diff --git a/docker/eno-controller/Dockerfile b/docker/eno-controller/Dockerfile
index 555cebf0..7e469d42 100644
--- a/docker/eno-controller/Dockerfile
+++ b/docker/eno-controller/Dockerfile
@@ -14,7 +14,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build go mod download
 COPY . .
 RUN --mount=type=cache,target=/root/.cache/go-build CGO_ENABLED=0 go build -ldflags="-s -w" ./cmd/eno-controller
 
-FROM gcr.io/distroless/static
+FROM gcr.io/distroless/static@sha256:034df5c1737e8241f6ed6423a12e720ee0f6d6f088609ee172f98f6f2166ef5d
 
 # https://github.com/GoogleContainerTools/distroless/blob/16dc4a6a33838006fe956e4c19f049ece9c18a8d/common/variables.bzl#L18
 USER 65532:65532
diff --git a/docker/eno-reconciler/Dockerfile b/docker/eno-reconciler/Dockerfile
index f93bb8f4..0b1c6875 100644
--- a/docker/eno-reconciler/Dockerfile
+++ b/docker/eno-reconciler/Dockerfile
@@ -14,7 +14,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build go mod download
 COPY . .
 RUN --mount=type=cache,target=/root/.cache/go-build CGO_ENABLED=0 go build -ldflags="-s -w" ./cmd/eno-reconciler
 
-FROM gcr.io/distroless/static
+FROM gcr.io/distroless/static@sha256:034df5c1737e8241f6ed6423a12e720ee0f6d6f088609ee172f98f6f2166ef5d
 
 # https://github.com/GoogleContainerTools/distroless/blob/16dc4a6a33838006fe956e4c19f049ece9c18a8d/common/variables.bzl#L18
 USER 65532:65532
diff --git a/examples/03-helm-shim/Dockerfile b/examples/03-helm-shim/Dockerfile
index 00f1f920..5350a660 100644
--- a/examples/03-helm-shim/Dockerfile
+++ b/examples/03-helm-shim/Dockerfile
@@ -6,7 +6,7 @@ WORKDIR /app
 COPY . .
 RUN --mount=type=cache,target=/root/.cache/go-build cd examples/03-helm-shim && CGO_ENABLED=0 go build -o /app/helm-shim .
 
-FROM gcr.io/distroless/static
+FROM gcr.io/distroless/static@sha256:034df5c1737e8241f6ed6423a12e720ee0f6d6f088609ee172f98f6f2166ef5d
 
 # https://github.com/GoogleContainerTools/distroless/blob/16dc4a6a33838006fe956e4c19f049ece9c18a8d/common/variables.bzl#L18
 USER 65532:65532
diff --git a/examples/03-helm-shim/go.mod b/examples/03-helm-shim/go.mod
index d38ab9f1..8d4b3e70 100644
--- a/examples/03-helm-shim/go.mod
+++ b/examples/03-helm-shim/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/eno/examples/helm-shim
 
 go 1.25.0
 
-toolchain go1.25.9
+toolchain go1.26.10
 
 replace github.com/Azure/eno/pkg/helmshim => ../../pkg/helmshim
 
diff --git a/examples/05-crd/Dockerfile b/examples/05-crd/Dockerfile
index 4f2a7ed8..687fc45f 100644
--- a/examples/05-crd/Dockerfile
+++ b/examples/05-crd/Dockerfile
@@ -20,4 +20,4 @@ FROM scratch
 USER 65532:65532
 
 COPY --from=builder /app/crd-synthesizer /bin/synthesize
-COPY examples/05-crd/config /config
\ No newline at end of file
+COPY examples/05-crd/config /config
diff --git a/go.mod b/go.mod
index 17a83d1d..db5b1c1a 100644
--- a/go.mod
+++ b/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/eno
 
 go 1.25.0
 
-toolchain go1.25.13
+toolchain go1.26.10
 
 require (
 	github.com/Azure/go-workflow v0.1.13
diff --git a/go.work b/go.work
index be8a3828..46507cf1 100644
--- a/go.work
+++ b/go.work
@@ -1,6 +1,6 @@
 go 1.25.0
 
-toolchain go1.25.9
+toolchain go1.26.10
 
 use (
 	.
diff --git a/pkg/helmshim/go.mod b/pkg/helmshim/go.mod
index 25c8d8d4..a6af3524 100644
--- a/pkg/helmshim/go.mod
+++ b/pkg/helmshim/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/eno/pkg/helmshim
 
 go 1.25.0
 
-toolchain go1.25.9
+toolchain go1.26.10
 
 replace github.com/imdario/mergo => github.com/imdario/mergo v0.3.16
 
diff --git a/pkg/kclshim/go.mod b/pkg/kclshim/go.mod
index fb07b44a..78440270 100644
--- a/pkg/kclshim/go.mod
+++ b/pkg/kclshim/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/eno/pkg/kclshim
 
 go 1.25.0
 
-toolchain go1.25.9
+toolchain go1.26.10
 
 require (
 	k8s.io/apimachinery v0.35.1