diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index dd905f072..69aea88c1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -7,9 +7,6 @@ on:
         required: true
         type: string
         default: ''
-      go_version:
-        required: true
-        type: string
 
   workflow_dispatch:
     inputs:
@@ -45,7 +42,7 @@ jobs:
 
     - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
-        go-version: ${{ inputs.go_version }}
+        go-version-file: go.mod
         cache: false
 
     - name: Display Go version
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cd0946a72..112f8836e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,10 +13,6 @@ on:
         required: false
         type: string
         default: "no"
-      go_version:
-        required: false
-        type: string
-        default: "1.27.2"
       # Optional overrides of the e2e runners and environment versions. An
       # empty value selects the default in vm_test.yml.
       runners:
@@ -72,7 +68,6 @@ jobs:
     uses: ./.github/workflows/lint.yml
     with:
       ref: ${{ inputs.ref }}
-      go_version: ${{ inputs.go_version }}
     secrets: inherit
 
   build:
@@ -81,7 +76,6 @@ jobs:
     uses: ./.github/workflows/build.yml
     with:
       ref: ${{ inputs.ref }}
-      go_version: ${{ inputs.go_version }}
     secrets: inherit
 
   unit_test:
@@ -90,7 +84,6 @@ jobs:
     uses: ./.github/workflows/unit_test.yml
     with:
       ref: ${{ inputs.ref }}
-      go_version: ${{ inputs.go_version }}
     secrets: inherit
 
   vm_test:
diff --git a/.github/workflows/ci_main.yml b/.github/workflows/ci_main.yml
index c41c4c08f..91cd62bf4 100644
--- a/.github/workflows/ci_main.yml
+++ b/.github/workflows/ci_main.yml
@@ -21,7 +21,6 @@ jobs:
     uses: ./.github/workflows/build.yml
     with:
       ref: ${{ github.sha }}
-      go_version: "1.27.2"
 
   release:
     name: Rolling release
diff --git a/.github/workflows/ci_nightly.yml b/.github/workflows/ci_nightly.yml
index 139176cbc..f8edc6368 100644
--- a/.github/workflows/ci_nightly.yml
+++ b/.github/workflows/ci_nightly.yml
@@ -22,14 +22,12 @@ jobs:
     uses: ./.github/workflows/build.yml
     with:
       ref: ${{ github.sha }}
-      go_version: "1.27.2"
 
   unit_test:
     name: Unit tests
     uses: ./.github/workflows/unit_test.yml
     with:
       ref: ${{ github.sha }}
-      go_version: "1.27.2"
 
   vm_test:
     needs: [build]
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index d71929b15..6087a3496 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -6,9 +6,6 @@ on:
         required: true
         type: string
         default: ''
-      go_version:
-        required: true
-        type: string
 
 permissions:
   contents: read
@@ -36,7 +33,7 @@ jobs:
           ref: ${{ inputs.ref }}
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: ${{ inputs.go_version }}
+          go-version-file: go.mod
           cache: false
       - name: golangci-lint
         uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
diff --git a/.github/workflows/unit_test.yml b/.github/workflows/unit_test.yml
index 96940d70a..2e7971e81 100644
--- a/.github/workflows/unit_test.yml
+++ b/.github/workflows/unit_test.yml
@@ -7,9 +7,6 @@ on:
         type: string
         default: ''
         required: true
-      go_version:
-        required: true
-        type: string
 
 permissions:
   contents: read
@@ -41,7 +38,7 @@ jobs:
 
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: ${{ inputs.go_version }}
+          go-version-file: go.mod
           cache: false
 
