diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index e6fb0d1a0d6..d3692d99d54 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -1,4 +1,4 @@
-ARG VARIANT="1.26"
+ARG VARIANT="1.27"
 FROM mcr.microsoft.com/vscode/devcontainers/go:${VARIANT}
 RUN apt-get update && \
     export DEBIAN_FRONTEND=noninteractive && \
diff --git a/.github/workflows/go-version-check.yaml b/.github/workflows/go-version-check.yaml
index d29f36aaf54..d91cada5b6b 100644
--- a/.github/workflows/go-version-check.yaml
+++ b/.github/workflows/go-version-check.yaml
@@ -402,8 +402,10 @@ jobs:
 
           # Determine GOEXPERIMENT requirements
           if [ "$TARGET_MIN_NUM" -ge 27 ]; then
-            GOEXP_CGO1="systemcrypto"
-            GOEXP_CGO0="systemcrypto"
+            # Go 1.27+ removed the crypto GOEXPERIMENTs and selects system crypto
+            # automatically, so no GOEXPERIMENT should be set for either CGO mode.
+            GOEXP_CGO1=""
+            GOEXP_CGO0=""
           elif [ "$TARGET_MIN_NUM" -ge 26 ]; then
             GOEXP_CGO1="systemcrypto"
             GOEXP_CGO0="ms_nocgo_opensslcrypto"
@@ -460,7 +462,7 @@ jobs:
           incorrect FIPS configuration for the current Go version.
 
           **FIPS rules:**
-          - CGO_ENABLED=1: GOEXPERIMENT=\`${GOEXP_CGO1}\`
+          - CGO_ENABLED=1: GOEXPERIMENT=\`${GOEXP_CGO1:-<none>}\`
           - CGO_ENABLED=0: GOEXPERIMENT=\`${GOEXP_CGO0:-<none>}\`
 
           **Reference:** https://github.com/microsoft/go/blob/microsoft/main/eng/doc/NocgoOpenSSL.md
@@ -592,8 +594,8 @@ jobs:
 
           # Determine GOEXPERIMENT rules per version
           if [ "$TARGET_MIN_NUM" -ge 27 ]; then
-            echo "goexp_cgo1=systemcrypto" >> "$GITHUB_OUTPUT"
-            echo "goexp_cgo0=systemcrypto" >> "$GITHUB_OUTPUT"
+            echo "goexp_cgo1=" >> "$GITHUB_OUTPUT"
+            echo "goexp_cgo0=" >> "$GITHUB_OUTPUT"
           elif [ "$TARGET_MIN_NUM" -ge 26 ]; then
             echo "goexp_cgo1=systemcrypto" >> "$GITHUB_OUTPUT"
             echo "goexp_cgo0=ms_nocgo_opensslcrypto" >> "$GITHUB_OUTPUT"
@@ -675,19 +677,18 @@ jobs:
           if [ "$FIPS_READY" = "true" ]; then
             FIPS_SECTION="
           ### FIPS Status: ✅ Already configured
-          GOEXPERIMENT and distroless/base are already correctly configured.
+          System crypto and distroless/base are already correctly configured.
           No FIPS changes needed for this upgrade."
           elif [ "$LATEST_MIN_NUM" -ge 27 ]; then
             FIPS_SECTION="
           ### ⚠️ FIPS / System Crypto Requirements
-          Go 1.27+ lifts the cgo requirement for systemcrypto on Linux.
-          \`GOEXPERIMENT=systemcrypto\` can now be set in ALL scripts/Dockerfiles regardless of CGO setting.
+          Go 1.27+ selects system crypto automatically and lifts the cgo requirement on supported Linux architectures.
           Reference: https://github.com/microsoft/go/blob/microsoft/main/eng/doc/NocgoOpenSSL.md
 
