diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f98290e..b46df7f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@v7
         with:
-          go-version: '1.26'
+          go-version: '1.26.8'
           cache: true
       - name: Build
         run: go build ./...
@@ -88,7 +88,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@v7
         with:
-          go-version: '1.26'
+          go-version: '1.26.8'
           cache: true
       - name: Install govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@latest
diff --git a/.github/workflows/desktop-release.yml b/.github/workflows/desktop-release.yml
index ea3953f..17ddceb 100644
--- a/.github/workflows/desktop-release.yml
+++ b/.github/workflows/desktop-release.yml
@@ -34,7 +34,7 @@ jobs:
 
       - uses: actions/setup-go@v7
         with:
-          go-version: '1.26'
+          go-version: '1.26.8'
           cache: true
 
       - uses: actions/setup-node@v7
diff --git a/docs/SECURITY-NOTES.md b/docs/SECURITY-NOTES.md
index 01ae04c..5b92bc8 100644
--- a/docs/SECURITY-NOTES.md
+++ b/docs/SECURITY-NOTES.md
@@ -7,11 +7,16 @@ present in the dependency tree. The job is a hard gate: a finding our code can r
 
 ## Go standard library
 
-The release and CI workflows ask for `go-version: '1.26'`, so `setup-go` resolves the latest 1.26.x patch
-and each Go security release arrives without a workflow edit. Keep it that way. Pinning an exact patch
-looks tidy and then quietly rots: the workflows sat on `'1.26.5'` while go1.26.6 fixed five advisories our
+The release and CI workflows pin an exact toolchain, `go-version: '1.26.8'`, so a release built today and one
+rebuilt next month use the same compiler and standard library. The cost of an exact pin is that Go security
+releases do not arrive on their own: the workflows sat on `'1.26.5'` while go1.26.6 fixed five advisories our
 code actually calls (`GO-2026-6218` net/url, `GO-2026-6090` crypto/tls, `GO-2026-6089` and `GO-2026-5026`
-net/http, `GO-2026-5972` encoding/asn1), which shipped in release binaries until the gate caught it.
+net/http, `GO-2026-5972` encoding/asn1), and those shipped in release binaries until the gate caught it.
+
+The `govulncheck` gate is what keeps the pin honest. It runs against the pinned toolchain, so a stdlib advisory
+our code can reach fails CI on the next pull request. When it does, or when a Go security release ships, bump
+the pin in all three places (`ci.yml` twice, `desktop-release.yml` once) to the latest 1.26.x and let the gate
+confirm it.
 
 If you build locally with an older toolchain you will see those findings. Update your Go toolchain.