diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0d2cbb5..01888c8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,7 +38,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           # Keep CI on the patched standard library release reported by govulncheck.
-          go-version: '1.26.9'
+          go-version: '1.26.10'
           cache: true
 
       - name: Check formatting
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d79d3a2..84f459c 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -37,7 +37,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: '1.26.9'
+          go-version: '1.26.10'
           cache: true
 
       - name: Initialize CodeQL
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index f8657af..aec404e 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -13,7 +13,7 @@ review and maintain.
 
 ## Local checks
 
-GoBot targets Go `1.26.9+` (or `1.27.2+` for the Go 1.27 series).
+GoBot targets Go `1.26.10+` (or `1.27.3+` for the Go 1.27 series).
 Before opening a pull request:
 
 ```sh
diff --git a/Dockerfile b/Dockerfile
index f0f6f6a..5d7f94d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM golang:1.26.9-alpine AS builder
+FROM golang:1.26.10-alpine AS builder
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN --mount=type=cache,target=/go/pkg/mod \
diff --git a/README.md b/README.md
index d5e37e6..d531e30 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@
 
 [![GoBot CI](https://github.com/variablenix/GoBot/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/variablenix/GoBot/actions/workflows/ci.yml)
 [![CodeQL](https://github.com/variablenix/GoBot/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/variablenix/GoBot/actions/workflows/codeql.yml)
-[![Go 1.26.9+](https://img.shields.io/badge/Go-1.26.9%2B-00ADD8?logo=go&logoColor=white)](go.mod)
+[![Go 1.26.10+](https://img.shields.io/badge/Go-1.26.10%2B-00ADD8?logo=go&logoColor=white)](go.mod)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 
 GoBot is an extensible Go IRC bot for long-running use on one or more IRC
@@ -53,7 +53,7 @@ are also persisted so they survive restarts.
 
 Requirements:
 
-- Go `1.26.9+` (or `1.27.2+` when using the Go 1.27 series)
+- Go `1.26.10+` (or `1.27.3+` when using the Go 1.27 series)
 - IRC network access
 - a writable data directory
 
diff --git a/docs/deployment.md b/docs/deployment.md
index e5333de..0ce8daa 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -5,7 +5,7 @@ systemd service, and using Docker.
 
 ## Requirements
 
-- Go `1.26.9+` (or `1.27.2+` when using the Go 1.27 series)
+- Go `1.26.10+` (or `1.27.3+` when using the Go 1.27 series)
 - a writable filesystem for the BoltDB database
 - network access to the IRC servers
 - optionally, Docker and Docker Compose
@@ -42,10 +42,10 @@ make test
 Configuration-only changes require a restart. Code changes require a new
 build before restarting.
 
-Use a patched Go toolchain when rebuilding: Go 1.26.9 and 1.27.2 contain
-standard-library security fixes that are not supplied by updating modules
+Use a patched Go toolchain when rebuilding: Go 1.26.10 and 1.27.3 contain
+certificate-validation security fixes that are not supplied by updating modules
 alone. An existing binary retains its old standard library until it is rebuilt
-and the service is restarted. CI and the Docker builder use Go 1.26.9.
+and the service is restarted. CI and the Docker builder use Go 1.26.10.
 
 ## First-run workflow
 
diff --git a/go.mod b/go.mod
index b440fb0..d4d2fb7 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/variablenix/GoBot
 
-go 1.26.9
+go 1.26.10
 
 require (
 	github.com/agnivade/levenshtein v1.2.1