-          1. Set \`GOEXPERIMENT=systemcrypto\` in ALL Dockerfile templates and pipeline build scripts
-          2. Remove \`MS_GO_NOSYSTEMCRYPTO=1\` from npm Dockerfiles if present
+          1. Remove \`GOEXPERIMENT=systemcrypto\`, \`GOEXPERIMENT=nosystemcrypto\`, and \`GOEXPERIMENT=ms_nocgo_opensslcrypto\` from all build scripts and Dockerfiles; these experiments are removed and cause build errors
+          2. **Keep** \`MS_GO_NOSYSTEMCRYPTO=1\` in the npm build script and npm Dockerfiles. It is an environment variable, **not** a GOEXPERIMENT, and it is still supported in Go 1.27. npm ships on an Ubuntu base without the Microsoft FIPS OpenSSL build, so removing it makes the binary require OpenSSL at startup and panic during initialization
           3. Ensure \`MARINER_DISTROLESS_IMG\` in \`build/images.mk\` is \`distroless/base\`
-          4. Update \`bpf-prog/ipv6-hp-bpf/linux.Dockerfile\` runtime base to \`azurelinux/distroless/base:3.0\`"
+          4. Update \`bpf-prog/ipv6-hp-bpf/linux.Dockerfile\` runtime base to \`mcr.microsoft.com/azurelinux/distroless/base:3.0\` (keep the full registry prefix — a bare \`azurelinux/...\` reference resolves to Docker Hub and is not pullable)"
           elif [ "$LATEST_MIN_NUM" -ge 26 ]; then
             FIPS_SECTION="
           ### ⚠️ FIPS / System Crypto Requirements (CRITICAL — builds will FAIL without this)
@@ -705,7 +706,7 @@ jobs:
           **Steps:**
           1. Add \`GOEXPERIMENT=ms_nocgo_opensslcrypto\` to ALL scripts/Dockerfiles/Makefiles with \`CGO_ENABLED=0\` on Linux
           2. Add \`GOEXPERIMENT=systemcrypto\` to scripts/Dockerfiles with \`CGO_ENABLED=1\` (cilium-log-collector)
-          3. Remove \`MS_GO_NOSYSTEMCRYPTO=1\` from npm Dockerfiles and replace with \`GOEXPERIMENT=ms_nocgo_opensslcrypto\`
+          3. **Keep** \`MS_GO_NOSYSTEMCRYPTO=1\` in the npm build script and npm Dockerfiles — npm ships on an Ubuntu base without the Microsoft FIPS OpenSSL build, so it must stay on the standard Go crypto backend. Do **not** replace it with a GOEXPERIMENT
           4. npm Dockerfiles use **plain Go tags** (e.g., \`golang:1.26.4\`) — do NOT add \`-azurelinux3.0\` suffix
           5. npm/windows.Dockerfile builds on Linux (\`--platform=linux/amd64\`) — it STILL needs GOEXPERIMENT for CGO=0
           6. Ensure \`MARINER_DISTROLESS_IMG\` in \`build/images.mk\` is \`distroless/base\`
diff --git a/.pipelines/build/scripts/azure-ip-masq-merger.sh b/.pipelines/build/scripts/azure-ip-masq-merger.sh
index 325c187080a..8af86bd6f73 100644
--- a/.pipelines/build/scripts/azure-ip-masq-merger.sh
+++ b/.pipelines/build/scripts/azure-ip-masq-merger.sh
@@ -5,7 +5,6 @@ set -eux
 FILE_EXT=''
 
 export CGO_ENABLED=0
-export GOEXPERIMENT=ms_nocgo_opensslcrypto
 
 mkdir -p "$OUT_DIR"/bin
 mkdir -p "$OUT_DIR"/files
diff --git a/.pipelines/build/scripts/azure-ipam.sh b/.pipelines/build/scripts/azure-ipam.sh
index 674e9a207b9..5d29064d1a7 100644
--- a/.pipelines/build/scripts/azure-ipam.sh
+++ b/.pipelines/build/scripts/azure-ipam.sh
@@ -4,7 +4,6 @@ set -eux
 [[ $OS =~ windows ]] && FILE_EXT='.exe' || FILE_EXT=''
 
 export CGO_ENABLED=0
-export GOEXPERIMENT=ms_nocgo_opensslcrypto
 
 mkdir -p "$OUT_DIR"/bin
 mkdir -p "$OUT_DIR"/files
diff --git a/.pipelines/build/scripts/azure-iptables-monitor.sh b/.pipelines/build/scripts/azure-iptables-monitor.sh
index c2ddbf93095..b269f55ee2d 100644
--- a/.pipelines/build/scripts/azure-iptables-monitor.sh
+++ b/.pipelines/build/scripts/azure-iptables-monitor.sh
@@ -5,7 +5,6 @@ set -eux
 FILE_EXT=''
 
 export CGO_ENABLED=0
-export GOEXPERIMENT=ms_nocgo_opensslcrypto
 export C_INCLUDE_PATH=/usr/include/bpf
 
 mkdir -p "$OUT_DIR"/bin
diff --git a/.pipelines/build/scripts/cilium-log-collector.sh b/.pipelines/build/scripts/cilium-log-collector.sh
index d88053b1a53..0c0ec78106d 100644
--- a/.pipelines/build/scripts/cilium-log-collector.sh
+++ b/.pipelines/build/scripts/cilium-log-collector.sh
@@ -4,7 +4,6 @@ set -eux
 [[ $OS =~ windows ]] && { echo "cilium-log-collector is not supported on Windows"; exit 1; }
 # enable cgo for -buildmode=c-shared
 export CGO_ENABLED=1
-export GOEXPERIMENT=systemcrypto
 
 mkdir -p "$OUT_DIR"/bin
 mkdir -p "$OUT_DIR"/files
diff --git a/.pipelines/build/scripts/cni.sh b/.pipelines/build/scripts/cni.sh
index 6ddf5dabc82..5cc1af64f0b 100644
--- a/.pipelines/build/scripts/cni.sh
+++ b/.pipelines/build/scripts/cni.sh
@@ -7,7 +7,6 @@ mkdir -p "$OUT_DIR"/files
 mkdir -p "$OUT_DIR"/bin
 
 export CGO_ENABLED=0
-export GOEXPERIMENT=ms_nocgo_opensslcrypto
 
 
 CNI_NET_DIR="$REPO_ROOT"/cni/network/plugin
diff --git a/.pipelines/build/scripts/cns.sh b/.pipelines/build/scripts/cns.sh
index 321e07fe809..fa8584c452d 100644
--- a/.pipelines/build/scripts/cns.sh
+++ b/.pipelines/build/scripts/cns.sh
@@ -4,7 +4,6 @@ set -eux
 [[ $OS =~ windows ]] && FILE_EXT='.exe' || FILE_EXT=''
 
