diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a787eb0b..7548956e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -44,7 +44,7 @@ jobs:
       - name: Install golangci-lint
         uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
-          version: v2.11.1  # keep in lockstep with test.yml Lint
+          version: v2.13.1  # keep in lockstep with test.yml Lint
           install-only: true
 
       - name: Cache BATS
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 1a6e7d2c..e3eb9caa 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -77,7 +77,7 @@ jobs:
       - name: Run golangci-lint
         uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
-          version: v2.11.1
+          version: v2.13.1
 
   lint-actions:
     name: GitHub Actions audit
diff --git a/.mise.toml b/.mise.toml
index cb44ff05..0ba32e7a 100644
--- a/.mise.toml
+++ b/.mise.toml
@@ -1,3 +1,3 @@
 [tools]
-go = "1.26.6"
+go = "1.27.0"
 goreleaser = "2.15.4"
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 65e5ecfb..d082813d 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -6,7 +6,7 @@ default_install_hook_types: [pre-commit, pre-push]
 
 repos:
   - repo: https://github.com/golangci/golangci-lint
-    rev: v2.11.1
+    rev: v2.13.1
     hooks:
       - id: golangci-lint
         args: [--timeout=5m]
diff --git a/Makefile b/Makefile
index 8126fa20..a3012f81 100644
--- a/Makefile
+++ b/Makefile
@@ -271,7 +271,7 @@ bench-compare:
 # so local and CI findings agree. govulncheck stays @latest on purpose: pinning
 # it only delays new advisories and Go version support.
 tools:
-	go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.11.1
+	go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.1
 	go install golang.org/x/vuln/cmd/govulncheck@latest
 	@echo "For gitleaks, install via: brew install gitleaks (or see https://github.com/gitleaks/gitleaks)"
 	@echo "For benchstat: go install golang.org/x/perf/cmd/benchstat@latest"
diff --git a/docs/install.md b/docs/install.md
index a55619d1..c14abbd7 100644
--- a/docs/install.md
+++ b/docs/install.md
@@ -60,9 +60,9 @@ nix profile install github:basecamp/hey-cli
 go install github.com/basecamp/hey-cli/cmd/hey@latest
 ```
 
-**From source** (requires Go 1.26+; [mise](https://mise.jdx.dev) installs the right version):
+**From source** (requires Go 1.27+; [mise](https://mise.jdx.dev) installs the right version):
 ```bash
-mise install       # install Go 1.26
+mise install       # install Go 1.27
 make install       # build and install into /usr/local/bin/hey
 ```
 
diff --git a/go.mod b/go.mod
index f7554f88..e987b40c 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/basecamp/hey-cli
 
-go 1.26.6
+go 1.27.0
 
 require (
 	charm.land/bubbles/v2 v2.2.0
diff --git a/nix/go.nix b/nix/go.nix
index 4dc38463..b92a75e1 100644
--- a/nix/go.nix
+++ b/nix/go.nix
@@ -1,10 +1,28 @@
-{ go_1_26 }:
+{ lib, fetchurl, go_1_27 }:
 
 # The Go toolchain shared by the package build and the dev shell.
 #
-# Both consumers use this one derivation so the package and `nix develop`
-# cannot drift. flake.lock temporarily selects a NixOS 26.05 snapshot because
-# nixpkgs-unstable still carried Go 1.26.5 when 1.26.6 landed; a normal lock
-# update can return to unstable once it catches up. The nix-build CI job covers
-# every go.mod change and every release tag, so a regression fails closed.
-go_1_26
+# go.mod's `go` directive is the floor; nixpkgs-unstable lagged it at 1.27rc3
+# when go.mod moved to 1.27.0, so the toolchain is rebuilt from the upstream
+# source tarball until nixpkgs catches up. The override is conditional and
+# drops itself once go_1_27 reaches 1.27.0 — delete this file's override and
+# return go_1_27 directly after a `nix flake update` that makes
+# `lib.versionOlder` false. Keep minGo in step with go.mod: a toolchain bump
+# that outpaces flake.lock breaks the build without touching go.mod or go.sum,
