diff --git a/CHANGELOG.md b/CHANGELOG.md
index 057d842..6c548e1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,8 @@
 ## Unreleased (next: v0.167.0) — the BYO SSH clean-up in the SAME update (R-1285); a reinstalled box's whole-guest tier is due at once (R-1232) — committed, not released
 
+- **R-972: Go 1.27.3** (`go.mod`; released 2026-10-19 with a security fix to `crypto/x509`). `govulncheck` v1.8.0 before:
+  1 called vulnerability (GO-2026-6809, `crypto/x509@go1.27.2`); after: 0. `golang.org/x/crypto` v0.58.0 is already the
+  newest. Full `go build/vet/test` green. The controller and hub move the same night.
 - **R-1232 (P2):** `backup.BackupRunner.NewestArchiveTime` — the tier due-check — counts only archives written with THIS
   storage's key on an encrypted storage (the R-727 discriminator; the archive carries no host id). Before: a reinstalled
   box shares the customer's PBS namespace and guest number with the old box, the old box's archive read as „the last
diff --git a/go.mod b/go.mod
index 4fe28e4..238101c 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module gitea.dooplex.hu/admin/felhom-agent
 
-go 1.27.2
+go 1.27.3
 
 require (
 	golang.org/x/crypto v0.58.0