       - name: Run unikontainers pkg unit tests
diff --git a/.github/workflows/vm_test.yml b/.github/workflows/vm_test.yml
index b5530956b..65c3ef2c4 100644
--- a/.github/workflows/vm_test.yml
+++ b/.github/workflows/vm_test.yml
@@ -48,7 +48,6 @@ permissions:
 # unset inputs as empty strings, which skip an input's default, hence the
 # fallbacks.
 env:
-  GO_VERSION: '1.27.2'
   RUNC_VERSION: ${{ inputs.runc_version || '1.3.0' }}
   CONTAINERD_VERSION: ${{ inputs.containerd_version || '2.3.7' }}
   CNI_VERSION: ${{ inputs.cni_version || '1.7.1' }}
@@ -79,7 +78,7 @@ jobs:
           exit 1
         fi
         echo "ARCH=${ARCH}" >> "$GITHUB_ENV"
-        for var in GO_VERSION RUNC_VERSION CONTAINERD_VERSION CNI_VERSION \
+        for var in RUNC_VERSION CONTAINERD_VERSION CNI_VERSION \
                    NERDCTL_VERSION CRICTL_VERSION FIRECRACKER_VERSION \
                    CLOUD_HYPERVISOR_VERSION SOLO5_VERSION HLUK_VERSION; do
           value="${!var}"
@@ -101,7 +100,7 @@ jobs:
 
     - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
-        go-version: ${{ env.GO_VERSION }}
+        go-version-file: go.mod
         cache: false
 
     - name: Install base dependencies
diff --git a/deployment/urunc-deploy/Dockerfile b/deployment/urunc-deploy/Dockerfile
index f2f2fd646..b5830d654 100644
--- a/deployment/urunc-deploy/Dockerfile
+++ b/deployment/urunc-deploy/Dockerfile
@@ -38,7 +38,7 @@ WORKDIR /artifacts
 RUN cp /app/tenders/hvt/solo5-hvt /artifacts/ && \
     cp /app/tenders/spt/solo5-spt /artifacts/
 
-FROM golang:1.27.2-alpine3.24@sha256:f92b6ef800e499660581efdabdf25d9d817a9d124eaf900924f0504e7e27e12d AS urunc-builder
+FROM golang:1.27.3-alpine3.24@sha256:b8c9b82affbbb82a020bbcf998dad2ba9516944ac7e883524642a481a9505e9c AS urunc-builder
 # COMMIT is passed from CI (first 7 chars of GITHUB_SHA) so that
 # `git describe --dirty` is not used inside the build context,
 # preventing a -dirty suffix in the embedded version string.
diff --git a/docs/installation.md b/docs/installation.md
index 1576bd2b4..05b8f94dc 100644
--- a/docs/installation.md
+++ b/docs/installation.md
@@ -513,7 +513,7 @@ To install `urunc`, there are three options:
 
 #### Option 1: Building from source
 
-In order to build `urunc` from source, any version of Go 1.20.6 or later should
+In order to build `urunc` from source, recent version of Go should
 be sufficient. Let's download Go [[versions.go ]]
 
 ```bash
diff --git a/docs/quickstart.md b/docs/quickstart.md
index 2c6f76a63..796a7efde 100644
--- a/docs/quickstart.md
+++ b/docs/quickstart.md
@@ -39,7 +39,7 @@ Then we need `urunc`:
 ```bash
 sudo apt install -y git make
 git clone https://github.com/urunc-dev/urunc.git
-docker run --rm -ti -v $PWD/urunc:/urunc -w /urunc golang:1.25 bash -c "git config --global --add safe.directory /urunc && make"
+docker run --rm -ti -v $PWD/urunc:/urunc -w /urunc golang:[[ versions.go ]] bash -c "git config --global --add safe.directory /urunc && make"
 sudo make -C urunc install
 ```
 
diff --git a/docs/variables/versions.yml b/docs/variables/versions.yml
index 5e53a3bdf..604e0fd58 100644
--- a/docs/variables/versions.yml
+++ b/docs/variables/versions.yml
@@ -1,5 +1,5 @@
 versions:
-  go: "1.27.2"
+  go: "1.27.3"
   nerdctl: "2.1.3"
   docker: "28.3.3"
   containerd: "2.3.7"
diff --git a/go.mod b/go.mod
index e4da74c26..2935fd1b9 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,8 @@ module github.com/urunc-dev/urunc
 
 go 1.26.8
 
+toolchain go1.27.3
+
 require (
 	github.com/BurntSushi/toml v1.6.0
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2