 export CGO_ENABLED=0
-export GOEXPERIMENT=ms_nocgo_opensslcrypto
 
 mkdir -p "$OUT_DIR"/files
 mkdir -p "$OUT_DIR"/bin
diff --git a/.pipelines/build/scripts/dropgz.sh b/.pipelines/build/scripts/dropgz.sh
index e65f3421466..894db89d9b2 100644
--- a/.pipelines/build/scripts/dropgz.sh
+++ b/.pipelines/build/scripts/dropgz.sh
@@ -21,7 +21,6 @@ function files::remove_exe_extensions() {
 [[ $OS =~ windows ]] && FILE_EXT='.exe' || FILE_EXT=''
 
 export CGO_ENABLED=0
-export GOEXPERIMENT=ms_nocgo_opensslcrypto
 
 mkdir -p "$GEN_DIR"
 mkdir -p "$OUT_DIR"/bin
diff --git a/.pipelines/build/scripts/install-go.sh b/.pipelines/build/scripts/install-go.sh
index 82729f20d55..d1ed50d1989 100755
--- a/.pipelines/build/scripts/install-go.sh
+++ b/.pipelines/build/scripts/install-go.sh
@@ -11,9 +11,9 @@ set -eux
 #   3. Hardcoded fallback digest below
 #
 # To update the fallback, run:
-#   IMG=mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0
+#   IMG=mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0
 #   echo "${IMG}@$(skopeo inspect docker://${IMG} --format '{{.Digest}}')"
-DEFAULT_IMAGE="mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0@sha256:8f638b09830f92f4005c56756cbafdd56d6460f41d2c1fd12b9bc02a5c85434c"
+DEFAULT_IMAGE="mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0@sha256:b40d1e7ecd4acb36102444f787bd626a2b08287fc385bf48ec609053f29f4558"
 
 # Resolves the golang image from the source Dockerfile for the given $name.
 # Echoes the image reference, or empty string if it cannot be determined.
diff --git a/.pipelines/build/scripts/ipv6-hp-bpf.sh b/.pipelines/build/scripts/ipv6-hp-bpf.sh
index 055d35f5e8a..648540d7c40 100644
--- a/.pipelines/build/scripts/ipv6-hp-bpf.sh
+++ b/.pipelines/build/scripts/ipv6-hp-bpf.sh
@@ -38,7 +38,6 @@ function findcp::shared_library() {
 [[ $OS =~ windows ]] && FILE_EXT='.exe' || FILE_EXT=''
 
 export CGO_ENABLED=0
-export GOEXPERIMENT=ms_nocgo_opensslcrypto
 export C_INCLUDE_PATH=/usr/include/bpf
 
 mkdir -p "$OUT_DIR"/bin
diff --git a/.pipelines/build/scripts/npm.sh b/.pipelines/build/scripts/npm.sh
index a48d3751ef9..4d36a4985d6 100644
--- a/.pipelines/build/scripts/npm.sh
+++ b/.pipelines/build/scripts/npm.sh
@@ -3,14 +3,12 @@ set -eux
 
 [[ $OS =~ windows ]] && FILE_EXT='.exe' || FILE_EXT=''
 
-export CGO_ENABLED=0
-# npm ships on the Ubuntu base image (it needs iptables/ipset at runtime), which
-# does not provide Microsoft's FIPS-capable OpenSSL. GOEXPERIMENT=ms_nocgo_openssl
-# crypto would make the binary require that OpenSSL and crash-loop on FIPS-enabled
-# clusters, so use the standard Go crypto backend (matches npm/*.Dockerfile and
-# the shipped release/v1.6 image). Components on the AzureLinux distroless base
-# use ms_nocgo_opensslcrypto instead.
+# npm ships on an Ubuntu base that does not carry the Microsoft FIPS OpenSSL
+# build, so use the standard Go crypto backend (matches npm/*.Dockerfile).
+# Components on the AzureLinux distroless base use the default system crypto
+# backend instead.
 export MS_GO_NOSYSTEMCRYPTO=1
+export CGO_ENABLED=0
 
 mkdir -p "$OUT_DIR"/files
 mkdir -p "$OUT_DIR"/bin
diff --git a/.pipelines/cni/cilium/nightly-release-test.yml b/.pipelines/cni/cilium/nightly-release-test.yml
index 34f18996f5e..daa5db1ddaf 100644
--- a/.pipelines/cni/cilium/nightly-release-test.yml
+++ b/.pipelines/cni/cilium/nightly-release-test.yml
@@ -64,15 +64,6 @@ stages:
                 ALPINE_ARGS="--build-arg ALPINE_IMAGE=${alpineACR} "
               fi
 
-              if [ "$(type)" = "docker-operator-generic-image" ]; then
-                # Apply patch to Dockerfile
-                DOCKERFILE_PATH="./images/$(directory)/Dockerfile"
-                echo "Patching Dockerfile: $DOCKERFILE_PATH"
-
-                # Add ARG and ENV statements to disable systemcrypto for Microsoft Go
-                sed -i '/^FROM.*builder/a ARG GOEXPERIMENT=boringcrypto \nENV GOEXPERIMENT=${GOEXPERIMENT}' "$DOCKERFILE_PATH"
-              fi
-
               BUILD_ARGS=${GO_ARGS}${ALPINE_ARGS}
               DOCKER_FLAGS="$BUILD_ARGS" \
               make $(type)
diff --git a/azure-ip-masq-merger/Dockerfile b/azure-ip-masq-merger/Dockerfile
index c66cfb77aa4..b071eefd846 100644
--- a/azure-ip-masq-merger/Dockerfile
+++ b/azure-ip-masq-merger/Dockerfile
@@ -3,8 +3,8 @@
 ARG ARCH
 ARG OS
 
-# mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0
-FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0@sha256:829285f9358799b5b9bfb48ee11e604d09b6d7fb7bf5acc22a86f77149fd82e6 AS go
+# mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0
+FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0@sha256:b40d1e7ecd4acb36102444f787bd626a2b08287fc385bf48ec609053f29f4558 AS go
 
 # mcr.microsoft.com/azurelinux/distroless/base:3.0
 FROM --platform=linux/${ARCH} mcr.microsoft.com/azurelinux/distroless/base:3.0@sha256:387a603a274e74568fd7a0e6d48ef68e631990e3b5149801515fe749a74b5b29 AS mariner-distroless
@@ -12,7 +12,6 @@ FROM --platform=linux/${ARCH} mcr.microsoft.com/azurelinux/distroless/base:3.0@s
 FROM go AS azure-ip-masq-merger
 ARG OS
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-ip-masq-merger
 COPY ./azure-ip-masq-merger .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/ip-masq-merger -trimpath -ldflags "-s -w -X main.version="$VERSION"" -gcflags="-dwarflocationlists=true" .
diff --git a/azure-ip-masq-merger/Dockerfile.tmpl b/azure-ip-masq-merger/Dockerfile.tmpl
index e6b25a44839..66ad79145b2 100644
--- a/azure-ip-masq-merger/Dockerfile.tmpl
+++ b/azure-ip-masq-merger/Dockerfile.tmpl
@@ -12,7 +12,6 @@ FROM --platform=linux/${ARCH} {{.MARINER_DISTROLESS_PIN}} AS mariner-distroless
 FROM go AS azure-ip-masq-merger
 ARG OS
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-ip-masq-merger
 COPY ./azure-ip-masq-merger .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/ip-masq-merger -trimpath -ldflags "-s -w -X main.version="$VERSION"" -gcflags="-dwarflocationlists=true" .
diff --git a/azure-ip-masq-merger/go.mod b/azure-ip-masq-merger/go.mod
index f988e1f4a33..13b594296ba 100644
--- a/azure-ip-masq-merger/go.mod
+++ b/azure-ip-masq-merger/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/azure-container-networking/azure-ip-masq-merger
 
 go 1.26.0
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require (
 	github.com/stretchr/testify v1.12.1
diff --git a/azure-ipam/Dockerfile b/azure-ipam/Dockerfile
index 7ebf43e6f83..b5a16a0aa53 100644
--- a/azure-ipam/Dockerfile
+++ b/azure-ipam/Dockerfile
@@ -5,8 +5,8 @@ ARG DROPGZ_VERSION=v0.0.12
 ARG OS_VERSION
 ARG OS
 
-# mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0
-FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0@sha256:829285f9358799b5b9bfb48ee11e604d09b6d7fb7bf5acc22a86f77149fd82e6 AS go
+# mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0
+FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0@sha256:b40d1e7ecd4acb36102444f787bd626a2b08287fc385bf48ec609053f29f4558 AS go
 
 # mcr.microsoft.com/azurelinux/base/core:3.0
 FROM --platform=linux/${ARCH} mcr.microsoft.com/azurelinux/base/core:3.0@sha256:daa1142fc6b44e27c8112ec6b4c2d579ddb9bc6b3747504e666010a45a51faa4 AS mariner-core
@@ -17,7 +17,6 @@ FROM --platform=linux/${ARCH} mcr.microsoft.com/azurelinux/distroless/base:3.0@s
 FROM go AS azure-ipam
 ARG OS
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-ipam
 COPY ./azure-ipam .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/azure-ipam -trimpath -ldflags "-s -w -X main.version="$VERSION" -X github.com/Azure/azure-container-networking/azure-ipam/internal/buildinfo.Version="$VERSION"" -gcflags="-dwarflocationlists=true" .
@@ -34,7 +33,6 @@ FROM go AS dropgz
 ARG DROPGZ_VERSION
 ARG OS
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 RUN go mod download github.com/azure/azure-container-networking/dropgz@$DROPGZ_VERSION
 WORKDIR /go/pkg/mod/github.com/azure/azure-container-networking/dropgz\@$DROPGZ_VERSION
 COPY --from=compressor /payload/* pkg/embed/fs/
diff --git a/azure-ipam/Dockerfile.tmpl b/azure-ipam/Dockerfile.tmpl
index 0100468fe86..a732ff2fa22 100644
--- a/azure-ipam/Dockerfile.tmpl
+++ b/azure-ipam/Dockerfile.tmpl
@@ -17,7 +17,6 @@ FROM --platform=linux/${ARCH} {{.MARINER_DISTROLESS_PIN}} AS mariner-distroless
 FROM go AS azure-ipam
 ARG OS
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-ipam
 COPY ./azure-ipam .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/azure-ipam -trimpath -ldflags "-s -w -X main.version="$VERSION" -X github.com/Azure/azure-container-networking/azure-ipam/internal/buildinfo.Version="$VERSION"" -gcflags="-dwarflocationlists=true" .
@@ -34,7 +33,6 @@ FROM go AS dropgz
 ARG DROPGZ_VERSION
 ARG OS
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 RUN go mod download github.com/azure/azure-container-networking/dropgz@$DROPGZ_VERSION
 WORKDIR /go/pkg/mod/github.com/azure/azure-container-networking/dropgz\@$DROPGZ_VERSION
 COPY --from=compressor /payload/* pkg/embed/fs/
diff --git a/azure-ipam/go.mod b/azure-ipam/go.mod
index b232f91f4e1..5d13cfc40ab 100644
--- a/azure-ipam/go.mod
+++ b/azure-ipam/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/azure-container-networking/azure-ipam
 
