diff --git a/.github/workflows/pr-govulncheck.yaml b/.github/workflows/pr-govulncheck.yaml
index f85e037..9f04e3c 100644
--- a/.github/workflows/pr-govulncheck.yaml
+++ b/.github/workflows/pr-govulncheck.yaml
@@ -10,6 +10,7 @@ on:
       - 'go.mod'
       - 'go.sum'
       - 'vendor/**'
+      - '.go-version'
       - '.github/workflows/pr-govulncheck.yaml'
   schedule:
     - cron: '17 4 * * 1' # weekly, so new CVEs against unchanged code still get flagged
@@ -23,4 +24,5 @@ jobs:
     steps:
       - uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0
         with:
+          go-version-input: '' # the action defaults this to the latest Go, which overrides the file and hides bugs in the Go we ship
           go-version-file: ./.go-version
diff --git a/.go-version b/.go-version
index f250c8f..3cd33cd 100644
--- a/.go-version
+++ b/.go-version
@@ -1 +1 @@
-1.26.6
+1.26.9
diff --git a/CHANGELOG.md b/CHANGELOG.md
index bc7839c..d9c5e45 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,7 @@
+## v1.3.5 (2026-10-20)
+
+- build with Go 1.26.9 for its fixes to the standard library's HTTP and TLS code, mostly ways a misbehaving connection could stall or crash the program (CVE-2026-78667, CVE-2026-78669, CVE-2026-97031 and others); govulncheck finds tctest reaches several of them, and the binary now scans clean ([#152](https://github.com/katbyte/tctest/pull/152))
+
 ## v1.3.4 (2026-09-22)
 
 - bump golang.org/x/text to v0.42.0 for CVE-2026-56852, a hang on invalid UTF-8 input; tctest never calls the affected code, but the binary now scans clean ([#148](https://github.com/katbyte/tctest/pull/148))
diff --git a/go.mod b/go.mod
index 4b60f38..2939233 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/katbyte/tctest
 
-go 1.26.6
+go 1.26.9
 
 require (
 	github.com/google/go-github/v89 v89.0.0