diff --git a/Dockerfile b/Dockerfile
index c7ca019..87d1736 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,7 +3,7 @@
 # (sqlc, templ) is committed, so the build needs only the Go toolchain.
 # No RUN --mount=type=cache: Railway's builder rejects cache mounts without
 # an id tied to one service ID, and the go.mod layer below caches modules.
-FROM golang:1.26.8-alpine AS build
+FROM golang:1.26.10-alpine AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
diff --git a/apps/admin/Dockerfile b/apps/admin/Dockerfile
index 3e9b45a..e67f6f6 100644
--- a/apps/admin/Dockerfile
+++ b/apps/admin/Dockerfile
@@ -4,7 +4,7 @@
 #   docker build -f apps/admin/Dockerfile .
 # No RUN --mount=type=cache: Railway's builder rejects cache mounts without
 # an id tied to one service ID, and the go.mod layer below caches modules.
-FROM golang:1.26.8-alpine AS build
+FROM golang:1.26.10-alpine AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
diff --git a/apps/backup/Dockerfile b/apps/backup/Dockerfile
index 3021a91..4b48850 100644
--- a/apps/backup/Dockerfile
+++ b/apps/backup/Dockerfile
@@ -6,7 +6,7 @@
 #   docker build -f apps/backup/Dockerfile .
 # No RUN --mount=type=cache: Railway's builder rejects cache mounts without
 # an id tied to one service ID, and the go.mod layer below caches modules.
-FROM golang:1.26.8-alpine AS build
+FROM golang:1.26.10-alpine AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
diff --git a/deploy/go.mod b/deploy/go.mod
index 515d2f9..4db0fe0 100644
--- a/deploy/go.mod
+++ b/deploy/go.mod
@@ -1,6 +1,6 @@
 module github.com/jayleaton/go-fast-stack/deploy
 
-go 1.26.8
+go 1.26.10
 
 require (
 	github.com/railwayapp/railway-go-sdk v0.6.0
diff --git a/docs/BUILD-PLAN.md b/docs/BUILD-PLAN.md
index f4508d1..02dfc35 100644
--- a/docs/BUILD-PLAN.md
+++ b/docs/BUILD-PLAN.md
@@ -5,7 +5,7 @@ Same architecture patterns, same feature set, rebuilt in Go for simpler maintena
 
 ## Decisions (JJ, 2026-10-22)
 
-- Language: Go (toolchain pinned in `mise.toml`, currently 1.26.8). **One Go module** at the repo root: `github.com/jayleaton/go-fast-stack`.
+- Language: Go (toolchain pinned in `mise.toml`, currently 1.26.10). **One Go module** at the repo root: `github.com/jayleaton/go-fast-stack`.
 - UI: server-rendered `templ` + **Datastar** (SSE-first; core library only, no Datastar Pro features) + Tailwind via the **standalone CLI** (no Node in the web toolchain).
 - Auth: **Go-native**, its own package `packages/auth`, modelled on Better Auth (table names, endpoint paths, flows) so Better Auth features can be ported later.
 - Database: Postgres 18, `pgx/v5`, `sqlc` for typed queries, `goose` migrations embedded in the binary.
diff --git a/go.mod b/go.mod
index aa5562b..f7b6a02 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/jayleaton/go-fast-stack
 
-go 1.26.8
+go 1.26.10
 
 require (
 	filippo.io/age v1.3.2
diff --git a/mise.toml b/mise.toml
index 9909bc7..5de22d1 100644
--- a/mise.toml
+++ b/mise.toml
@@ -1,4 +1,4 @@
 [tools]
-go = "1.26.8"
+go = "1.26.10"
 # Secrets (optional): make doppler-setup, USE_DOPPLER=1 make dev.
 doppler = "3.77.0"
diff --git a/tools/actionlint/go.mod b/tools/actionlint/go.mod
index 55d91d8..56ae459 100644
--- a/tools/actionlint/go.mod
+++ b/tools/actionlint/go.mod
@@ -1,6 +1,6 @@
 module github.com/jayleaton/go-fast-stack/tools/actionlint
 
-go 1.26.8
+go 1.26.10
 
 tool github.com/rhysd/actionlint/cmd/actionlint
 
diff --git a/tools/go.mod b/tools/go.mod
index 7bae5e9..5b82a52 100644
--- a/tools/go.mod
+++ b/tools/go.mod
@@ -1,6 +1,6 @@
 module github.com/jayleaton/go-fast-stack/tools
 
-go 1.26.8
+go 1.26.10
 
 tool (
 	github.com/golangci/golangci-lint/v2/cmd/golangci-lint