diff --git a/Dockerfile b/Dockerfile
index abb6c03..bd74f93 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 # golang 1.26.5: fixes the Go stdlib pair CVE-2026-39822 (HIGH, os.Root symlink
 # traversal) / CVE-2026-42505 (crypto/tls ECH) that 1.26.4 builds carry.
-FROM golang:1.26.5-bookworm@sha256:1ecb7edf62a0408027bd5729dfd6b1b8766e578e8df93995b225dfd0944eb651 AS build-stage
+FROM golang:1.26.6-bookworm@sha256:116d58cbd88c1297624acc6e967a060012422bacf9930927e23fb719189c6f36 AS build-stage
 # Always compile with the base image's Go, never an auto-downloaded toolchain.
 ENV GOTOOLCHAIN=local