diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6cef473..4f5c921 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- **Go toolchain:** bump minimum Go to **1.26.6** (`go.mod`, `Dockerfile`) — addresses Grype **High** stdlib findings on **1.26.5** images: [GO-2026-5026](https://pkg.go.dev/vuln/GO-2026-5026), [GO-2026-5972](https://pkg.go.dev/vuln/GO-2026-5972), [GO-2026-6088](https://pkg.go.dev/vuln/GO-2026-6088), [GO-2026-6090](https://pkg.go.dev/vuln/GO-2026-6090), [GO-2026-5942](https://pkg.go.dev/vuln/GO-2026-5942), and [GO-2026-6218](https://pkg.go.dev/vuln/GO-2026-6218) (**Medium**).
+
 [↑ Back to top](#top)
 
 ## [1.1.0] - 2026-08-01
diff --git a/Dockerfile b/Dockerfile
index 4e1b396..11e109f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 # kzero — minimal runtime image (build from repo root: make docker-build)
 # Final stage uses distroless (no Alpine/BusyBox) so CVEs in wget/busybox from
 # minimal Alpine bases do not apply; CA certs are included in distroless static.
-FROM golang:1.26.5-alpine3.24 AS build
+FROM golang:1.26.6-alpine3.24 AS build
 ARG VERSION=dev
 ARG COMMIT=unknown
 ARG BUILDDATE=unknown
diff --git a/README.md b/README.md
index 24efa18..eb00506 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@
 
 [![Version](https://img.shields.io/badge/version-1.1.0-blue.svg)](https://github.com/hrodrig/kzero/releases)
 [![GitHub release](https://img.shields.io/github/v/release/hrodrig/kzero)](https://github.com/hrodrig/kzero/releases)
-[![Go](https://img.shields.io/badge/Go-1.26.5-00ADD8.svg)](https://go.dev/dl/)
+[![Go](https://img.shields.io/badge/Go-1.26.6-00ADD8.svg)](https://go.dev/dl/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)
 [![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/hrodrig/kzero)
 [![CI](https://github.com/hrodrig/kzero/actions/workflows/ci.yml/badge.svg)](https://github.com/hrodrig/kzero/actions/workflows/ci.yml)
@@ -98,7 +98,7 @@ Host tooling depends on **`run.execution`** and your pipeline step types (see [S
 | Phase hooks, **`custom:`**, per-step **`pre`/`post`**, shell **`release.*`** `.sh` | **`command.shell`** (default **`/bin/sh`**; shebang ignored). Scripts must match that interpreter — on Ubuntu default **`/bin/sh`** is often **dash** (`pipefail` / `[[` fail). Opt-in **`command.shell: /bin/bash`**. See [SPEC — Hook and script interpreter](SPECIFICATIONS.md#hook-and-script-interpreter-commandshell). |
 
 - **RBAC** sufficient for the operations in your pipelines (for example **`get`/`patch`/`scale`**, PVC delete, Helm releases, pod exec)
-- **Go 1.26.5+** if you [build from source](#quick-start) (`make build`) or use [`go install`](#install-with-go)
+- **Go 1.26.6+** if you [build from source](#quick-start) (`make build`) or use [`go install`](#install-with-go)
 
 [↑ Back to top](#top)
 
@@ -225,7 +225,7 @@ If you installed from **[Releases](#install-or-update)** or **`go install`** (be
 
 ### Install with Go
 
-From any machine with Go **1.26.5+** (installs to `$(go env GOPATH)/bin`; ensure that directory is on your `PATH`):
+From any machine with Go **1.26.6+** (installs to `$(go env GOPATH)/bin`; ensure that directory is on your `PATH`):
 
 ```bash
 go install github.com/hrodrig/kzero/cmd/kzero@latest
diff --git a/go.mod b/go.mod
index f0233ec..40f76c7 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/hrodrig/kzero
 
-go 1.26.5
+go 1.26.6
 
 require (
 	github.com/spf13/cobra v1.10.2