 go 1.26.1
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require (
 	github.com/Azure/azure-container-networking v1.8.12
diff --git a/azure-iptables-monitor/Dockerfile b/azure-iptables-monitor/Dockerfile
index f6e9d5f2512..43584eb32ed 100644
--- a/azure-iptables-monitor/Dockerfile
+++ b/azure-iptables-monitor/Dockerfile
@@ -8,14 +8,13 @@ FROM mcr.microsoft.com/azurelinux/base/core:3.0@sha256:daa1142fc6b44e27c8112ec6b
 # mcr.microsoft.com/azurelinux/distroless/base:3.0
 FROM mcr.microsoft.com/azurelinux/distroless/base:3.0@sha256:387a603a274e74568fd7a0e6d48ef68e631990e3b5149801515fe749a74b5b29 AS mariner-distroless
 
-# mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0
-FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0@sha256:829285f9358799b5b9bfb48ee11e604d09b6d7fb7bf5acc22a86f77149fd82e6 AS go
+# mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0
+FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0@sha256:b40d1e7ecd4acb36102444f787bd626a2b08287fc385bf48ec609053f29f4558 AS go
 
 
 FROM go AS azure-iptables-monitor
 ARG OS
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-iptables-monitor
 COPY ./azure-iptables-monitor .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/iptables-monitor -trimpath -ldflags "-s -w -X main.version="$VERSION"" -gcflags="-dwarflocationlists=true" .
@@ -31,7 +30,6 @@ COPY ./go.mod ./go.sum ./
 RUN tdnf install -y llvm clang libbpf-devel gcc binutils glibc
 # Set up C include path for BPF
 ENV C_INCLUDE_PATH=/usr/include/bpf
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 # Set up architecture-specific symlinks for cross-compilation support
 RUN if [ "$ARCH" = "amd64" ]; then \
         ARCH_DIR=x86_64-linux-gnu; \
diff --git a/azure-iptables-monitor/Dockerfile.tmpl b/azure-iptables-monitor/Dockerfile.tmpl
index 45b35afe5b3..4215441bb35 100644
--- a/azure-iptables-monitor/Dockerfile.tmpl
+++ b/azure-iptables-monitor/Dockerfile.tmpl
@@ -15,7 +15,6 @@ FROM --platform=linux/${ARCH} {{.GO_PIN}} AS go
 FROM go AS azure-iptables-monitor
 ARG OS
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-iptables-monitor
 COPY ./azure-iptables-monitor .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/iptables-monitor -trimpath -ldflags "-s -w -X main.version="$VERSION"" -gcflags="-dwarflocationlists=true" .
@@ -31,7 +30,6 @@ COPY ./go.mod ./go.sum ./
 RUN tdnf install -y llvm clang libbpf-devel gcc binutils glibc
 # Set up C include path for BPF
 ENV C_INCLUDE_PATH=/usr/include/bpf
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 # Set up architecture-specific symlinks for cross-compilation support
 RUN if [ "$ARCH" = "amd64" ]; then \
         ARCH_DIR=x86_64-linux-gnu; \
diff --git a/azure-iptables-monitor/go.mod b/azure-iptables-monitor/go.mod
index 8e2a6a4c666..6440ce80c27 100644
--- a/azure-iptables-monitor/go.mod
+++ b/azure-iptables-monitor/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/azure-container-networking/azure-iptables-monitor
 
 go 1.26.0
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require (
 	github.com/coreos/go-iptables v0.8.0
diff --git a/bpf-prog/ipv6-hp-bpf/go.mod b/bpf-prog/ipv6-hp-bpf/go.mod
index f13a763afd6..0aef7f1cf0b 100644
--- a/bpf-prog/ipv6-hp-bpf/go.mod
+++ b/bpf-prog/ipv6-hp-bpf/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/azure-container-networking/bpf-prog/ipv6-hp-bpf
 
 go 1.25.0
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require (
 	github.com/cilium/ebpf v0.22.0
diff --git a/bpf-prog/ipv6-hp-bpf/linux.Dockerfile b/bpf-prog/ipv6-hp-bpf/linux.Dockerfile
index d61357d9ab7..635862308fb 100644
--- a/bpf-prog/ipv6-hp-bpf/linux.Dockerfile
+++ b/bpf-prog/ipv6-hp-bpf/linux.Dockerfile
@@ -1,7 +1,7 @@
 ARG ARCH
-# IMG=mcr.microsoft.com/oss/go/microsoft/golang:1.26.7
+# IMG=mcr.microsoft.com/oss/go/microsoft/golang:1.27.1
 # echo "${IMG}@$(skopeo inspect docker://${IMG} --format '{{.Digest}}')"
-FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.26.7@sha256:be14ce4ce048adf5584ce3a0919d21987284e2235b6e7e9bb0e6a01133870be9 AS go
+FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.27.1@sha256:edd9a9ae78ad898771bc506ae596e67b6db7f4f055616982805ebd75764d3f77 AS go
 ARG VERSION
 ARG DEBUG
 ARG OS
@@ -36,7 +36,6 @@ RUN if [ "$ARCH" = "arm64" ]; then \
     cp /lib/"$ARCH"/libbsd.so.0 /tmp/lib/ && \
     cp /lib/"$ARCH"/libmd.so.0 /tmp/lib/
 ENV C_INCLUDE_PATH=/usr/include/bpf
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 RUN if [ "$DEBUG" = "true" ]; then echo "\n#define DEBUG" >> /bpf-prog/ipv6-hp-bpf/include/helper.h; fi
 RUN GOOS=$OS CGO_ENABLED=0 go generate ./...
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/ipv6-hp-bpf -trimpath -ldflags "-s -w -X main.version="$VERSION"" -gcflags="-dwarflocationlists=true" .
diff --git a/build/images.mk b/build/images.mk
index 22cdfc0d441..4cb6ad4b536 100644
--- a/build/images.mk
+++ b/build/images.mk
@@ -1,7 +1,7 @@
 # Source images
 GOPATH						?= $(shell go env GOPATH)
 
