diff --git a/dockerfiles/code-coverage-uploader/Dockerfile b/dockerfiles/code-coverage-uploader/Dockerfile
index b29c5f7fd..ee3db6f95 100644
--- a/dockerfiles/code-coverage-uploader/Dockerfile
+++ b/dockerfiles/code-coverage-uploader/Dockerfile
@@ -9,6 +9,6 @@ RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*
 RUN curl -sfLo /tmp/codecov https://uploader.codecov.io/latest/linux/codecov
 RUN chmod +x /tmp/codecov
 
-FROM golang:1.27.2
+FROM golang:1.27.3
 RUN apt-get update -y && apt-get dist-upgrade -y
 COPY --from=builder /tmp/codecov /usr/local/bin/codecov
diff --git a/dockerfiles/crane/Dockerfile b/dockerfiles/crane/Dockerfile
index 01dc5b277..696810499 100644
--- a/dockerfiles/crane/Dockerfile
+++ b/dockerfiles/crane/Dockerfile
@@ -4,7 +4,7 @@
 FROM gcr.io/go-containerregistry/crane as crane
 FROM mikefarah/yq:4.54.1 AS yq
 
-FROM golang:1.27.2
+FROM golang:1.27.3
 COPY --from=yq /usr/bin/yq /usr/local/bin
 COPY --from=crane /ko-app/crane /usr/local/bin
 ENTRYPOINT ["bash"]
diff --git a/dockerfiles/gh-cli/Dockerfile b/dockerfiles/gh-cli/Dockerfile
index cdf2655e4..27d817554 100644
--- a/dockerfiles/gh-cli/Dockerfile
+++ b/dockerfiles/gh-cli/Dockerfile
@@ -11,5 +11,5 @@ RUN curl \
     https://github.com/cli/cli/releases/download/v2.40.0/gh_2.40.0_linux_amd64.tar.gz \
     && tar -C /tmp --strip-components=1 -xzvf /tmp/gh.tar.gz
 
-FROM golang:1.27.2
+FROM golang:1.27.3
 COPY --from=builder /tmp/bin/gh /usr/local/bin/gh
diff --git a/dockerfiles/integration-test-runner-beta/Dockerfile b/dockerfiles/integration-test-runner-beta/Dockerfile
index 4cb6301e1..120514f03 100644
--- a/dockerfiles/integration-test-runner-beta/Dockerfile
+++ b/dockerfiles/integration-test-runner-beta/Dockerfile
@@ -37,7 +37,7 @@ RUN google-chrome --version
 
 # Install Go. The download URL that can be used below for any version of Go can be found on https://go.dev/dl/
 ENV PATH /usr/local/go/bin:$PATH
-RUN curl -fsSL https://go.dev/dl/go1.27.2.linux-amd64.tar.gz -o /tmp/go.tar.gz && \
+RUN curl -fsSL https://go.dev/dl/go1.27.3.linux-amd64.tar.gz -o /tmp/go.tar.gz && \
     tar -C /usr/local -xzf /tmp/go.tar.gz && \
     rm /tmp/go.tar.gz && \
     go version
diff --git a/dockerfiles/integration-test-runner/Dockerfile b/dockerfiles/integration-test-runner/Dockerfile
index 43ce65c46..ba3e2787b 100644
--- a/dockerfiles/integration-test-runner/Dockerfile
+++ b/dockerfiles/integration-test-runner/Dockerfile
@@ -37,7 +37,7 @@ RUN google-chrome --version
 
 # Install Go. The download URL that can be used below for any version of Go can be found on https://go.dev/dl/
 ENV PATH /usr/local/go/bin:$PATH
-RUN curl -fsSL https://go.dev/dl/go1.27.2.linux-amd64.tar.gz -o /tmp/go.tar.gz && \
+RUN curl -fsSL https://go.dev/dl/go1.27.3.linux-amd64.tar.gz -o /tmp/go.tar.gz && \
     tar -C /usr/local -xzf /tmp/go.tar.gz && \
     rm /tmp/go.tar.gz && \
     go version
diff --git a/dockerfiles/test-cfssl/Dockerfile b/dockerfiles/test-cfssl/Dockerfile
index 9b894d531..583086647 100644
--- a/dockerfiles/test-cfssl/Dockerfile
+++ b/dockerfiles/test-cfssl/Dockerfile
@@ -11,7 +11,7 @@ FROM cfssl/cfssl:v1.7.1 as cfssl
 
