --git a/go.mod b/go.mod
index 3bec2e0..5d2d1e7 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/devsy-org/devsy-provider-aws
 
-go 1.26.4
+go 1.26.8
 
 require (
 	al.essio.dev/pkg/shellescape v1.6.0
diff --git a/renovate.json b/renovate.json
index bfa4120..42e18bf 100644
--- a/renovate.json
+++ b/renovate.json
@@ -35,6 +35,15 @@
       "matchManagers": ["gomod"],
       "automerge": true,
       "prPriority": 3
+    },
+    {
+      "matchManagers": ["gomod"],
+      "matchDepNames": ["go"],
+      "matchDepTypes": ["golang"],
+      "matchFileNames": ["go.mod"],
+      "allowedVersions": "1.26.8",
+      "automerge": false,
+      "description": "keep the Go module version aligned with the pinned Go 1.26.8 toolchain"
     }
   ]
 }