-export GO_IMG					?= mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0
+export GO_IMG					?= mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0
 export MARINER_CORE_IMG			?= mcr.microsoft.com/azurelinux/base/core:3.0
 export MARINER_DISTROLESS_IMG	?= mcr.microsoft.com/azurelinux/distroless/base:3.0
 export WIN_HPC_IMG				?= mcr.microsoft.com/oss/kubernetes/windows-host-process-containers-base-image:v1.0.0
diff --git a/cilium-log-collector/Dockerfile b/cilium-log-collector/Dockerfile
index 498b6731a5d..fc33040fd85 100644
--- a/cilium-log-collector/Dockerfile
+++ b/cilium-log-collector/Dockerfile
@@ -3,12 +3,11 @@
 ARG ARCH
 ARG OS
 
-# mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0
-FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0@sha256:829285f9358799b5b9bfb48ee11e604d09b6d7fb7bf5acc22a86f77149fd82e6 AS go
+# mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0
+FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0@sha256:b40d1e7ecd4acb36102444f787bd626a2b08287fc385bf48ec609053f29f4558 AS go
 
 FROM go AS fluent-bit-plugin
 ARG VERSION
-ENV GOEXPERIMENT=systemcrypto
 WORKDIR /cilium-log-collector
 COPY ./cilium-log-collector .
 RUN go build -buildmode=c-shared -a -o out_azure_app_insights.so -trimpath -ldflags "-X main.version=$VERSION" -gcflags="-dwarflocationlists=true" .
diff --git a/cilium-log-collector/Dockerfile.tmpl b/cilium-log-collector/Dockerfile.tmpl
index bcec425ac52..3de6cc1a5c5 100644
--- a/cilium-log-collector/Dockerfile.tmpl
+++ b/cilium-log-collector/Dockerfile.tmpl
@@ -8,7 +8,6 @@ FROM --platform=linux/${ARCH} {{.GO_PIN}} AS go
 
 FROM go AS fluent-bit-plugin
 ARG VERSION
-ENV GOEXPERIMENT=systemcrypto
 WORKDIR /cilium-log-collector
 COPY ./cilium-log-collector .
 RUN go build -buildmode=c-shared -a -o out_azure_app_insights.so -trimpath -ldflags "-X main.version=$VERSION" -gcflags="-dwarflocationlists=true" .
diff --git a/cilium-log-collector/Makefile b/cilium-log-collector/Makefile
index 5d6eae78299..62180cc2f8a 100755
--- a/cilium-log-collector/Makefile
+++ b/cilium-log-collector/Makefile
@@ -14,7 +14,7 @@ cilium-log-collector-version: ## prints the cilium-log-collector version
 # Build the cilium-log-collector plugin "so" file
 cilium-log-collector-binary:
 	$(MKDIR) $(CILIUM_LOG_COLLECTOR_BUILD_DIR)
-	cd $(CILIUM_LOG_COLLECTOR_DIR) && CGO_ENABLED=1 GOEXPERIMENT=systemcrypto go build -buildmode=c-shared -a -o $(CILIUM_LOG_COLLECTOR_BUILD_DIR)/out_azure_app_insights.so -trimpath -ldflags "-X main.version=$(CILIUM_LOG_COLLECTOR_VERSION)" -gcflags="-dwarflocationlists=true" .
+	cd $(CILIUM_LOG_COLLECTOR_DIR) && CGO_ENABLED=1 go build -buildmode=c-shared -a -o $(CILIUM_LOG_COLLECTOR_BUILD_DIR)/out_azure_app_insights.so -trimpath -ldflags "-X main.version=$(CILIUM_LOG_COLLECTOR_VERSION)" -gcflags="-dwarflocationlists=true" .
 
 
 CILIUM_LOG_COLLECTOR_IMAGE = cilium-log-collector
diff --git a/cilium-log-collector/go.mod b/cilium-log-collector/go.mod
index 87cd77cf629..6ae77020cfb 100644
--- a/cilium-log-collector/go.mod
+++ b/cilium-log-collector/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/azure-container-networking/cilium-log-collector
 
 go 1.26.1
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require (
 	github.com/Azure/azure-container-networking v1.8.12
diff --git a/cni/Dockerfile b/cni/Dockerfile
index a5b933caf10..8f3c3c1c0e2 100644
--- a/cni/Dockerfile
+++ b/cni/Dockerfile
@@ -5,8 +5,8 @@ ARG DROPGZ_VERSION=v0.0.12
 ARG OS_VERSION
 ARG OS
 
-# mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0
-FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0@sha256:829285f9358799b5b9bfb48ee11e604d09b6d7fb7bf5acc22a86f77149fd82e6 AS go
+# mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0
+FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0@sha256:b40d1e7ecd4acb36102444f787bd626a2b08287fc385bf48ec609053f29f4558 AS go
 
