diff --git a/.github/workflows/vulncheck.yml b/.github/workflows/vulncheck.yml
index 24e3ac6..5261be2 100644
--- a/.github/workflows/vulncheck.yml
+++ b/.github/workflows/vulncheck.yml
@@ -24,7 +24,7 @@ jobs:
         go-version: ${{ matrix.go-version }}
         check-latest: true
     - name: Get govulncheck
-      run: go install golang.org/x/vuln/cmd/govulncheck@v1.7.0
+      run: go install golang.org/x/vuln/cmd/govulncheck@v1.8.0
       shell: bash
     - name: Run govulncheck
       run: govulncheck ./...
diff --git a/README.md b/README.md
index 3738a08..07bcc3c 100644
--- a/README.md
+++ b/README.md
@@ -11,7 +11,7 @@ Import it directly. This repository declares `module github.com/pgsty/silo-pkg/v
 so a consumer requires it by name and needs no `replace` directive:
 
 ```go
-require github.com/pgsty/silo-pkg/v3 v3.13.2
+require github.com/pgsty/silo-pkg/v3 v3.14.0
 ```
 
 ```go
@@ -54,11 +54,13 @@ the Windows ROOT store directly and is unchanged. See the
 
 ## Versioning
 
-Tags follow upstream's numbering so it is obvious which release a version is
-based on. They do not promise identical contents: this fork skips upstream work
-that only serves the closed product, and carries fixes upstream has not taken.
-Read the tag annotation before upgrading — some releases have to be taken
-together with a matching MinIO server change, and say so.
+SILO versions are released independently of upstream. Read the release notes
+before upgrading: changes to shared policy behavior must be adopted together
+with the matching SILO server, Console and mcli changes.
+
+Version 3.14.0 separates self-service password changes from user administration.
+Review the [password authorization migration](UPSTREAM.md#breaking-authorization-compatibility)
+when upgrading policies that deny `admin:CreateUser` or `admin:ChangeMyPassword`.
 
 ## Contributing
 
diff --git a/UPSTREAM.md b/UPSTREAM.md
index b3d559b..620fdf6 100644
--- a/UPSTREAM.md
+++ b/UPSTREAM.md
@@ -1,9 +1,9 @@
-# Upstream review: 2026-09-10
+# Upstream review: 2026-09-13
 
 Reviewed `minio/pkg` through
 [`657d87e88168`](https://github.com/minio/pkg/commit/657d87e881680db68e3a9f9286569788651c968e)
 and `minio/minio-go` through
-[`78bfa91607c2`](https://github.com/minio/minio-go/commit/78bfa91607c2b9a7eb1ad5fe739de3c6c238d5ab).
+[`60bd07042d49`](https://github.com/minio/minio-go/commit/60bd07042d49a40c4155d3fbde3d390f39867a1e).
 
 ## Adopted
 
@@ -14,11 +14,13 @@ and `minio/minio-go` through
 - [pkg #233](https://github.com/minio/pkg/pull/233): add `consolereadonly`,
   with GetObject, GetBucketLocation and ListBucket. Apply #262 to this new
   policy too. The original `readonly` S3 permissions remain unchanged.
-- Pin the upstream SDK to `v7.3.1-0.20260909183557-78bfa91607c2`. Relative to
+- Pin the upstream SDK to `v7.3.1-0.20260910142817-60bd07042d49`. Relative to
   the previous `0e78d3f18efe` pin, it contains configurable upload limits
   ([#2299](https://github.com/minio/minio-go/pull/2299)), Content-Type in
-  streaming SignedHeaders ([#2301](https://github.com/minio/minio-go/pull/2301))
-  and caller TLS trust on RDMA ([#2302](https://github.com/minio/minio-go/pull/2302)).
+  streaming SignedHeaders ([#2301](https://github.com/minio/minio-go/pull/2301)),
+  caller TLS trust on RDMA ([#2302](https://github.com/minio/minio-go/pull/2302)),
+  and consistent listing checksums and optional restore status
+  ([#2303](https://github.com/minio/minio-go/pull/2303)).
 
 ## Breaking authorization compatibility
 
@@ -55,7 +57,7 @@ rollback limits.
