diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index feeb48b4..49ea5f76 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -103,10 +103,10 @@ jobs:
       - name: Clean Go module cache
         run: rm -rf ~/go/pkg/mod 2>/dev/null || true
 
-      - name: Set up Go 1.22
+      - name: Set up Go 1.27
         uses: actions/setup-go@v6
         with:
-          go-version: '1.22'
+          go-version: '1.27'
           cache-dependency-path: |
             cmd/server/go.sum
             cmd/ingestor/go.sum
@@ -343,10 +343,10 @@ jobs:
       - name: Clean Go module cache
         run: rm -rf ~/go/pkg/mod 2>/dev/null || true
 
-      - name: Set up Go 1.22
+      - name: Set up Go 1.27
         uses: actions/setup-go@v6
         with:
-          go-version: '1.22'
+          go-version: '1.27'
           cache-dependency-path: cmd/server/go.sum
 
       - name: Build Go server
@@ -758,10 +758,10 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v5
 
-      - name: Set up Go 1.22
+      - name: Set up Go 1.27
         uses: actions/setup-go@v6
         with:
-          go-version: '1.22'
+          go-version: '1.27'
 
       - name: Build corescope-decrypt (static, linux/amd64)
         run: |
diff --git a/Dockerfile b/Dockerfile
index bfb8fd00..4e70794c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,7 +3,7 @@
 # BUILDPLATFORM is auto-set by buildx; default to linux/amd64 so plain
 # `docker build` (without buildx) doesn't fail on an empty platform string.
 ARG BUILDPLATFORM=linux/amd64
-FROM --platform=$BUILDPLATFORM golang:1.22-alpine AS builder
+FROM --platform=$BUILDPLATFORM golang:1.27-alpine AS builder
 
 ARG APP_VERSION=unknown
 ARG GIT_COMMIT=unknown
diff --git a/Dockerfile.go b/Dockerfile.go
index 77e0329a..ec2725f5 100644
--- a/Dockerfile.go
+++ b/Dockerfile.go
@@ -1,4 +1,4 @@
-FROM golang:1.22-alpine AS builder
+FROM golang:1.27-alpine AS builder
 
 RUN apk add --no-cache build-base