diff --git a/go.mod b/go.mod
index 2b1aa2f15..df4c24b74 100644
--- a/go.mod
+++ b/go.mod
@@ -2,12 +2,8 @@ module github.com/warmbly/warmbly
 
 go 1.26.0
 
-// Pinned so every build, local and CI, uses a toolchain carrying the
-// standard-library security fixes. The net/http, crypto/tls, net/url,
-// encoding/xml, encoding/asn1 and net advisories govulncheck reports against
-// earlier toolchains are fixed in go1.26.6; the Docker builder images track the
-// matching 1.26 line. Raise both together.
-toolchain go1.26.8
+// Keep the pinned toolchain and 1.26 builder images on patched security releases.
+toolchain go1.26.9
 
 require (
 	cloud.google.com/go/cloudtasks v1.13.7
@@ -57,7 +53,7 @@ require (
 	go.uber.org/zap v1.27.0
 	golang.org/x/crypto v0.57.0
 	golang.org/x/mod v0.41.0
-	golang.org/x/net v0.59.0
+	golang.org/x/net v0.60.0
 	golang.org/x/oauth2 v0.36.0
 	golang.org/x/sync v0.23.0
 	golang.org/x/term v0.46.0
diff --git a/go.sum b/go.sum
index daee0c86c..af1232cb1 100644
--- a/go.sum
+++ b/go.sum
@@ -1078,6 +1078,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
 golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=