diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3c97737..f580816 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,7 +25,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.26"
+          go-version: "1.27"
           # Without this, setup-go keeps the runner image's PREINSTALLED Go when it
           # satisfies the "1.26" range, instead of fetching the newest patch. That
           # silently pins CI to a stale patch release — which govulncheck then reports
@@ -64,7 +64,7 @@ jobs:
       - name: Run golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.4
+          version: v2.13.1
 
       - name: Run govulncheck
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b477a6a..02da950 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,7 +32,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.26"
+          go-version: "1.27"
           # Match ci.yml: build released binaries with the newest 1.26 patch rather
           # than whatever the runner image happens to ship, so a release never carries
           # stdlib vulnerabilities CI has already been fixed against.