diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b157e88..8583203 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,21 +15,25 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Setup
-        uses:
-          actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.21
+          go-version: '1.27.3'
 
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Build releases
         run: |
-          make releases VERSION=$GITHUB_REF_NAME
+          make releases VERSION="${GITHUB_REF_NAME#v}"
 
       - name: Release
-        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
-        with:
-          draft: true
-          files: |
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "$GITHUB_REF_NAME" \
+            --repo "$GITHUB_REPOSITORY" \
+            --draft \
+            --verify-tag \
+            --title "Release ${GITHUB_REF_NAME#v}" \
+            --generate-notes \
             releases/git-sizer-*
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 89d59a4..75d310d 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -9,13 +9,12 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
       fail-fast: false
-    # Preserve Go 1.21 coverage: macOS 26 rejects its linker output without LC_UUID.
-    runs-on: ${{ matrix.os == 'macos-latest' && 'macos-15' || matrix.os }}
+    runs-on: ${{ matrix.os }}
     steps:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.21.3'
+          go-version: '1.27.3'
 
       - name: Check out code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/Makefile b/Makefile
index ff80eaf..5a806b0 100644
--- a/Makefile
+++ b/Makefile
@@ -41,7 +41,7 @@ define PLATFORM_template =
 .PHONY: bin/git-sizer-$(1)-$(2)$(3)
 bin/git-sizer-$(1)-$(2)$(3):
 	mkdir -p bin
-	GOOS=$(1) GOARCH=$(2) $$(GO) build $$(GOFLAGS) -ldflags "-X main.ReleaseVersion=$$(VERSION)" -o $$@ .
+	CGO_ENABLED=0 GOOS=$(1) GOARCH=$(2) $$(GO) build $$(GOFLAGS) -ldflags "-X main.ReleaseVersion=$$(VERSION)" -o $$@ .
 common-platforms: bin/git-sizer-$(1)-$(2)$(3)
 
 # Note that releases don't include code from vendor (they're only used
diff --git a/docs/RELEASING.md b/docs/RELEASING.md
index 5656dd8..43ba19d 100644
--- a/docs/RELEASING.md
+++ b/docs/RELEASING.md
@@ -6,16 +6,8 @@
         git tag -as v$VERSION
         git push origin v$VERSION
 
-2.  Build the release for the major platforms:
+    Pushing the tag triggers `.github/workflows/release.yml`, which builds the release archives for all supported platforms and creates a draft release on GitHub.
 
-        make releases VERSION=$VERSION
+2.  Go to the [releases page](https://github.com/github/git-sizer/releases).
 
-    The output is a bunch of ZIP files written to directory `releases/`.
-
-3.  Go to the [releases page](https://github.com/github/git-sizer/releases).
-
-4.  Click on "Draft a new release".
-
-5.  Select the tag, add the required information, and upload the zip files.
-
-6.  Click "Publish release".
+3.  Open the generated draft release, add the release notes, and click "Publish release".
diff --git a/script/ensure-go-installed.sh b/script/ensure-go-installed.sh
index 1e301fd..7a760f1 100644
--- a/script/ensure-go-installed.sh
+++ b/script/ensure-go-installed.sh
@@ -4,17 +4,22 @@ if [ -z "$ROOTDIR" ]; then
     echo 1>&2 'ensure-go-installed.sh invoked without ROOTDIR set!'
 fi
 
-# Is go installed, and at least 1.21?
+# Is go installed, and at least 1.26.10 (or 1.27.3+)?
 go_ok() {
     set -- $(go version 2>/dev/null |
-                sed -n 's/.*go\([0-9][0-9]*\)\.\([0-9][0-9]*\).*/\1 \2/p' |
+                sed -n 's/.*go\([0-9][0-9]*\)\.\([0-9][0-9]*\)\.\([0-9][0-9]*\).*/\1 \2 \3/p' |
                 head -n 1)
-    [ $# -eq 2 ] && [ "$1" -eq 1 ] && [ "$2" -ge 21 ]
+    if [ $# -ne 3 ] || [ "$1" -ne 1 ]; then
+        return 1
+    fi
+    [ "$2" -gt 27 ] ||
+        { [ "$2" -eq 27 ] && [ "$3" -ge 3 ]; } ||
+        { [ "$2" -eq 26 ] && [ "$3" -ge 10 ]; }
 }
 
 # If a local go is installed, use it.
 set_up_vendored_go() {
-    GO_VERSION=go1.21.3
+    GO_VERSION=go1.27.3
     VENDORED_GOROOT="$ROOTDIR/vendor/$GO_VERSION/go"
     if [ -x "$VENDORED_GOROOT/bin/go" ]; then
         export GOROOT="$VENDORED_GOROOT"
diff --git a/script/install-vendored-go b/script/install-vendored-go
index 76d2195..7ec079b 100755
--- a/script/install-vendored-go
+++ b/script/install-vendored-go
@@ -2,20 +2,24 @@
 
 # The checksums below must correspond to the downloads for this version.
 # The checksums can be found on https://go.dev/dl
-GO_VERSION=go1.21.3
+GO_VERSION=go1.27.3
 
 case "$(uname -s):$(uname -m)" in
 Linux:x86_64)
     GO_PKG=${GO_VERSION}.linux-amd64.tar.gz
-    GO_PKG_SHA=1241381b2843fae5a9707eec1f8fb2ef94d827990582c7c7c32f5bdfbfd420c8
+    GO_PKG_SHA=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40
+    ;;
+Linux:aarch64|Linux:arm64)
+    GO_PKG=${GO_VERSION}.linux-arm64.tar.gz
+    GO_PKG_SHA=a06e99309dbcbdca1a8ccd2282c3ee146e55930886e26b4f1193269587165f49
     ;;
 Darwin:x86_64)
     GO_PKG=${GO_VERSION}.darwin-amd64.tar.gz
-    GO_PKG_SHA=27014fc69e301d7588a169ca239b3cc609f0aa1abf38528bf0d20d3b259211eb
+    GO_PKG_SHA=b6f8e931e4ab497fcde6da8ae4499a58f9d258e55c8a80824a516eae5950a750
     ;;
 Darwin:arm64)
     GO_PKG=${GO_VERSION}.darwin-arm64.tar.gz
-    GO_PKG_SHA=65302a7a9f7a4834932b3a7a14cb8be51beddda757b567a2f9e0cbd0d7b5a6ab
+    GO_PKG_SHA=dd3908cf20959d798c1e06ebe5b72213f0505ce01373b40ce3110975a6cd99c2
     ;;
 *)
     echo 1>&2 "I don't know how to install Go on your platform."