 # We just need any basic unix with bash, but we can pick the same
 # base image that they use, just in case they did any dynamic linking.
-FROM golang:1.27.2
+FROM golang:1.27.3
 
 # Thier Docerfile https://github.com/cloudflare/cfssl/blob/master/Dockerfile
 # calls their Makefile https://github.com/cloudflare/cfssl/blob/master/Makefile
diff --git a/pipelines/dockerfile-builders/pipeline.yml b/pipelines/dockerfile-builders/pipeline.yml
index f981cc447..18900f350 100644
--- a/pipelines/dockerfile-builders/pipeline.yml
+++ b/pipelines/dockerfile-builders/pipeline.yml
@@ -38,7 +38,7 @@ meta:
   # These version numbers should be updated periodically.
   codegen-versions: &codegen-versions
     # Choose which version of Golang to use in the codegen container images.
-    BUILD_ARG_GO_VERSION: '1.27.2'
+    BUILD_ARG_GO_VERSION: '1.27.3'
     # Choose which version of sigs.k8s.io/controller-tools/cmd/controller-gen to install
     # in the codegen container images.
     BUILD_ARG_CONTROLLER_GEN_VERSION: 0.22.0
diff --git a/pipelines/pull-requests/pipeline.yml b/pipelines/pull-requests/pipeline.yml
index 78913f32d..f14470111 100644
--- a/pipelines/pull-requests/pipeline.yml
+++ b/pipelines/pull-requests/pipeline.yml
@@ -593,7 +593,7 @@ jobs:
             type: registry-image
             source:
               repository: golang
-              tag: '1.27.2'
+              tag: '1.27.3'
           inputs:
             - name: pinniped-pr
           outputs:
diff --git a/pipelines/shared-helpers/test-binaries-image/Dockerfile b/pipelines/shared-helpers/test-binaries-image/Dockerfile
index 17fca531a..81989490f 100644
--- a/pipelines/shared-helpers/test-binaries-image/Dockerfile
+++ b/pipelines/shared-helpers/test-binaries-image/Dockerfile
@@ -3,7 +3,7 @@
 # Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-FROM golang:1.27.2-bookworm as build-env
+FROM golang:1.27.3-bookworm as build-env
 WORKDIR /work
 COPY . .
 ARG GOPROXY
diff --git a/pipelines/shared-helpers/test-binaries-image/Dockerfile_fips b/pipelines/shared-helpers/test-binaries-image/Dockerfile_fips
index 540d158fe..2cecc89b6 100644
--- a/pipelines/shared-helpers/test-binaries-image/Dockerfile_fips
+++ b/pipelines/shared-helpers/test-binaries-image/Dockerfile_fips
@@ -6,7 +6,7 @@
 # we need a separate dockerfile for the fips test image so that the integration tests
 # use the right ciphers etc.
 
