diff --git a/Dockerfile b/Dockerfile
index c71b191d3..1629557ee 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,7 +17,7 @@
 # This image is also the single source of truth for the Go toolchain: CI reads the
 # version out of this line (see .github/scripts/go-version.sh) so tests and images
 # always run the same runtime.
-FROM golang:1.26.6-alpine3.24@sha256:af8d6740070b8906d12eae1c3e3ea0957fb63f492051ea05e354c38ef9fe88df AS builder
+FROM golang:1.26.7-alpine3.24@sha256:28d89ee9cc0ff9fec75c82ca201e6bf7fdf9a679d4b7b24dfa04f2bb766bb468 AS builder
 
 ARG TARGETPLATFORM
 ARG TARGETARCH
diff --git a/cmd/test-server/Dockerfile b/cmd/test-server/Dockerfile
index e0dc826db..f0ff258cc 100644
--- a/cmd/test-server/Dockerfile
+++ b/cmd/test-server/Dockerfile
@@ -17,7 +17,7 @@
 #
 # Pinned by digest so the build is reproducible even if the tag is republished.
 # The tag is kept alongside it for readability; Renovate updates both together.
-FROM golang:1.26.6-alpine3.24@sha256:af8d6740070b8906d12eae1c3e3ea0957fb63f492051ea05e354c38ef9fe88df AS builder
+FROM golang:1.26.7-alpine3.24@sha256:28d89ee9cc0ff9fec75c82ca201e6bf7fdf9a679d4b7b24dfa04f2bb766bb468 AS builder
 
 ARG TARGETARCH