 # mcr.microsoft.com/azurelinux/base/core:3.0
 FROM --platform=linux/${ARCH} mcr.microsoft.com/azurelinux/base/core:3.0@sha256:daa1142fc6b44e27c8112ec6b4c2d579ddb9bc6b3747504e666010a45a51faa4 AS mariner-core
@@ -19,7 +19,6 @@ ARG OS
 ARG VERSION
 ARG CNI_AI_PATH
 ARG CNI_AI_ID
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-container-networking
 COPY . .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/azure-vnet -trimpath -ldflags "-s -w -X main.version="$VERSION"" -gcflags="-dwarflocationlists=true" cni/network/plugin/main.go
@@ -52,7 +51,6 @@ FROM go AS dropgz
 ARG DROPGZ_VERSION
 ARG OS
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 RUN go mod download github.com/azure/azure-container-networking/dropgz@$DROPGZ_VERSION
 WORKDIR /go/pkg/mod/github.com/azure/azure-container-networking/dropgz\@$DROPGZ_VERSION
 COPY --from=compressor /payload/* pkg/embed/fs/
diff --git a/cni/Dockerfile.tmpl b/cni/Dockerfile.tmpl
index 65a3f2da89a..ca967715fdf 100644
--- a/cni/Dockerfile.tmpl
+++ b/cni/Dockerfile.tmpl
@@ -19,7 +19,6 @@ ARG OS
 ARG VERSION
 ARG CNI_AI_PATH
 ARG CNI_AI_ID
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-container-networking
 COPY . .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/azure-vnet -trimpath -ldflags "-s -w -X main.version="$VERSION"" -gcflags="-dwarflocationlists=true" cni/network/plugin/main.go
@@ -52,7 +51,6 @@ FROM go AS dropgz
 ARG DROPGZ_VERSION
 ARG OS
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 RUN go mod download github.com/azure/azure-container-networking/dropgz@$DROPGZ_VERSION
 WORKDIR /go/pkg/mod/github.com/azure/azure-container-networking/dropgz\@$DROPGZ_VERSION
 COPY --from=compressor /payload/* pkg/embed/fs/
diff --git a/cns/Dockerfile b/cns/Dockerfile
index 521a36fd2d0..47529064614 100644
--- a/cns/Dockerfile
+++ b/cns/Dockerfile
@@ -4,8 +4,8 @@ ARG ARCH
 ARG OS_VERSION
 ARG OS
 
-# mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0
-FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0@sha256:829285f9358799b5b9bfb48ee11e604d09b6d7fb7bf5acc22a86f77149fd82e6 AS go
+# mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0
+FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0@sha256:b40d1e7ecd4acb36102444f787bd626a2b08287fc385bf48ec609053f29f4558 AS go
 
 # mcr.microsoft.com/azurelinux/base/core:3.0
 FROM mcr.microsoft.com/azurelinux/base/core:3.0@sha256:daa1142fc6b44e27c8112ec6b4c2d579ddb9bc6b3747504e666010a45a51faa4 AS mariner-core
@@ -18,7 +18,6 @@ ARG OS
 ARG CNS_AI_ID
 ARG CNS_AI_PATH
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-container-networking
 COPY . .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/azure-cns -ldflags "-s -w -X main.version="$VERSION" -X "$CNS_AI_PATH"="$CNS_AI_ID"" -gcflags="-dwarflocationlists=true" cns/service/*.go
diff --git a/cns/Dockerfile.tmpl b/cns/Dockerfile.tmpl
index 591418b8ef5..06a414c276d 100644
--- a/cns/Dockerfile.tmpl
+++ b/cns/Dockerfile.tmpl
@@ -18,7 +18,6 @@ ARG OS
 ARG CNS_AI_ID
 ARG CNS_AI_PATH
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-container-networking
 COPY . .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/azure-cns -ldflags "-s -w -X main.version="$VERSION" -X "$CNS_AI_PATH"="$CNS_AI_ID"" -gcflags="-dwarflocationlists=true" cns/service/*.go
diff --git a/cns/deviceplugin/server.go b/cns/deviceplugin/server.go
index fe22607fa23..65da82767f5 100644
--- a/cns/deviceplugin/server.go
+++ b/cns/deviceplugin/server.go
@@ -97,7 +97,7 @@ func (s *Server) Ready(ctx context.Context) error {
 // of the steps to make the Device available in the container
 // We are not using this functionality currently
 func (s *Server) Allocate(_ context.Context, req *v1beta1.AllocateRequest) (*v1beta1.AllocateResponse, error) {
-	s.logger.Info("allocate request", zap.Any("req", *req))
+	s.logger.Info("allocate request", zap.Any("req", req))
 	crs := req.GetContainerRequests()
 	resps := make([]*v1beta1.ContainerAllocateResponse, len(crs))
 	for i, containerReq := range crs {
diff --git a/cns/restserver/util_test.go b/cns/restserver/util_test.go
index c3c7ad76eb9..7bc6253acde 100644
--- a/cns/restserver/util_test.go
+++ b/cns/restserver/util_test.go
@@ -14,44 +14,50 @@ import (
 func TestAreNCsPresent(t *testing.T) {
 	present := ncList("present")
 	tests := []struct {
-		name    string
-		service HTTPRestService
-		want    bool
+		name       string
+		newService func() HTTPRestService
+		want       bool
 	}{
 		{
 			name: "container status present",
-			service: HTTPRestService{
-				state: &httpRestServiceState{
-					ContainerStatus: map[string]containerstatus{
-						"nc1": {},
+			newService: func() HTTPRestService {
+				return HTTPRestService{
+					state: &httpRestServiceState{
+						ContainerStatus: map[string]containerstatus{
+							"nc1": {},
+						},
 					},
-				},
+				}
 			},
 			want: true,
 		},
 		{
 			name: "containerIDByOrchestorContext present",
-			service: HTTPRestService{
-				state: &httpRestServiceState{
-					ContainerIDByOrchestratorContext: map[string]*ncList{
-						"nc1": &present,
+			newService: func() HTTPRestService {
+				return HTTPRestService{
+					state: &httpRestServiceState{
+						ContainerIDByOrchestratorContext: map[string]*ncList{
+							"nc1": &present,
+						},
 					},
-				},
+				}
 			},
 			want: true,
 		},
 		{
 			name: "neither containerStatus nor containerIDByOrchestratorContext present",
-			service: HTTPRestService{
-				state: &httpRestServiceState{},
+			newService: func() HTTPRestService {
+				return HTTPRestService{
+					state: &httpRestServiceState{},
+				}
 			},
 			want: false,
 		},
 	}
-	for _, tt := range tests { //nolint:govet // this mutex copy is to keep a local reference to this variable in the test func closure, and is ok
-		tt := tt //nolint:govet // this mutex copy is to keep a local reference to this variable in the test func closure, and is ok
+	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got := tt.service.areNCsPresent()
+			service := tt.newService()
+			got := service.areNCsPresent()
 			assert.Equal(t, got, tt.want)
 		})
 	}
diff --git a/dropgz/go.mod b/dropgz/go.mod
index 8137918a3c2..37cf1534bff 100644
--- a/dropgz/go.mod
+++ b/dropgz/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/azure-container-networking/dropgz
 
