diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5bf6413..841ce7e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -43,6 +43,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
 ### Security
 
+- Bump Go to 1.26.10 to pick up the fix for GO-2026-6809 (crypto/x509), which `govulncheck` now reports against 1.26.9.
 - A small `CUDLY_MCP_MAX_COUNT` no longer admits an enormous purchase (50 x
   `u-24tb1` is about $286M): the USD cap bounds the real total.
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 16fa7ae..8152faa 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -48,7 +48,7 @@ By participating in this project, you agree to maintain a respectful and inclusi
 
 ### Prerequisites
 
-- Go 1.26.9 or later (the floor set by the `go` directive in `go.mod`)
+- Go 1.26.10 or later (the floor set by the `go` directive in `go.mod`)
 - Git
 
 ### Getting Started
@@ -85,7 +85,7 @@ from a copy of the committed `go.work` and append your active worktrees:
 // go.work.local -- gitignored, developer-local
 // Keep this `go` line at or above the modules' own directive, otherwise the
 // workspace is rejected. Copy it from the committed go.work.
-go 1.26.9
+go 1.26.10
 
 use (
     .
diff --git a/README.md b/README.md
index 42d5911..0bb5663 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ Every purchase tool is dry-run by default (`dry_run=true`) and requires an expli
 
 ## Install
 
-Use Go 1.26.9, as declared by this module. The shared Go modules are published and pinned in `go.mod`, so this checkout builds on its own. From this checkout:
+Use Go 1.26.10, as declared by this module. The shared Go modules are published and pinned in `go.mod`, so this checkout builds on its own. From this checkout:
 
 ```bash
 make build
diff --git a/go.mod b/go.mod
index 8056ead..6e4994f 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/LeanerCloud/cloud-commitments-mcp
 
-go 1.26.9
+go 1.26.10
 
 require (
 	github.com/aws/aws-sdk-go-v2 v1.47.3
diff --git a/go.work b/go.work
index e3dba14..2c6c8ae 100644
--- a/go.work
+++ b/go.work
@@ -1,3 +1,3 @@
-go 1.26.9
+go 1.26.10
 
 use .