diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..c2b519d
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,44 @@
+version: 2
+
+# Version updates use GitHub's default three-day cooldown; security fixes do not.
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      minor-and-patch:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
+      security-updates:
+        applies-to: security-updates
+        patterns:
+          - "*"
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: docker
+    directory: /docker
+    schedule:
+      interval: weekly
+    # Keep Ubuntu digest updates; release changes are deliberate platform choices.
+    ignore:
+      - dependency-name: ubuntu
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+          - version-update:semver-patch
+    groups:
+      docker:
+        patterns:
+          - "*"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a463c2c..f41d6dd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,13 +10,15 @@ permissions:
 jobs:
   test:
     runs-on: ubuntu-26.04
+    env:
+      GOTOOLCHAIN: local
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
       - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
-          go-version: '1.27.3'
+          go-version-file: go.mod
           cache: true
       - name: SDK fixture paths
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 39b6e97..c0dafab 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -57,6 +57,7 @@ jobs:
           REF_NAME: ${{ github.ref_name }}
         run: |
           commit=$(git rev-parse HEAD)
+          go_version=$(awk '$1 == "go" {print $2}' go.mod)
           release=$(< VERSION)
           [[ "$release" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]] || {
             echo 'VERSION must be MAJOR.MINOR.PATCH, without a v prefix, leading zeroes, prerelease suffixes, or build metadata.' >&2
@@ -72,6 +73,7 @@ jobs:
           fi
           {
             echo "version=$version"
+            echo "go=$go_version"
             echo "commit=$commit"
             echo "epoch=$(git show -s --format=%ct HEAD)"
             echo "bundle=livepeer-${version}-linux-${ARCH}"
@@ -105,14 +107,15 @@ jobs:
         env:
           RELEASE_VERSION: ${{ steps.metadata.outputs.version }}
           RELEASE_COMMIT: ${{ steps.metadata.outputs.commit }}
+          RELEASE_GO_VERSION: ${{ steps.metadata.outputs.go }}
           SOURCE_DATE_EPOCH: ${{ steps.metadata.outputs.epoch }}
           BUNDLE: ${{ steps.metadata.outputs.bundle }}
         run: |
           mkdir -p dist "$RUNNER_TEMP/package/$BUNDLE/bin"
           cp "$RUNNER_TEMP/bin/"* "$RUNNER_TEMP/package/$BUNDLE/bin/"
           cp LICENSE "$RUNNER_TEMP/package/$BUNDLE/"
-          printf 'version=%s\ncommit=%s\ngo=go1.27.3\nos=linux\narch=%s\n' \
-            "$RELEASE_VERSION" "$RELEASE_COMMIT" "$ARCH" > "$RUNNER_TEMP/package/$BUNDLE/VERSION"
+          printf 'version=%s\ncommit=%s\ngo=go%s\nos=linux\narch=%s\n' \
+            "$RELEASE_VERSION" "$RELEASE_COMMIT" "$RELEASE_GO_VERSION" "$ARCH" > "$RUNNER_TEMP/package/$BUNDLE/VERSION"
           (
             cd "$RUNNER_TEMP/package/$BUNDLE"
             sha256sum bin/* > SHA256SUMS
diff --git a/README.md b/README.md
index a69649e..97f14e3 100644
--- a/README.md
+++ b/README.md
@@ -20,7 +20,7 @@ configuration.
 
 ## Build
 
-Install Go 1.27.3 or newer, then run from the repository root:
+Install the Go version declared in [go.mod](go.mod) or newer, then run from the repository root:
 
 ```sh
 make build
diff --git a/cmd/livepeer/integration_test.go b/cmd/livepeer/integration_test.go
index 6e75162..ef65bf9 100644
--- a/cmd/livepeer/integration_test.go
+++ b/cmd/livepeer/integration_test.go
@@ -253,8 +253,12 @@ func checkGoSDK(t *testing.T, root, serviceURL, runnerURL string) {
 	if sdkDir == "" {
 		return
 	}
+	module := exec.Command("go", "list", "-m", "-f", "{{.GoVersion}}")
+	module.Dir = root
+	goVersion, err := module.Output()
+	require.NoError(t, err)
 	dir := t.TempDir()
-	goMod := "module sdkcompat\n\ngo 1.27.3\n\nrequire github.com/livepeer/golang-runner v0.0.0\n\nreplace github.com/livepeer/golang-runner => " + sdkDir + "\n"
+	goMod := fmt.Sprintf("module sdkcompat\n\ngo %s\n\nrequire github.com/livepeer/golang-runner v0.0.0\n\nreplace github.com/livepeer/golang-runner => %s\n", strings.TrimSpace(string(goVersion)), sdkDir)
 	require.NoError(t, os.WriteFile(filepath.Join(dir, "go.mod"), []byte(goMod), 0600))
 	source, err := os.ReadFile(filepath.Join(root, "cmd", "livepeer", "testdata", "go_sdk_compat.go"))
 	require.NoError(t, err)
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 4c1da92..3e9cfc8 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -4,7 +4,8 @@ ENV CGO_ENABLED=0 GOTOOLCHAIN=local GOENV=off GOWORK=off \
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN sha256sum go.mod go.sum > /tmp/modules.sha256 && \
-    test "$(go env GOVERSION)" = go1.27.3 && go mod download && go mod verify && \
+    test "$(go env GOVERSION)" = "go$(awk '$1 == "go" {print $2}' go.mod)" && \
+    go mod download && go mod verify && \
     sha256sum -c /tmp/modules.sha256
 COPY . .
 ARG TARGETOS
diff --git a/docs/development.md b/docs/development.md
index 9cf0e9f..99b2216 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -1,6 +1,8 @@
 # Development
 
-The module requires Go 1.27.3 or newer. Build all executables with:
+The minimum Go version is declared in [go.mod](../go.mod). CI and release metadata
+use that version; keep the digest-pinned Go builder in `docker/Dockerfile` aligned
+with it. Build all executables with:
 
 ```sh
 make build