-FROM golang:1.27.2-bookworm as build-env
+FROM golang:1.27.3-bookworm as build-env
 WORKDIR /work
 COPY . .
 ARG GOPROXY
diff --git a/pipelines/shared-tasks/build-cli-binaries/task.yml b/pipelines/shared-tasks/build-cli-binaries/task.yml
index 982f0aea8..37ab22a80 100644
--- a/pipelines/shared-tasks/build-cli-binaries/task.yml
+++ b/pipelines/shared-tasks/build-cli-binaries/task.yml
@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.27.2'
+    tag: '1.27.3'
 inputs:
   - name: pinniped
   - name: pinniped-ci
diff --git a/pipelines/shared-tasks/confirm-built-with-fips/task.yml b/pipelines/shared-tasks/confirm-built-with-fips/task.yml
index f70b50523..c4fc445d3 100644
--- a/pipelines/shared-tasks/confirm-built-with-fips/task.yml
+++ b/pipelines/shared-tasks/confirm-built-with-fips/task.yml
@@ -10,6 +10,6 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.27.2'
+    tag: '1.27.3'
 run:
   path: pinniped-ci/pipelines/shared-tasks/confirm-built-with-fips/task.sh
diff --git a/pipelines/shared-tasks/confirm-built-with-gofips140/task.yml b/pipelines/shared-tasks/confirm-built-with-gofips140/task.yml
index a32b300da..e44cc224f 100644
--- a/pipelines/shared-tasks/confirm-built-with-gofips140/task.yml
+++ b/pipelines/shared-tasks/confirm-built-with-gofips140/task.yml
@@ -10,6 +10,6 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.27.2'
+    tag: '1.27.3'
 run:
   path: pinniped-ci/pipelines/shared-tasks/confirm-built-with-gofips140/task.sh
diff --git a/pipelines/shared-tasks/confirm-version/task.yml b/pipelines/shared-tasks/confirm-version/task.yml
index a83985072..0e48d3a3e 100644
--- a/pipelines/shared-tasks/confirm-version/task.yml
+++ b/pipelines/shared-tasks/confirm-version/task.yml
@@ -10,7 +10,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.27.2'
+    tag: '1.27.3'
 run:
   # Confirm that the correct git sha was baked into the executables and that they log the version as their
   # first line of output. Do this by directly running the server binary from the rootfs of the built image.
diff --git a/pipelines/shared-tasks/format-release/task.yml b/pipelines/shared-tasks/format-release/task.yml
index b1ab725ed..a8a97bcfd 100644
--- a/pipelines/shared-tasks/format-release/task.yml
+++ b/pipelines/shared-tasks/format-release/task.yml
@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.27.2'
+    tag: '1.27.3'
 inputs:
   - name: pinniped
   - name: release-semver
diff --git a/pipelines/shared-tasks/run-go-vuln-scan/task.yml b/pipelines/shared-tasks/run-go-vuln-scan/task.yml
index f4252f827..1f48d4aa7 100644
--- a/pipelines/shared-tasks/run-go-vuln-scan/task.yml
+++ b/pipelines/shared-tasks/run-go-vuln-scan/task.yml
@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.27.2'
+    tag: '1.27.3'
 inputs:
   - name: pinniped
   - name: pinniped-ci
diff --git a/pipelines/shared-tasks/run-unit-tests/task.yml b/pipelines/shared-tasks/run-unit-tests/task.yml
index 54158db9a..d01a2501a 100644
--- a/pipelines/shared-tasks/run-unit-tests/task.yml
+++ b/pipelines/shared-tasks/run-unit-tests/task.yml
@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.27.2'
+    tag: '1.27.3'
 inputs:
   - name: pinniped
   - name: pinniped-ci
diff --git a/pipelines/shared-tasks/run-verify-go-generate/task.yml b/pipelines/shared-tasks/run-verify-go-generate/task.yml
index 4e38e7edd..15b8bcbe1 100644
--- a/pipelines/shared-tasks/run-verify-go-generate/task.yml
+++ b/pipelines/shared-tasks/run-verify-go-generate/task.yml
@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.27.2'
+    tag: '1.27.3'
 inputs:
   - name: pinniped
   - name: pinniped-ci
diff --git a/pipelines/shared-tasks/run-verify-go-mod-tidy/task.yml b/pipelines/shared-tasks/run-verify-go-mod-tidy/task.yml
index 166cbbf60..77e9cd252 100644
--- a/pipelines/shared-tasks/run-verify-go-mod-tidy/task.yml
+++ b/pipelines/shared-tasks/run-verify-go-mod-tidy/task.yml
@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.27.2'
+    tag: '1.27.3'
 inputs:
   - name: pinniped
   - name: pinniped-ci
diff --git a/pipelines/shared-tasks/run-verify-lint/task.yml b/pipelines/shared-tasks/run-verify-lint/task.yml
index 4879bd51c..69174f87c 100644
--- a/pipelines/shared-tasks/run-verify-lint/task.yml
+++ b/pipelines/shared-tasks/run-verify-lint/task.yml
@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.27.2'
+    tag: '1.27.3'
 inputs:
   - name: pinniped
   - name: pinniped-ci
diff --git a/pipelines/shared-tasks/update-version-and-cli-docs/task.yml b/pipelines/shared-tasks/update-version-and-cli-docs/task.yml
index e4ae1c22b..6fe2fae62 100644
--- a/pipelines/shared-tasks/update-version-and-cli-docs/task.yml
+++ b/pipelines/shared-tasks/update-version-and-cli-docs/task.yml
@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.27.2'
+    tag: '1.27.3'
 inputs:
   - name: pinniped-ci
   - name: github-final-release