diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fc459ae..059f697 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,7 +50,7 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v9.3.0
         with:
-          version: v2.13.2
+          version: v2.15.0
           args: ./...
 
   minimum-go:
diff --git a/.github/workflows/release-legacy.yml b/.github/workflows/release-legacy.yml
index 2802524..6d0efa6 100644
--- a/.github/workflows/release-legacy.yml
+++ b/.github/workflows/release-legacy.yml
@@ -25,7 +25,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.26.x"
+          go-version-file: go.mod
           cache: true
 
       - name: Stash GoReleaser config
diff --git a/.github/workflows/release-unified.yml b/.github/workflows/release-unified.yml
index eefcd56..58376f4 100644
--- a/.github/workflows/release-unified.yml
+++ b/.github/workflows/release-unified.yml
@@ -7,6 +7,11 @@ on:
         description: "Version to release (for example, 0.3.5)"
         required: true
         type: string
+      dry_run:
+        description: "Build and verify without publishing a release or creating tags"
+        required: false
+        default: false
+        type: boolean
 
 permissions: {}
 
@@ -21,6 +26,7 @@ jobs:
     uses: openclaw/release-workflows/.github/workflows/release-go-cli.yml@v1
     with:
       version: ${{ inputs.version }}
+      dry-run: ${{ inputs.dry_run }}
       repository-type: personal
       homebrew-tap: steipete/homebrew-tap
       homebrew-formula: sonoscli
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 66fefdd..ed8831c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,7 +9,8 @@
 - Label initial `watch` notifications with the correct service even when they arrive before subscription setup finishes.
 
 ### Changed
-- Prefer Go 1.26.8 for source, CI, and Docker builds while retaining Go 1.26 compatibility; refresh lint tooling, the Dockerfile frontend, and pinned documentation workflow actions.
+- Prefer Go 1.27.3 for source, CI, Docker, and release builds to fix reachable standard-library vulnerabilities while retaining Go 1.26 compatibility; refresh lint tooling, the Dockerfile frontend, and pinned documentation workflow actions.
+- Allow release workflow dry runs to build and verify the current version without creating tags or publishing a release.
 
 ## [0.3.4] - 2026-07-17
 
diff --git a/Dockerfile b/Dockerfile
index fd85c06..cb2196e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.27.0
 
-ARG GO_VERSION=1.26.8
+ARG GO_VERSION=1.27.3
 
 FROM golang:${GO_VERSION}-bookworm AS build
 WORKDIR /src
diff --git a/docs/testing.md b/docs/testing.md
index 45663dc..0017e46 100644
--- a/docs/testing.md
+++ b/docs/testing.md
@@ -28,7 +28,8 @@ Expected:
 - All commands exit `0`
 - CI should match `.github/workflows/ci.yml` (`gofmt`, coverage, `golangci-lint`, race tests, `go vet`)
 - CI enforces a minimum total coverage of `75%` (statement coverage across `./...`) and a focused `85%` floor for the stream proxy package.
-- The main CI job uses the preferred Go 1.26.8 toolchain from `go.mod`; a separate job tests the Go 1.26.0 source minimum with automatic toolchain switching disabled.
+- The main CI job uses the preferred Go 1.27.3 toolchain from `go.mod`; a separate job tests the Go 1.26.0 source minimum with automatic toolchain switching disabled. Docker and release builds use the same patched toolchain.
+- To verify release builds without publishing or creating tags, dispatch `release-unified.yml` on `main` with the current version and `dry_run: true`.
 
 ## Live network test plan (manual)
 
diff --git a/go.mod b/go.mod
index 56b1167..d17f3b8 100644
--- a/go.mod
+++ b/go.mod
@@ -2,7 +2,7 @@ module github.com/steipete/sonoscli
 
 go 1.26
 
-toolchain go1.26.8
+toolchain go1.27.3
 
 require github.com/spf13/cobra v1.10.2
 
diff --git a/internal/streamproxy/server_test.go b/internal/streamproxy/server_test.go
index de65269..e6ec82b 100644
--- a/internal/streamproxy/server_test.go
+++ b/internal/streamproxy/server_test.go
@@ -424,7 +424,10 @@ func TestServeHandlesStreamOverHTTP(t *testing.T) {
 
 	cancel()
 	select {
-	case <-errCh:
+	case err := <-errCh:
+		if err != nil {
+			t.Fatalf("serve returned error: %v", err)
+		}
 	case <-time.After(2 * time.Second):
 		t.Fatalf("server did not stop")
 	}
@@ -478,7 +481,10 @@ func TestServeHandlesMultipleTracks(t *testing.T) {
 
 	cancel()
 	select {
-	case <-errCh:
+	case err := <-errCh:
+		if err != nil {
+			t.Fatalf("serve returned error: %v", err)
+		}
 	case <-time.After(2 * time.Second):
 		t.Fatalf("server did not stop")
 	}