diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 05d2f10..e5c6209 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -22,7 +22,7 @@ jobs:
         with:
           go-version-file: go.mod
           cache: true
-      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           languages: go
-      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 552fae3..de5d160 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -49,7 +49,7 @@ jobs:
 
       - name: TruffleHog OSS
         id: trufflehog
-        uses: trufflesecurity/trufflehog@e76dff8a7e57d6df0c60ad8cbf5d5cba505a8fc9 # v3.99.2
+        uses: trufflesecurity/trufflehog@e63326d6545de8f425d93ce24078c6e68d83f70e # v3.99.3
         with:
           path: ./
           base: ${{ steps.scan_range.outputs.base }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 306ee71..bc1240a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,7 @@
 
 ## Unreleased
 
+- Update govulncheck to v1.9.0, CodeQL to v4.39.0, and TruffleHog to v3.99.3 for current security analysis tooling while retaining the Go 1.27.0 minimum.
 - Move macOS release preflight to Xcode 27, retaining macOS 13 deployment checks and verifying Intel execution through Rosetta.
 
 - Fix Crabbox hydration readiness and shutdown with lease-scoped state files, and allow automatic local hydration by omitting an unsupported explicit cache option.
diff --git a/Makefile b/Makefile
index 48a6007..8262e53 100644
--- a/Makefile
+++ b/Makefile
@@ -53,7 +53,7 @@ lint: vet
 	trap 'rm -f "$$output_file"' 0; \
 	GOWORK=off go run golang.org/x/tools/cmd/deadcode@v0.52.0 -test ./... > "$$output_file"; \
 	if [ -s "$$output_file" ]; then cat "$$output_file"; exit 1; fi
-	GOWORK=off go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 ./...
+	GOWORK=off go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 ./...
 
 check: tidy-check fmt lint test test-race test-release