 
 | Upstream work | SILO decision |
 | --- | --- |
-| #265, x/crypto v0.56.0 | Already selected; no additional version bump. |
+| #265, x/crypto v0.56.0 | Superseded by v0.57.0 in the Go dependency refresh for v3.14.0. |
 | #230, RNG subkey initialization | Already fixed locally. |
 | #226, exact condition key lookup | Already fixed locally. |
 | #242, xtime.Duration JSON marshaling | Already implemented locally. |
diff --git a/go.mod b/go.mod
index 0d18cac..a57309e 100644
--- a/go.mod
+++ b/go.mod
@@ -22,16 +22,16 @@ require (
 	github.com/lestrrat-go/jwx/v3 v3.2.0
 	github.com/mattn/go-colorable v0.1.15
 	github.com/mattn/go-isatty v0.0.24
-	github.com/minio/minio-go/v7 v7.3.1-0.20260909183557-78bfa91607c2
+	github.com/minio/minio-go/v7 v7.3.1-0.20260910142817-60bd07042d49
 	github.com/minio/mux v1.10.1
 	github.com/rjeczalik/notify v0.9.3
 	github.com/tinylib/msgp v1.6.4
 	github.com/zeebo/xxh3 v1.1.0
 	go.etcd.io/etcd/client/v3 v3.7.1
 	go.yaml.in/yaml/v3 v3.0.5
-	golang.org/x/crypto v0.56.0
-	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sys v0.47.0
+	golang.org/x/crypto v0.57.0
+	golang.org/x/oauth2 v0.37.0
+	golang.org/x/sys v0.48.0
 )
 
 require (
@@ -67,8 +67,8 @@ require (
 	go.etcd.io/etcd/client/pkg/v3 v3.7.1 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.28.0 // indirect
-	golang.org/x/net v0.58.0 // indirect
-	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/net v0.59.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260831171406-18b4a7587f8a // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260831171406-18b4a7587f8a // indirect
 	google.golang.org/grpc v1.83.2 // indirect
diff --git a/go.sum b/go.sum
index 6343d66..17cf247 100644
--- a/go.sum
+++ b/go.sum
@@ -97,8 +97,8 @@ github.com/mattn/go-runewidth v0.0.29 h1:3oGF3R/S2N9DQ3ptftzVIvg2eicmojCzlwBEmqE
 github.com/mattn/go-runewidth v0.0.29/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8=
 github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
 github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
-github.com/minio/minio-go/v7 v7.3.1-0.20260909183557-78bfa91607c2 h1:nvX7IksPFOF/cBvkSg/Z+urBZkmhZrfUVmzdNFLjZ5Y=
-github.com/minio/minio-go/v7 v7.3.1-0.20260909183557-78bfa91607c2/go.mod h1:KUPWdecEO1LWyUz+sTGXAuf2jZHrPh5fCsRH86QbPfk=
+github.com/minio/minio-go/v7 v7.3.1-0.20260910142817-60bd07042d49 h1:xDONRymps7J67VLaNzMqq25qYCHHm3JgXnKPRf1NoFs=
+github.com/minio/minio-go/v7 v7.3.1-0.20260910142817-60bd07042d49/go.mod h1:KUPWdecEO1LWyUz+sTGXAuf2jZHrPh5fCsRH86QbPfk=
 github.com/minio/mux v1.10.1 h1:grrK8SwRKbkNFE6qG7WAvFGH09bB46d5teOOtKfQ14s=
 github.com/minio/mux v1.10.1/go.mod h1:INYT4sMSTJy0QWUEA/E2DZNxJ5sAxIwbnyZjkzNFRfE=
 github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
@@ -152,22 +152,22 @@ go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo=
 go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
-golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
-golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
-golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
-golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
-golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
-golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
+golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
+golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
 golang.org/x/sys v0.0.0-20180926160741-c2ed4eda69e7/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
+golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 google.golang.org/genproto/googleapis/api v0.0.0-20260831171406-18b4a7587f8a h1:i3TAXhpKc7TUP1VAPiBBrv45kamjoizCC3rOC0cAbOs=