diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 56d8f7e..798ec8e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -62,9 +62,10 @@ jobs:
 
       - name: Run security scan
         if: matrix.os == 'linux' && matrix.arch == 'amd64'
-        run: |
-          go install github.com/securego/gosec/v2/cmd/gosec@latest
-          gosec -exclude=G304 ./...
+        uses: golangci/golangci-lint-action@v9
+        with:
+          version: v2.14.0
+          args: --no-config --enable-only=gosec --tests=false --timeout=5m
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 182d640..f9160b1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [v0.4.7] - 2026-10-13
+
+### Fixed
+- Release security scan now runs gosec through golangci-lint (`--enable-only=gosec --tests=false`). The previous `go install gosec@latest` step failed on Go 1.27.2 with `export data version 5 is greater than maximum supported version 4`, so v0.4.6 was not released
+- Release tests and security scan run before image build and publishing
+
 ## [v0.4.6] - 2026-10-13
 
 ### Fixed
diff --git a/Makefile b/Makefile
index e5be5a0..cd8527e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,5 @@
 BINARY_NAME := bucketsyncd
-VERSION := 0.4.6
+VERSION := 0.4.7
 
 LDFLAGS=-ldflags "-X main.version=$(VERSION)"
 
diff --git a/debian/changelog b/debian/changelog
index abcfbb1..c867bf3 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+bucketsyncd (0.4.7-1) unstable; urgency=medium
+
+  * Fix: release security scan runs gosec via golangci-lint; go install gosec failed on Go 1.27.2 export data
+
+ -- Ross Golder <ross@golder.org>  Tue, 13 Oct 2026 00:00:00 +0000
+
 bucketsyncd (0.4.6-1) unstable; urgency=medium
 
   * Build: Go 1.27.2 and golangci-lint v2.14.0
diff --git a/main.go b/main.go
index 03cc7a7..12ec633 100644
--- a/main.go
+++ b/main.go
@@ -13,7 +13,7 @@ import (
 )
 
 var (
-	version   = "v0.4.6"
+	version   = "v0.4.7"
 	buildTime = "unknown"
 	gitCommit = "unknown"
 )