diff --git a/.dagger/main.go b/.dagger/main.go
index e88560e..4515483 100644
--- a/.dagger/main.go
+++ b/.dagger/main.go
@@ -24,7 +24,7 @@ import (
 )
 
 const (
-	defaultGoVersion  = "1.26.3"
+	defaultGoVersion  = "1.26.5"
 	defaultRccVersion = "v18.17.4"
 )
 
diff --git a/.github/renovate.json5 b/.github/renovate.json5
index e3e1c7d..fd297c3 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -13,7 +13,8 @@
   "prHourlyLimit": 1,
 
   "ignorePaths": [
-    ".dagger/**",
+    ".dagger/go.mod",
+    ".dagger/go.sum",
     "blobs/**",
     "build/**",
     "tmp/**"
@@ -31,16 +32,16 @@
   "customManagers": [
     {
       "customType": "regex",
-      "description": "Track the Go toolchain pin across RCC source, CI, and developer toolkit config.",
+      "description": "Track the official Go toolchain pin across RCC source, CI, and Dagger.",
       "managerFilePatterns": [
         "/^go\\.mod$/",
-        "/^developer/setup\\.ya?ml$/",
-        "/^\\.github/workflows/rcc\\.ya?ml$/"
+        "/^\\.github/workflows/rcc\\.ya?ml$/",
+        "/^\\.dagger/main\\.go$/"
       ],
       "matchStrings": [
         "(?:^|\\n)go\\s+(?<currentValue>\\d+\\.\\d+\\.\\d+)",
         "go-version:\\s*[\"']?(?<currentValue>\\d+\\.\\d+\\.\\d+)[\"']?",
-        "-\\s*go=(?<currentValue>\\d+\\.\\d+\\.\\d+)"
+        "defaultGoVersion\\s*=\\s*[\"'](?<currentValue>\\d+\\.\\d+\\.\\d+)[\"']"
       ],
       "depNameTemplate": "go",
       "datasourceTemplate": "golang-version",
@@ -69,7 +70,7 @@
     },
     {
       "description": [
-        "Keep Go runtime updates coordinated across go.mod, CI, and the RCC developer toolkit."
+        "Keep official Go runtime updates coordinated across go.mod, CI, and Dagger."
       ],
       "groupName": "Go toolchain",
       "matchManagers": [
@@ -79,6 +80,21 @@
       "matchPackageNames": [
         "go"
       ]
+    },
+    {
+      "description": [
+        "gopkg.in/yaml.v2 cannot take v3 releases without changing the module import path."
+      ],
+      "matchManagers": [
+        "gomod"
+      ],
+      "matchPackageNames": [
+        "gopkg.in/yaml.v2"
+      ],
+      "matchUpdateTypes": [
+        "major"
+      ],
+      "enabled": false
     }
   ]
 }
diff --git a/.github/workflows/rcc.yaml b/.github/workflows/rcc.yaml
index a73168d..ca16bbb 100644
--- a/.github/workflows/rcc.yaml
+++ b/.github/workflows/rcc.yaml
@@ -31,7 +31,7 @@ jobs:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
         with:
-          go-version: "1.26.3"
+          go-version: "1.26.5"
       - name: Set up Python 3.10
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
         with:
@@ -78,7 +78,7 @@ jobs:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
         with:
-          go-version: "1.26.3"
+          go-version: "1.26.5"
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
         with:
           python-version: "3.10"
diff --git a/AGENTS.md b/AGENTS.md
index 65078fc..5de6ec0 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -25,7 +25,7 @@ rcc run -r developer/toolkit.yaml --dev -t local
 rcc run -r developer/toolkit.yaml -t robot
 ```
 
-If the host already has the pinned toolchain, `inv` is fine. `developer/setup.yaml`, CI, and `go.mod` pin Go `1.25.7`; `developer/setup.yaml` also pins Python `3.10.15`, Invoke `2.2.0`, Robot Framework `6.1.1`, and Git `2.46.0`.
+If the host already has the pinned toolchain, `inv` is fine. CI, `go.mod`, and the Dagger runner pin Go `1.26.5`; the contained `developer/setup.yaml` environment pins the newest Conda Forge build, currently Go `1.26.3`, plus Python `3.10.15`, Invoke `2.2.0`, Robot Framework `6.1.1`, and Git `2.46.0`.
 
