diff --git a/Dockerfile b/Dockerfile
index 883e52c5c..fe6fd9198 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -26,7 +26,7 @@ RUN VITE_APP_VERSION_CODE="${VERSION}" \
     npm run build
 
 # Stage 2: Build Go binary
-FROM golang:1.27.3-alpine@sha256:f2c872bcee949b7be9c490efd02b48a8a2fbf947cdf533f1c58525ec9d8170fd AS builder
+FROM golang:1.27.4-alpine@sha256:0a5f7fe796599ff487605987432e7619ae45beeb2fba4c2ce0b907879932aebf AS builder
 
 # Install build dependencies (no gcc/musl-dev needed - pure Go SQLite driver)
 RUN apk add --no-cache git tzdata
diff --git a/deploy/coding-agent/Dockerfile b/deploy/coding-agent/Dockerfile
index 2149410d7..fadc9c220 100644
--- a/deploy/coding-agent/Dockerfile
+++ b/deploy/coding-agent/Dockerfile
@@ -21,7 +21,7 @@
 # --------------------------------------------------------------------
 # Stage 1: cross-compile the ws CLI for linux/<TARGETARCH>
 # --------------------------------------------------------------------
-FROM golang:1.27.3-bookworm@sha256:32fa283222e2905d9fee971f60c842e5c815fdc036cf7ea599bf36bd7ca8f67f AS ws-build
+FROM golang:1.27.4-bookworm@sha256:4fa7c968ba93f1635670522dbb01a2c78150443e1385746924566079f36570ea AS ws-build
 
 WORKDIR /src
 
diff --git a/deploy/windshift-runner/Dockerfile b/deploy/windshift-runner/Dockerfile
index 89cc2381d..a12d15cbb 100644
--- a/deploy/windshift-runner/Dockerfile
+++ b/deploy/windshift-runner/Dockerfile
@@ -26,7 +26,7 @@
 # --------------------------------------------------------------------
 # Stage 1: build windshift-runner + windshift-triage
 # --------------------------------------------------------------------
-FROM golang:1.27.3-alpine@sha256:f2c872bcee949b7be9c490efd02b48a8a2fbf947cdf533f1c58525ec9d8170fd AS build
+FROM golang:1.27.4-alpine@sha256:0a5f7fe796599ff487605987432e7619ae45beeb2fba4c2ce0b907879932aebf AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
diff --git a/go.mod b/go.mod
index 18d6e63e0..762fb0150 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module windshift
 
-go 1.27.3
+go 1.27.4
 
 require (
 	charm.land/bubbles/v2 v2.2.0
diff --git a/release.sh b/release.sh
index b2ad086f0..321bc744d 100755
--- a/release.sh
+++ b/release.sh
@@ -891,7 +891,7 @@ write_release_provenance() {
             echo ""
             echo "Resolved base image digests at build time"
             echo "-----------------------------------------"
-            for image in node:24.18.0-alpine golang:1.27.3-alpine golang:1.27.3-bookworm node:lts-slim; do
+            for image in node:24.18.0-alpine golang:1.27.4-alpine golang:1.27.4-bookworm node:lts-slim; do
                 docker buildx imagetools inspect "$image" 2>/dev/null | grep -E 'Name:|Digest:' || true
             done
         fi
diff --git a/scripts/demo/Dockerfile b/scripts/demo/Dockerfile
index 8a9527c3c..63d23d7cb 100644
--- a/scripts/demo/Dockerfile
+++ b/scripts/demo/Dockerfile
@@ -26,7 +26,7 @@ RUN npm run build
 # ============================================================
 # Stage 1b: Build windshift server binary
 # ============================================================
-FROM golang:1.27.3-alpine@sha256:f2c872bcee949b7be9c490efd02b48a8a2fbf947cdf533f1c58525ec9d8170fd AS builder
+FROM golang:1.27.4-alpine@sha256:0a5f7fe796599ff487605987432e7619ae45beeb2fba4c2ce0b907879932aebf AS builder
 
 # Install build dependencies
 RUN apk add --no-cache git