diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2122e91f..a67d205f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,9 @@ hub answers 400 to both and nothing else changes.
   as `restore_failed` — `since`, `why`), `app_hold_cleared` when a hold is gone; every hold is sent again once a day and
   at each start (`repeat: true`). The last-reported set is kept in `settings.reported_holds`, so a hold cleared while the
   controller was down is still reported cleared. Both severity info (the hub mails nothing on receipt).
+- **R-972: Go 1.27.3** (`go.mod` + the builder image `golang:1.27.3-*` pinned by digest; released 2026-10-19 with a
+  security fix to `crypto/x509`). `govulncheck` v1.8.0: 1 called vulnerability before (GO-2026-6809), 0 after; full
+  `go build/vet/test` green. `golang.org/x/crypto` v0.58.0 is already the newest.
 - **R-1220 (P2, delete path):** an app whose `app.yaml` EXISTS but cannot be read counts as INSTALLED (fail closed):
   `stacks.liveDriveBinds(drives)` adds every folder its compose binds on every given drive, so „Megőrzött adatok" never
   lists — and never offers to delete — that app's live folder; one WARN names the app. Before: a parse error gave a nil
diff --git a/controller/Dockerfile b/controller/Dockerfile
index 855cc9e4..3f7ac988 100644
--- a/controller/Dockerfile
+++ b/controller/Dockerfile
@@ -7,7 +7,7 @@
 # --- Build stage ---
 # R-972 (v0.322.0): a supported, patched Go, pinned by version AND digest (no moving tag). Go 1.24 had no security fixes
 # left (go.dev/doc/devel/release#policy). The builder's Debian does not reach the runtime (a static CGO-free binary).
-FROM golang:1.27.2-trixie@sha256:47667934874913a449b96faa7ef4777fa285d9ec29126ee80ed61c45b7cccf0e AS builder
+FROM golang:1.27.3-trixie@sha256:fbb7ae40b62ff8afe31662df570d39b4f5052ac32b90dae8e60d7657a20a74f4 AS builder
 
 ARG TARGETOS=linux
 ARG TARGETARCH
diff --git a/controller/go.mod b/controller/go.mod
index 666988bb..7cf3ccb8 100644
--- a/controller/go.mod
+++ b/controller/go.mod
@@ -1,6 +1,6 @@
 module gitea.dooplex.hu/admin/felhom-controller
 
-go 1.27.2
+go 1.27.3
 
 require (
 	github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6