diff --git a/go.mod b/go.mod
index 17191b0..fe76f92 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,8 @@ module github.com/parallelworks/hopper
 
 go 1.27.0
 
+toolchain go1.27.3
+
 // hopper does no cryptography of its own. Running tests and `go run` in
 // fips140=only mode proves that nothing non-approved sneaks in.
 godebug fips140=only
diff --git a/hopperotel/go.mod b/hopperotel/go.mod
index dbb9030..cff40e6 100644
--- a/hopperotel/go.mod
+++ b/hopperotel/go.mod
@@ -2,6 +2,8 @@ module github.com/parallelworks/hopper/hopperotel
 
 go 1.27.0
 
+toolchain go1.27.3
+
 godebug fips140=only
 
 require (
diff --git a/hopperui/go.mod b/hopperui/go.mod
index 0073160..041137d 100644
--- a/hopperui/go.mod
+++ b/hopperui/go.mod
@@ -2,6 +2,8 @@ module github.com/parallelworks/hopper/hopperui
 
 go 1.27.0
 
+toolchain go1.27.3
+
 godebug fips140=only
 
 require (
diff --git a/tools/dev/go.mod b/tools/dev/go.mod
index 5dc3eea..a4f83a3 100644
--- a/tools/dev/go.mod
+++ b/tools/dev/go.mod
@@ -2,6 +2,8 @@ module github.com/parallelworks/hopper/tools/dev
 
 go 1.27.2
 
+toolchain go1.27.3
+
 tool github.com/parallelworks/foundation/dev/cmd/dev
 
 require (
diff --git a/tools/go.mod b/tools/go.mod
index 8984d62..723ba7f 100644
--- a/tools/go.mod
+++ b/tools/go.mod
@@ -2,6 +2,8 @@ module github.com/parallelworks/hopper/tools
 
 go 1.27.0
 
+toolchain go1.27.3
+
 tool github.com/golangci/golangci-lint/v2/cmd/golangci-lint
 
 require (