diff --git a/Dockerfile b/Dockerfile
index 2f7a99a..9f87fe4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 # Agent image. One binary, two roles (ADR 0009): the same image runs the
 # controller (a Deployment — ADR 0026) and the node scanner (a DaemonSet); the
 # role is the first argument.
-FROM golang:1.26.7@sha256:e30143be198ab04cf7ba25fba83ab3a692ca584c994aad0bf131fa0eb32dd8c1 AS build
+FROM golang:1.27.1@sha256:f44f6e88636cfb311f9ebace870ded69d943f227bb3cb27d32ffd84ea18c43ea AS build
 WORKDIR /src
 
 # Cache module downloads separately from the source.