diff --git a/CHANGELOG.md b/CHANGELOG.md
index fcd052f..37e9895 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,7 +1,14 @@
 # Changelog
 
-## 0.1.8 (Unreleased)
+## 0.1.8 (2026-10-20)
 
+### Highlights
+
+- Fix certificate validation vulnerability GO-2026-6809 in release binaries.
+
+### Changes
+
+- Security: build with Go 1.27.3 to fix certificate validation vulnerability GO-2026-6809.
 - Breaking: macOS release binaries now require macOS 13 Ventura or newer, matching Go 1.27's supported minimum.
 - CI: move macOS jobs and release verification to `xcode-27` and smoke-test Intel binaries with Rosetta.
 - Security: build with Go 1.27.2 to fix standard-library vulnerabilities while retaining Go 1.25 source compatibility.
diff --git a/Dockerfile b/Dockerfile
index a8c3e6b..921dcad 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.27
 
-ARG GO_VERSION=1.27.2
+ARG GO_VERSION=1.27.3
 ARG ALPINE_VERSION=3.24
 
 FROM golang:${GO_VERSION}-alpine AS build
diff --git a/README.md b/README.md
index ea173cb..c5cbc98 100644
--- a/README.md
+++ b/README.md
@@ -77,7 +77,7 @@ The default config file is `~/Library/Application Support/blu/config.json` on ma
 
 ## Development
 
-CI and release builds use Go 1.27.2, while the source minimum remains Go 1.25.
+CI and release builds use Go 1.27.3, while the source minimum remains Go 1.25.
 macOS jobs run on the Apple Silicon `xcode-27` image and smoke-test Intel release
 binaries with Rosetta. Both macOS architectures require macOS 13.0 or newer.
 
diff --git a/cmd/blu/main.go b/cmd/blu/main.go
index 0b63d9f..396f2bf 100644
--- a/cmd/blu/main.go
+++ b/cmd/blu/main.go
@@ -9,7 +9,7 @@ import (
 )
 
 var (
-	version = "0.1.7"
+	version = "0.1.8"
 	exit    = os.Exit
 )
 
diff --git a/docs/releasing.md b/docs/releasing.md
index 8614b94..a757a04 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -27,7 +27,7 @@ other than 13.0, including toolchain-default changes. If cgo is introduced, also
 set matching `CGO_CFLAGS` and `CGO_LDFLAGS` with `-mmacosx-version-min=13.0`;
 the environment variable alone does not reliably constrain external linking.
 CI exercises the same build configuration and target gate without Apple secrets.
-CI, releases, and Docker use Go 1.27.2; the source minimum remains Go 1.25.
+CI, releases, and Docker use Go 1.27.3; the source minimum remains Go 1.25.
 
 ## Dry run
 
diff --git a/go.mod b/go.mod
index 3313907..68b03fb 100644
--- a/go.mod
+++ b/go.mod
@@ -2,7 +2,7 @@ module github.com/steipete/blucli
 
 go 1.25.0
 
-toolchain go1.27.2
+toolchain go1.27.3
 
 require github.com/grandcat/zeroconf v1.0.0