diff --git a/.github/workflows/act-image-repin.yml b/.github/workflows/act-image-repin.yml
index 5bb03db8..7048d89a 100644
--- a/.github/workflows/act-image-repin.yml
+++ b/.github/workflows/act-image-repin.yml
@@ -103,7 +103,7 @@ jobs:
         if: steps.resolve.outputs.changed == 'true'
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: "1.25"
+          go-version-file: e2e/go.mod
 
       - name: Verify e2e module builds
         if: steps.resolve.outputs.changed == 'true'
diff --git a/.github/workflows/build-cli.yaml b/.github/workflows/build-cli.yaml
index 8b61ceec..e6e9525e 100644
--- a/.github/workflows/build-cli.yaml
+++ b/.github/workflows/build-cli.yaml
@@ -27,7 +27,7 @@ jobs:
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: '1.25'
+          go-version-file: go.mod
           cache: true
 
       - name: Build binary
diff --git a/.github/workflows/nightly-release.yaml b/.github/workflows/nightly-release.yaml
index c78b8cf4..17f3c0c8 100644
--- a/.github/workflows/nightly-release.yaml
+++ b/.github/workflows/nightly-release.yaml
@@ -205,7 +205,7 @@ jobs:
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         if: github.event.inputs.dry_run == 'true'
         with:
-          go-version: "1.25"
+          go-version-file: go.mod
 
       - name: Compute candidate version (dry run)
         id: version
diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index 72cdac7c..a24228da 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -53,7 +53,7 @@ jobs:
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: '1.25'
+          go-version-file: go.mod
           cache: true
 
       - name: Run unit tests
@@ -89,7 +89,7 @@ jobs:
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: '1.25'
+          go-version-file: go.mod
           cache: true
 
       - name: Run golangci-lint
@@ -111,7 +111,7 @@ jobs:
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: '1.25'
+          go-version-file: go.mod
           cache: true
 
       - name: Build cascade CLI
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 44ffe212..4ff9c4d9 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -44,7 +44,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: "1.25"
+          go-version-file: go.mod
 
       - name: Run tests
         run: go test -v ./...
@@ -70,7 +70,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: "1.25"
+          go-version-file: go.mod
 
       - name: Install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
diff --git a/.github/workflows/validate.yaml b/.github/workflows/validate.yaml
index 15e10fff..58def78a 100644
--- a/.github/workflows/validate.yaml
+++ b/.github/workflows/validate.yaml
@@ -41,7 +41,7 @@ jobs:
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: '1.25'
+          go-version-file: go.mod
           cache: true
 
       - name: Run tests
@@ -73,7 +73,7 @@ jobs:
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: '1.25'
+          go-version-file: go.mod
           cache: true
 
       - name: Run golangci-lint
@@ -81,9 +81,23 @@ jobs:
         with:
           version: v2.10.1
 
+  vuln:
+    name: Vulnerability Scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Run govulncheck
+        run: go run golang.org/x/vuln/cmd/govulncheck@v1.3.0 ./...
+
   validate:
     name: Validation Gate
-    needs: [test, lint]
+    needs: [test, lint, vuln]
     runs-on: ubuntu-latest
     outputs:
       result: ${{ steps.result.outputs.result }}
diff --git a/docs/release-verification.md b/docs/release-verification.md
index 6f3175d1..042f1304 100644
--- a/docs/release-verification.md
+++ b/docs/release-verification.md
@@ -81,7 +81,7 @@ cd cascade
 git checkout v0.X.Y
 ```
 
-2. Ensure Go 1.25 is installed (the version used for official releases).
+2. Ensure Go 1.26.4 or newer is installed (the toolchain pinned in `go.mod` via the `toolchain` directive, used for official releases).
 
 3. Build with the same flags used in the release workflow:
 
diff --git a/docs/src/content/docs/adoption.md b/docs/src/content/docs/adoption.md
index 40366d12..7ec361f8 100644
--- a/docs/src/content/docs/adoption.md
+++ b/docs/src/content/docs/adoption.md
@@ -18,7 +18,7 @@ The flow in one line: you write a manifest plus callback workflows, run `cascade
 - **GitHub Actions enabled** on the repository, with trunk-based development (a single primary branch).
 - **Conventional Commits are required.** cascade derives the semver bump, the changelog, and breaking-change detection entirely from Conventional Commit messages. This is not optional. Commits that do not follow the convention are not processed correctly and version derivation can fail. See [Versioning and schema compatibility](/cascade/versioning/).
 - **GitHub setup**: environments for each deploy stage, branch and tag protection, the secrets your callbacks consume, and scoped tokens. The [Security and Hardening](/cascade/security/hardening/) checklist is the authoritative list; wire it up before your first production promotion.
-- The `cascade` CLI for local generation (Go 1.25+ to `go install`; in Actions, the setup action installs it for you). See [Getting Started](/cascade/getting-started/).
+- The `cascade` CLI for local generation (Go 1.26.4+ to `go install`; in Actions, the setup action installs it for you). See [Getting Started](/cascade/getting-started/).
 
 ## Build a pipeline from scratch
 
diff --git a/docs/src/content/docs/getting-started.md b/docs/src/content/docs/getting-started.md
index 5ddba7ba..cd373da8 100644
--- a/docs/src/content/docs/getting-started.md
+++ b/docs/src/content/docs/getting-started.md
@@ -7,7 +7,7 @@ This guide walks through setting up `cascade` in your repository. For the big pi
 
 ## Prerequisites
 
-- Go 1.25+ (for the CLI)
+- Go 1.26.4+ (for the CLI)
 - A GitHub repository with Actions enabled
 - Trunk-based development (single primary branch)
 
diff --git a/e2e/go.mod b/e2e/go.mod
index 6afeefe8..d19d354a 100644
--- a/e2e/go.mod
+++ b/e2e/go.mod
@@ -2,6 +2,8 @@ module github.com/stablekernel/cascade/e2e
 
 go 1.25.0
 
+toolchain go1.26.4
+
 replace github.com/stablekernel/cascade => ../
 
 require (
diff --git a/go.mod b/go.mod
index 072196d7..5d97c2bf 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,8 @@ module github.com/stablekernel/cascade
 
 go 1.25
 
+toolchain go1.26.4
+
 require (
 	github.com/pmezard/go-difflib v1.0.0
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2