 go 1.25.0
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require (
 	github.com/jsternberg/zap-logfmt v1.3.0
diff --git a/go.mod b/go.mod
index dbd921e0b1f..a6ed0e00c6b 100644
--- a/go.mod
+++ b/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/azure-container-networking
 
 go 1.26.0
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require (
 	github.com/Azure/azure-container-networking/zapai v0.0.3
diff --git a/npm/linux.Dockerfile b/npm/linux.Dockerfile
index d733634d93a..dba4da3bfab 100644
--- a/npm/linux.Dockerfile
+++ b/npm/linux.Dockerfile
@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.26.7 AS builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.27.1 AS builder
 ARG VERSION
 ARG NPM_AI_PATH
 ARG NPM_AI_ID
diff --git a/npm/windows.Dockerfile b/npm/windows.Dockerfile
index c70c2451dab..075b58c1f87 100644
--- a/npm/windows.Dockerfile
+++ b/npm/windows.Dockerfile
@@ -1,5 +1,5 @@
 ARG OS_VERSION
-FROM --platform=linux/amd64 mcr.microsoft.com/oss/go/microsoft/golang:1.26.7 AS builder
+FROM --platform=linux/amd64 mcr.microsoft.com/oss/go/microsoft/golang:1.27.1 AS builder
 ARG VERSION
 ARG NPM_AI_PATH
 ARG NPM_AI_ID
diff --git a/pkgerrlint/go.mod b/pkgerrlint/go.mod
index 6eda1b58a03..91192209acb 100644
--- a/pkgerrlint/go.mod
+++ b/pkgerrlint/go.mod
@@ -2,6 +2,6 @@ module github.com/Azure/azure-container-networking/pkgerrlint
 
 go 1.25.0
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require github.com/pkg/errors v0.9.1
diff --git a/tools.go.mod b/tools.go.mod
index 6cbcfa0b6d4..eada43e2138 100644
--- a/tools.go.mod
+++ b/tools.go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/azure-container-networking
 
 go 1.25.0
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 // To use/update leverage -modfile=tools.go.mod field in respective go commands
 tool (
diff --git a/tools/azure-npm-to-cilium-validator/go.mod b/tools/azure-npm-to-cilium-validator/go.mod
index efdd9201898..2d584960fb7 100644
--- a/tools/azure-npm-to-cilium-validator/go.mod
+++ b/tools/azure-npm-to-cilium-validator/go.mod
@@ -2,7 +2,7 @@ module azure-npm-to-cilium-validator
 
 go 1.26.1
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require (
 	github.com/Azure/azure-container-networking v1.8.12
diff --git a/tools/failure-agent/go.mod b/tools/failure-agent/go.mod
index b1e2cc1756f..cbfdcbdeba6 100644
--- a/tools/failure-agent/go.mod
+++ b/tools/failure-agent/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/azure-container-networking/tools/failure-agent
 
 go 1.25.0
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require (
 	github.com/google/uuid v1.6.0
diff --git a/tools/release/go.mod b/tools/release/go.mod
index efacde0772d..820d1fecc37 100644
--- a/tools/release/go.mod
+++ b/tools/release/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/azure-container-networking/tools/release
 
 go 1.25.0
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require github.com/spf13/cobra v1.10.2
 
diff --git a/zapai/go.mod b/zapai/go.mod
index 77a8101103f..f90f4826584 100644
--- a/zapai/go.mod
+++ b/zapai/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/azure-container-networking/zapai
 
 go 1.25.0
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require (
 	github.com/jsternberg/zap-logfmt v1.3.0