diff --git a/CHANGELOG.md b/CHANGELOG.md
index c977323..d5ae5a3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,16 @@
 
 Notable changes to VT-SecretShare. Versions follow [Semantic Versioning](https://semver.org/).
 
+## Unreleased
+
+### Security
+
+- Build with Go 1.27.3. Go 1.27.2's `crypto/x509` still trusted a set of
+  compromised intermediate certificates
+  ([GO-2026-6809](https://pkg.go.dev/vuln/GO-2026-6809)); govulncheck found the
+  server reaching `x509.Certificate.Verify`. The Docker image builds with
+  `golang:1.27.3-alpine` too.
+
 ## 1.0.0 - 2026-10-20
 
 First tagged release. It covers everything built since June 2026, the same code
diff --git a/Dockerfile b/Dockerfile
index 0a71903..7f08f6f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Build (works the same under `docker build` and `podman build`).
-FROM golang:1.27.2-alpine AS build
+FROM golang:1.27.3-alpine AS build
 WORKDIR /src
 COPY go.mod go.sum* ./
 RUN go mod download
diff --git a/go.mod b/go.mod
index 383f141..8d5f786 100644
--- a/go.mod
+++ b/go.mod
@@ -2,7 +2,7 @@ module github.com/ValentinTorassa/VT-SecretShare
 
 go 1.27.0
 
-toolchain go1.27.2
+toolchain go1.27.3
 
 require github.com/redis/go-redis/v9 v9.23.0