diff --git a/.project/STATUS.md b/.project/STATUS.md
index 9bcdbba..c8de286 100644
--- a/.project/STATUS.md
+++ b/.project/STATUS.md
@@ -2,13 +2,13 @@
 
 **Updated:** 2026-07-22
 **Branch:** main
-**Last Commit:** 09f51d1 - Add queued email notifications for collaboration events
+**Baseline Commit:** 4454e91 - Add Cloudflare email and collaboration workflows
 
 ## Quick Stats
 
 | Metric | Value |
 |--------|-------|
-| Total Tracked Files | 201 |
+| Total Tracked Files | 208 |
 | Go Files | 63 |
 | Swift Files | 15 (macOS app and package manifest) |
 | Go Test Files | 18 |
@@ -19,8 +19,10 @@
 
 - `go test -coverpkg=./... -coverprofile=... ./...` passes with 52.4% aggregate statement coverage.
 - `swift build` passes for the macOS app and CLI.
-- Focused race tests pass for email, collaboration, and HTTP packages. A full `go test -race ./...` exceeds the current five-minute local timeout.
-- `govulncheck` currently fails because Go 1.24.2 has 31 reachable standard-library vulnerabilities; the pinned Go toolchain must be upgraded before production sign-off.
+- `go test -race ./...` passes under Go 1.26.5.
+- Go is pinned consistently to 1.26.5 for local, CI, module, workspace, and container builds.
+- `govulncheck@latest` reports no reachable vulnerabilities.
+- The `golang:1.26.5-bookworm` production image builds successfully.
 - Highest package coverage: Markdown 87.0%, email 77.9%, store 70.0%, config 67.9%, auth 54.9%, and sync 54.2%.
 - Collaboration, configuration, email-provider, and collaboration HTTP integration tests are present; database, logging, and realtime still lack direct suites.
 
@@ -61,7 +63,6 @@ Milestone 4 collaboration completion:
 
 ## Known Gaps Requiring Human Review
 
-- Go 1.24.2 is below the patched versions reported by `govulncheck`, including fixes for `html/template`, `crypto/tls`, `net/http`, and `crypto/x509` vulnerabilities.
 - WebSocket broadcasts are authenticated but not filtered by per-document permissions.
 - Content-hash downloads are not tied back to effective document permission.
 - Browser caches are not cleared on logout.
diff --git a/.project/adrs/adr-001-tech-stack.md b/.project/adrs/adr-001-tech-stack.md
index 5cbc2c7..d574e46 100644
--- a/.project/adrs/adr-001-tech-stack.md
+++ b/.project/adrs/adr-001-tech-stack.md
@@ -9,7 +9,7 @@ dependencies, secure server-side rendering, and a straightforward deployment
 artifact.
 
 ## Decision
-Use Go 1.24+ with the standard library plus minimal, audited packages. The Go
+Use Go 1.26+ with the standard library plus minimal, audited packages. The Go
 binary serves HTML templates and embeds its CSS, images, and small browser
 scripts. There is no separate SPA, Node dependency tree, or frontend build
 pipeline.
diff --git a/.project/project-plan.md b/.project/project-plan.md
index 9e97186..817217e 100644
--- a/.project/project-plan.md
+++ b/.project/project-plan.md
@@ -253,7 +253,7 @@ See [architecture-overview.md](architecture-overview.md) for detailed component
 
 ## Technology Stack
 
-### Backend (Go 1.24+)
+### Backend (Go 1.26+)
 
 | Component     | Library                                     | Justification                            |
 | ------------- | ------------------------------------------- | ---------------------------------------- |
diff --git a/Dockerfile b/Dockerfile
index ae45c0d..34f4679 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.24-bookworm AS server-build
+FROM golang:1.26.5-bookworm AS server-build
 WORKDIR /workspace
 RUN apt-get update && apt-get install -y --no-install-recommends build-essential ca-certificates && rm -rf /var/lib/apt/lists/*
 COPY go.work ./
diff --git a/apps/server/go.mod b/apps/server/go.mod
index 9b11de1..918b643 100644
--- a/apps/server/go.mod
+++ b/apps/server/go.mod
@@ -1,6 +1,6 @@
 module github.com/tim/cairnquire/apps/server
 
-go 1.24.2
+go 1.26.5
 
 require (
 	github.com/fsnotify/fsnotify v1.9.0
diff --git a/go.work b/go.work
index 232f054..fe7da30 100644
--- a/go.work
+++ b/go.work
@@ -1,4 +1,3 @@
-go 1.24.2
+go 1.26.5
 
 use ./apps/server
-
diff --git a/mise.toml b/mise.toml
index 7dc9279..88f6698 100644
--- a/mise.toml
+++ b/mise.toml
@@ -1,5 +1,5 @@
 [tools]
-go = "1.24.2"
+go = "1.26.5"
 
 [tasks.server-run]
 description = "Run the Go server"
@@ -45,4 +45,4 @@ run = "true"
 [tasks.vulncheck]
 description = "Run govulncheck"
 dir = "apps/server"
-run = "go run golang.org/x/vuln/cmd/govulncheck@v1.1.4 ./..."
+run = "go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./..."