diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 50b7b40..9de05e2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,7 +38,9 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: stable
+          # The module declares its toolchain; `stable` moved to 1.27 under a
+          # golangci-lint built with 1.26, which panics on the newer stdlib.
+          go-version-file: src/go.mod
       # One gate, defined once, in the Makefile. Reimplementing these steps here
       # let the local `make check` and CI drift apart silently.
       - name: Gate
diff --git a/SECURITY.md b/SECURITY.md
index 1909044..4882055 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -2,7 +2,9 @@
 
 ## Reporting a vulnerability
 
-Please report security vulnerabilities privately to **opensource@simtabi.com**.
+The preferred channel is GitHub private vulnerability reporting: open a private report at <https://github.com/simtabi/ssh-manager/security/advisories/new>. The report stays attached to the repository, with a draft advisory and a CVE request path. Email **security@simtabi.com** if you do not use GitHub.
+
+Please report security vulnerabilities privately to **security@simtabi.com**.
 Do **not** open a public issue for a security report.
 
 Include, where possible: a description of the issue, affected version(s),