diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index ee6ca22ff..991876811 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -12,7 +12,7 @@ Key non-negotiables (full detail in `CLAUDE.md`):
 - Run `make mock` after editing any `Repository`/`Feature`/`WSMAN` interface — `internal/mocks/` is generated. The `mock` target encodes non-obvious `mockgen` flags; don't reproduce them by hand.
 - Device credentials (`Password`, `MPSPassword`, `MEBXPassword`) are always encrypted via `safeRequirements.Encrypt` in `dtoToEntity`. Never write plaintext to `entity.Device`.
 - Touching `internal/controller/tcp/cira/`, `internal/usecase/devices/redirection*.go`, or the WebSocket relay (`internal/controller/ws/v1/redirect.go`)? Trace the byte flow end to end and update the sibling `*_test.go` — APF state-machine races have caused real outages in the predecessor.
-- Module path is `github.com/device-management-toolkit/console`; Go 1.25+ required. Commands run natively on Linux, macOS, and Windows — WSL is not required.
+- Module path is `github.com/device-management-toolkit/console`; Go 1.27+ required. Commands run natively on Linux, macOS, and Windows — WSL is not required.
 - Small, focused PRs only. No scope creep. Stack prerequisite refactors as `refactor:` / `test:` / `build:` ahead of the `feat:` that triggers a release.
 - Commits follow Conventional Commits (commitlint-enforced). `feat:` cuts a minor release, `fix:`/`perf:`/`chore:` cuts a patch, `BREAKING CHANGE:` cuts a major — avoid breaking `/api/v1/*`. See `CONTRIBUTING.md` for the full scope list.
 - Before declaring done: `go test -race -count=1 ./...`, `gofumpt -l -w -extra ./` (no diff), `go vet ./...`, and `docker run --rm -v .:/app -w /app golangci/golangci-lint:latest golangci-lint run -v --fix` (use `-v ${pwd}:/app` on Windows PowerShell — no remaining diagnostics) all green.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b17ceb102..3fc660a75 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -145,7 +145,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        go-version: [1.25.x]
+        go-version: [1.27.x]
         os: [windows-2019, windows-2022, ubuntu-22.04, ubuntu-24.04]
     steps:
       - name: Harden Runner
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d4b2c0e41..b76bc40f2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -189,10 +189,10 @@ jobs:
           node-version: 22.x
 
       # Pin Go only for license generation
-      - name: Use Go 1.25.1 for license scan
+      - name: Use Go 1.27.x for license scan
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.25.1"
+          go-version: "1.27.x"
           check-latest: true
       - name: Pin toolchain for this step
         run: |
diff --git a/CLAUDE.md b/CLAUDE.md
index 7edf1daf1..c7a1e3dc7 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -27,7 +27,7 @@ Sibling reference repos in the workspace: [MPS](https://github.com/device-manage
 ## Commands
 
 
-**Go 1.25+ required** (per `go.mod`). **Module path is `github.com/device-management-toolkit/console`** — all intra-repo imports use that prefix. Copy `.env.example` to `.env` (the VS Code launch config and the few `make` targets that still apply read it via `envFile` / `-include`; raw `go run` reads env vars from your shell).
+**Go 1.27+ required** (per `go.mod`). **Module path is `github.com/device-management-toolkit/console`** — all intra-repo imports use that prefix. Copy `.env.example` to `.env` (the VS Code launch config and the few `make` targets that still apply read it via `envFile` / `-include`; raw `go run` reads env vars from your shell).
 
 ### Running the app
 
diff --git a/README.md b/README.md
index d1aee36d8..528763a45 100644
--- a/README.md
+++ b/README.md
@@ -75,7 +75,7 @@ Local development can be done on **Linux**, **macOS**, and **Windows**. On Windo
 ### Prerequisites
 
 Before you begin, ensure you have:
-- [Go 1.24+](https://go.dev/dl/)
+- [Go 1.27+](https://go.dev/dl/)
 - [Git](https://git-scm.com/downloads)
 - [Node.js & npm](https://nodejs.org/) (for the Web UI)
 - [Docker & Docker Compose](https://docs.docker.com/get-docker/) (optional, for PostgreSQL)
diff --git a/go.mod b/go.mod
index 7f9aba858..9a0c24a46 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/device-management-toolkit/console
 
-go 1.25.0
+go 1.27.0
 
 // replace github.com/device-management-toolkit/go-wsman-messages/v2 => ../go-wsman-messages
 
@@ -115,7 +115,7 @@ require (
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.3.1 // indirect
 	golang.org/x/arch v0.23.0 // indirect
-	golang.org/x/crypto v0.55.0 // indirect
+	golang.org/x/crypto v0.56.0 // indirect
 	golang.org/x/net v0.57.0 // indirect
 	golang.org/x/sync v0.22.0 // indirect
 	golang.org/x/sys v0.47.0
diff --git a/go.sum b/go.sum
index e5a2f0d37..011bc0d54 100644
--- a/go.sum
+++ b/go.sum
@@ -291,8 +291,8 @@ golang.org/x/arch v0.23.0 h1:lKF64A2jF6Zd8L0knGltUnegD62JMFBiCPBmQpToHhg=
 golang.org/x/arch v0.23.0/go.mod h1:dNHoOeKiyja7GTvF9NJS1l3Z2yntpQNzgrjh1cU103A=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
+golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
+golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
 golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=