diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0eeadf5..e381dae 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,7 +14,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.x'
+          go-version: '1.26.x'
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:
@@ -28,7 +28,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.x'
+          go-version: '1.26.x'
       - name: Run tests
         run: go test -v -race -coverprofile=coverage.out ./...
       - name: Check coverage
@@ -54,7 +54,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.x'
+          go-version: '1.26.x'
       - name: Install ONNX Runtime
         run: |
           ONNX_VERSION=1.16.3
@@ -83,7 +83,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.x'
+          go-version: '1.26.x'
       - name: Run benchmarks
         run: go test -bench=. -benchmem -benchtime=3s ./benchmarks/... 2>/dev/null || echo "No benchmarks yet"
 
@@ -99,7 +99,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.x'
+          go-version: '1.26.x'
       - name: Build CLI
         env:
           GOOS: ${{ matrix.goos }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3fcbd1d..db0a6c8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,7 +19,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.x'
+          go-version: '1.26.x'
       - name: Run tests
         run: go test -race ./...
       - name: Build binaries
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8793029..14fea24 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- CI and release workflows now pin `go-version: '1.26.x'` (was `1.25.x`); unblocks Dependabot rollups that bump `go.mod` to require Go 1.26.0 (e.g. `hugot` v0.7.2).
+
 ### Fixed
 - Replace deprecated `httputil.ReverseProxy.Director` with `Rewrite` in `pkg/proxy/server.go`; `Director` is deprecated since Go 1.26 (SA1019); `Rewrite` achieves the same Host-preservation behaviour and has been available since Go 1.20.