diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 9622bc7db..723475ef3 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -36,7 +36,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@6fed3ca145920b639991cb756090506e1bcaf515 # v1
+        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 
diff --git a/.github/workflows/fresh-install-conformance.yml b/.github/workflows/fresh-install-conformance.yml
index b1649b5df..1a2357a8e 100644
--- a/.github/workflows/fresh-install-conformance.yml
+++ b/.github/workflows/fresh-install-conformance.yml
@@ -67,7 +67,7 @@ jobs:
       - name: Set up Go (tree mode builds ao from source)
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.27.1'
+          go-version: '1.27.2'
           cache-dependency-path: cli/go.sum
 
       - name: Run fresh-install conformance (tree mode)
diff --git a/.github/workflows/install-e2e.yml b/.github/workflows/install-e2e.yml
index af7313034..e1a75667e 100644
--- a/.github/workflows/install-e2e.yml
+++ b/.github/workflows/install-e2e.yml
@@ -35,7 +35,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.27.1'
+          go-version: '1.27.2'
           cache-dependency-path: cli/go.sum
 
       - name: Build ao and link skills into a fresh HOME
@@ -64,7 +64,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.27.1'
+          go-version: '1.27.2'
           cache-dependency-path: cli/go.sum
 
       - name: Build ao and link skills into a fresh HOME
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index ecf0c7c0d..d41e39c59 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -20,7 +20,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.27.1'
+          go-version: '1.27.2'
           cache-dependency-path: cli/go.sum
 
       - name: Run CLI tests with coverage
@@ -75,7 +75,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.27.1'
+          go-version: '1.27.2'
 
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -151,7 +151,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.27.1'
+          go-version: '1.27.2'
           cache-dependency-path: cli/go.sum
 
       - name: Grade routing-probe goldens (advisory)
diff --git a/.github/workflows/release-path-smoke.yml b/.github/workflows/release-path-smoke.yml
index 820d6f836..5c09942a4 100644
--- a/.github/workflows/release-path-smoke.yml
+++ b/.github/workflows/release-path-smoke.yml
@@ -64,7 +64,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.27.1'
+          go-version: '1.27.2'
           cache-dependency-path: cli/go.sum
 
       # Same action + same version constraint the Release Publisher uses, so the
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4e453386d..72091c4d6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -44,7 +44,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.27.1'
+          go-version: '1.27.2'
           cache-dependency-path: cli/go.sum
 
       - name: Set up Python
@@ -149,7 +149,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.27.1'
+          go-version: '1.27.2'
 
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 7f6a10339..3c0cc9a10 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -180,7 +180,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.27.1'
+          go-version: '1.27.2'
           cache-dependency-path: cli/go.sum
 
       - name: Set up Python
@@ -305,7 +305,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.27.1'
+          go-version: '1.27.2'
           cache-dependency-path: cli/go.sum
 
       - name: Set up isolated Python for evaluator integrity tests
@@ -585,7 +585,7 @@ jobs:
         if: needs.changes.outputs.go == 'true' || needs.changes.outputs.shell == 'true' || needs.changes.outputs.ci == 'true'
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.27.1'
+          go-version: '1.27.2'
           cache-dependency-path: cli/go.sum
 
       - name: Set up Python (security toolchain)