diff --git a/hub/CHANGELOG.md b/hub/CHANGELOG.md
index 387c9414..47407aa1 100644
--- a/hub/CHANGELOG.md
+++ b/hub/CHANGELOG.md
@@ -1,5 +1,8 @@
 ## Unreleased (next: v0.173.0) — D53: a held app reaches the operator (`08` §10); R-1218: a keyed recovery package is never replaced by a key-less one
 
+- **R-972: Go 1.27.3** (`go.mod` + the builder image `golang:1.27.3-*` pinned by digest; released 2026-10-19 with a
+  security fix to `crypto/x509`). `govulncheck` v1.8.0: 1 called vulnerability before (GO-2026-6809), 0 after; full
+  `go build/vet/test` green. `golang.org/x/crypto` v0.58.0 is already the newest.
 - **R-1218 (P2, key code), the hub half:** `store.SaveHostEscrowWithIdentity` REFUSES (`ErrEscrowWouldDropRepoKey`) an upload that
   seals no off-site repository password (`restic_pw_sha256` "") over a package that seals one; the escrow PUT answers 409
   with the reason and a WARN. Before: the good package was demoted to operator-only custody and the household's code no
diff --git a/hub/Dockerfile b/hub/Dockerfile
index 5dc7e12b..42c98a3b 100644
--- a/hub/Dockerfile
+++ b/hub/Dockerfile
@@ -1,5 +1,5 @@
 # R-972: a supported, patched Go and the current Alpine, pinned by version and digest (no moving tag).
-FROM golang:1.27.2-alpine3.24@sha256:f92b6ef800e499660581efdabdf25d9d817a9d124eaf900924f0504e7e27e12d AS builder
+FROM golang:1.27.3-alpine3.24@sha256:b8c9b82affbbb82a020bbcf998dad2ba9516944ac7e883524642a481a9505e9c AS builder
 
 WORKDIR /app
 
diff --git a/hub/go.mod b/hub/go.mod
index 1c7aadf1..d01a6243 100644
--- a/hub/go.mod
+++ b/hub/go.mod
@@ -1,6 +1,6 @@
 module gitea.dooplex.hu/admin/felhom-hub
 
-go 1.27.2
+go 1.27.3
 
 require (
 	golang.org/x/crypto v0.58.0