+# which is why the nix-build CI job runs on every go.mod change and on tags.
+#
+# Both consumers must use this one derivation. The dev shell once listed
+# the nixpkgs Go directly, which handed `nix develop` a Go older than go.mod's
+# directive — `make build` then failed under GOTOOLCHAIN=local or offline.
+let
+  minGo = "1.27.0";
+in
+if lib.versionOlder go_1_27.version minGo
+then go_1_27.overrideAttrs (_: {
+  version = minGo;
+  src = fetchurl {
+    url = "https://go.dev/dl/go${minGo}.src.tar.gz";
+    hash = "sha256-cAJAPXzERSnvbSb2mkSBgmM5Xq18FsBaWAiuBH6+sOU=";
+  };
+})
+else go_1_27
diff --git a/scripts/check-lint-lockstep.sh b/scripts/check-lint-lockstep.sh
index 1a674364..da6abb01 100755
--- a/scripts/check-lint-lockstep.sh
+++ b/scripts/check-lint-lockstep.sh
@@ -22,7 +22,7 @@ WORKFLOW_DIR=".github/workflows"
 # The oldest golangci-lint every workflow may pin. Raising this is a deliberate
 # act, not housekeeping: move it in the same commit that moves the workflow
 # pins, so the floor and the pins never disagree in a merged tree.
-MIN_VERSION="v2.11.1"
+MIN_VERSION="v2.13.1"
 
 # Compare numerically, field by field, never lexically. As strings v2.9.0
 # sorts *above* v2.11.1 — 9 > 1 — so a lexical test would wave through the exact
diff --git a/tests/e2e/check_release_lockstep.bats b/tests/e2e/check_release_lockstep.bats
index c3183da7..afe9441c 100644
--- a/tests/e2e/check_release_lockstep.bats
+++ b/tests/e2e/check_release_lockstep.bats
@@ -15,7 +15,7 @@ setup() {
   cat > .pre-commit-config.yaml <<'YAML'
 repos:
   - repo: https://github.com/golangci/golangci-lint
-    rev: v2.11.1
+    rev: v2.13.1
     hooks:
       - id: golangci-lint
 YAML
@@ -25,7 +25,7 @@ jobs:
     steps:
       - uses: golangci/golangci-lint-action@abc # v9.3.0
         with:
-          version: v2.11.1
+          version: v2.13.1
       - run: scripts/check-release-lockstep.sh
 YAML
   cat > .github/workflows/security.yml <<'YAML'
@@ -40,7 +40,7 @@ jobs:
     steps:
       - uses: golangci/golangci-lint-action@abc # v9.3.0
         with:
-          version: v2.11.1
+          version: v2.13.1
           install-only: true
       - run: scripts/publish.sh
   release:
@@ -63,7 +63,7 @@ teardown() {
   run scripts/check-release-lockstep.sh
   [ "$status" -eq 0 ]
   [[ "$output" == *"goreleaser pin in lockstep (v2.15.4)"* ]]
-  [[ "$output" == *"pre-commit golangci-lint rev in lockstep (v2.11.1)"* ]]
+  [[ "$output" == *"pre-commit golangci-lint rev in lockstep (v2.13.1)"* ]]
   [[ "$output" == *"gosec pin in lockstep (v2.28.0)"* ]]
   [[ "$output" == *"release lockstep check passed"* ]]
 }
@@ -78,7 +78,7 @@ teardown() {
 }
 
 @test "fails when the pre-commit golangci-lint rev drifts from CI" {
-  sed -i.bak 's/rev: v2.11.1/rev: v2.1.6/' .pre-commit-config.yaml && rm -f .pre-commit-config.yaml.bak
+  sed -i.bak 's/rev: v2.13.1/rev: v2.1.6/' .pre-commit-config.yaml && rm -f .pre-commit-config.yaml.bak
   run scripts/check-release-lockstep.sh
   [ "$status" -eq 1 ]
   [[ "$output" == *"golangci-lint pins disagree"* ]]
@@ -86,7 +86,7 @@ teardown() {
 }
 
 @test "inherits the golangci-lint workflow lockstep failure" {
-  sed -i.bak 's/version: v2.11.1/version: v2.9.0/' .github/workflows/release.yml && rm -f .github/workflows/release.yml.bak
+  sed -i.bak 's/version: v2.13.1/version: v2.9.0/' .github/workflows/release.yml && rm -f .github/workflows/release.yml.bak
   run scripts/check-release-lockstep.sh
   [ "$status" -eq 1 ]
   [[ "$output" == *"golangci-lint pins disagree across workflows"* ]]
diff --git a/tests/smoke/go.mod b/tests/smoke/go.mod
index 633fbfd6..1c62af16 100644
--- a/tests/smoke/go.mod
+++ b/tests/smoke/go.mod
@@ -1,6 +1,6 @@
 module github.com/basecamp/hey-cli/tests/smoke
 
-go 1.26.1
+go 1.27.0
 
 require (
 	github.com/chromedp/cdproto v0.0.0-20250803210736-d308e07a266d