diff --git a/Dockerfile b/Dockerfile
index 96310e7..19e4341 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 # Build the krop-controller binary (the single kcp controller at ./cmd/controller).
 # Multi-arch: the builder runs on $BUILDPLATFORM and cross-compiles Go to $TARGETARCH;
 # the distroless runtime stage has no RUN, so amd64+arm64 needs no QEMU.
-FROM --platform=$BUILDPLATFORM golang:1.27@sha256:f44f6e88636cfb311f9ebace870ded69d943f227bb3cb27d32ffd84ea18c43ea AS build
+FROM --platform=$BUILDPLATFORM golang:1.27@sha256:e432b43af23a9328d56a7c499be0476810aa344acbcf65fc7c455d4ff5a40602 AS build
 ARG TARGETOS
 ARG TARGETARCH
 ARG VERSION=dev
diff --git a/flake.nix b/flake.nix
index b7d6471..acd8ac4 100644
--- a/flake.nix
+++ b/flake.nix
@@ -24,7 +24,7 @@
       {
         devShells.default = dev-kit.lib.mkShell {
           inherit system;
-          goVersion = "1.27.1";
+          goVersion = "1.27.2";
           # Private module host: skip the public proxy/sumdb for our GitLab modules.
           env.GOPRIVATE = "gitlab.opendefense.cloud";
         };
diff --git a/go.mod b/go.mod
index 1b79063..e68287b 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module go.opendefense.cloud/krop-controller
 
-go 1.27.1
+go 1.27.2
 
 require (
 	github.com/kcp-dev/logicalcluster/v3 v3.0.5