diff --git a/.changeset/go-1-27-3-emudhra.md b/.changeset/go-1-27-3-emudhra.md
new file mode 100644
index 00000000..e3e8b7d5
--- /dev/null
+++ b/.changeset/go-1-27-3-emudhra.md
@@ -0,0 +1,5 @@
+---
+"cre-cli": patch
+---
+
+Build the CLI with Go 1.27.3, which distrusts the eight compromised eMudhra (emSign) intermediate CAs (CVE-2026-111943). Earlier builds accept TLS certificates issued from those keys, so an attacker on the network path could impersonate the CRE API, login, Vault gateway or RPC endpoints the CLI connects to. Release builds now take the Go version from `go.mod`.
diff --git a/.github/workflows/build-and-release.yml b/.github/workflows/build-and-release.yml
index 29f2aea4..1c2322fd 100644
--- a/.github/workflows/build-and-release.yml
+++ b/.github/workflows/build-and-release.yml
@@ -24,7 +24,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # actions/setup-go@v5.2.0
         with:
-          go-version: "1.25"
+          go-version-file: go.mod
 
       - name: Setup GitHub Token
         id: setup-github-token
@@ -149,7 +149,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # actions/setup-go@v5.2.0
         with:
-          go-version: "1.25"
+          go-version-file: go.mod
 
       - name: Setup GitHub Token
         id: setup-github-token
@@ -250,7 +250,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # actions/stup-go@v5.2.0
         with:
-          go-version: "1.25"
+          go-version-file: go.mod
 
       - name: Setup GitHub Token
         id: setup-github-token
diff --git a/.github/workflows/preview-build.yml b/.github/workflows/preview-build.yml
index 13b119b6..dee1a094 100644
--- a/.github/workflows/preview-build.yml
+++ b/.github/workflows/preview-build.yml
@@ -21,7 +21,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # actions/setup-go@v5.2.0
         with:
-          go-version: "1.25"
+          go-version-file: go.mod
 
       - name: Install Dependencies
         run: |
@@ -72,7 +72,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # actions/setup-go@v5.2.0
         with:
-          go-version: "1.25"
+          go-version-file: go.mod
 
       - name: Build the Go Binary
         env:
@@ -107,7 +107,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # stup-go@v5.2.0
         with:
-          go-version: "1.25"
+          go-version-file: go.mod
 
       - name: Install Dependencies
         shell: pwsh
diff --git a/.github/workflows/pull-request-main.yml b/.github/workflows/pull-request-main.yml
index ad9a6dbd..e17bc029 100644
--- a/.github/workflows/pull-request-main.yml
+++ b/.github/workflows/pull-request-main.yml
@@ -25,7 +25,7 @@ jobs:
         uses: smartcontractkit/.github/actions/ci-lint-go@31f7a923a25f7672641b5099cbb85ce4a984fc05 # ci-lint-go@3.1.0
         with:
           only-new-issues: false
-          golangci-lint-version: v2.13.1
+          golangci-lint-version: v2.15.0
           aws-region: ${{ secrets.AWS_REGION }}
           use-gati: "true"
           aws-role-arn-gati: ${{ secrets.AWS_OIDC_DEV_PLATFORM_READ_REPOS_EXTERNAL_TOKEN_ISSUER_ROLE_ARN }}
diff --git a/.tool-versions b/.tool-versions
index 71d117e2..db771c08 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1,5 +1,5 @@
-golang 1.26.2
-golangci-lint 2.11.2
+golang 1.27.3
+golangci-lint 2.15.0
 goreleaser 2.0.1
 python 3.10.5
 nodejs 20.13.1
diff --git a/go.mod b/go.mod
index e62a4fa0..6866e5be 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/smartcontractkit/cre-cli
 
-go 1.27.1
+go 1.27.3
 
 require (
 	github.com/BurntSushi/toml v1.6.0
diff --git a/internal/ui/progress.go b/internal/ui/progress.go
index bc18fdd6..780d0208 100644
--- a/internal/ui/progress.go
+++ b/internal/ui/progress.go
@@ -112,32 +112,33 @@ func DownloadWithProgress(resp io.ReadCloser, contentLength int64, destFile *os.
 		},
 	}
 
-	// Start download in goroutine
-	errCh := make(chan error, 1)
+	// Start download in goroutine. The result is reported to the model via
+	// p.Send; copyDone only signals that the goroutine has exited.
+	copyDone := make(chan struct{})
 	go func() {
+		defer close(copyDone)
 		_, err := io.Copy(pw, resp)
 		if err != nil {
 			p.Send(progressErrMsg{err: err})
 		} else {
 			p.Send(progressDoneMsg{})
 		}
-		errCh <- err
 	}()
 
 	// Run the UI — blocks until done, error, or Ctrl+C
 	finalModel, err := p.Run()
 	if err != nil {
 		// Bubble Tea itself failed. Close the response body to unblock the
-		// download goroutine, then drain the channel so it can exit.
+		// download goroutine, then wait for it to exit.
 		resp.Close()
-		<-errCh
+		<-copyDone
 		return err
 	}
 
 	// Close the response body so the download goroutine's io.Copy finishes.
 	// For a completed download this is a no-op; for Ctrl+C it unblocks io.Copy.
 	resp.Close()
-	<-errCh
+	<-copyDone
 
 	// If the user pressed Ctrl+C, the model is not done — treat as cancellation
 	if fm, ok := finalModel.(downloadModel); ok && !fm.done {