 ```bash
 inv assets
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 88c1949..fc47685 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -21,7 +21,7 @@ Pinned tool versions live in `developer/setup.yaml`:
 - Python **3.10.15**
 - Invoke **2.2.0**
 - Robot Framework **6.1.1** (matches `robot_requirements.txt`)
-- Go **1.25.7**
+- Go **1.26.3** (latest available from Conda Forge; CI and Dagger use **1.26.5**)
 - Git **2.46.0**
 
 ### 1) Prerequisites
@@ -72,7 +72,7 @@ Sometimes, less (tools) is not more (productivity). But you do you.
 
 ### Requirements
 
-- Go **1.25.x** (CI uses `1.25.7`. Mismatched versions lead to mysterious build failures. Ask us how we know.)
+- Go **1.26.x** (CI uses `1.26.5`. Mismatched versions lead to mysterious build failures. Ask us how we know.)
 - Python **3.10+**
 - Invoke (`python -m pip install invoke`)
 
@@ -166,7 +166,7 @@ dagger call grep-dir --directory-arg . --pattern "TODO"
 
 **What `RunRobotTests` actually does:**
 
-1. Pulls a `golang:1.25.7` base image
+1. Pulls a `golang:1.26.5` base image
 2. Installs curl, git, and friends
 3. Downloads `rcc` from [our releases](https://github.com/joshyorko/rcc/releases)
 4. Mounts your source directory (read-only, nothing gets mutated on your host)
@@ -192,7 +192,7 @@ The module lives in `.dagger/main.go`. It's just Go code with the Dagger SDK—a
 // Example: Add a new function to run unit tests
 func (m *RccCi) RunUnitTests(ctx context.Context, source *dagger.Directory) (string, error) {
     return dag.Container().
-        From("golang:1.25.7").
+        From("golang:1.26.5").
         WithMountedDirectory("/src", source).
         WithWorkdir("/src").
         WithExec([]string{"go", "test", "./..."}).
diff --git a/developer/setup.yaml b/developer/setup.yaml
index 0bb9aaf..465f3af 100644
--- a/developer/setup.yaml
+++ b/developer/setup.yaml
@@ -1,8 +1,8 @@
 channels:
   - conda-forge
 dependencies:
-  # Note: needs to match the version in the GitHub Actions workflow
-  # (both rcc and rcc-pipeline)
+  # Conda Forge can lag official Go patch releases. Keep this pinned to the
+  # newest version actually available from conda-forge; CI and Dagger may lead.
   - python=3.10.15
   - invoke=2.2.0
   # Note: needs to match the version in robot_requirements.txt
diff --git a/docs/changelog.md b/docs/changelog.md
index 8877bd8..4a2ba43 100644
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -1,4 +1,25 @@
 # rcc change log
+## Unreleased
+
+### Dependency Updates
+
+- update the official Go toolchain from 1.26.3 to 1.26.5 across `go.mod`,
+  GitHub Actions, and the Dagger runner; keep the contained developer toolkit
+  on the newest Conda Forge build, Go 1.26.3
+- update `golang.org/x/term` from v0.43.0 to v0.45.0 and its required
+  `golang.org/x/sys` dependency from v0.45.0 to v0.47.0
+- update `gopkg.in/yaml.v2` from v2.2.8 to v2.4.0
+- stop PatchRaptor from reopening the invalid `gopkg.in/yaml.v2` v3 lane;
+  v3 requires the separate `gopkg.in/yaml.v3` module path
+- stop the official Go release manager from updating the Conda-managed toolkit
+  pin before that version exists on Conda Forge
+
+## v18.17.6 (date: 08.06.2026)
+
+### Security
+
+- update `gopkg.in/yaml.v2` from v2.2.2 to v2.2.8
+
 ## v18.17.5 (date: 30.05.2026)
 
 ### Dependency Updates
diff --git a/go.mod b/go.mod
index 9ec4e16..b200077 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/joshyorko/rcc
 
-go 1.26.3
+go 1.26.5
 
 require (
 	github.com/dchest/siphash v1.2.3
@@ -9,9 +9,9 @@ require (
 	github.com/mitchellh/go-ps v1.0.0
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/viper v1.21.0
-	golang.org/x/sys v0.45.0
-	golang.org/x/term v0.43.0
-	gopkg.in/yaml.v2 v2.2.8
+	golang.org/x/sys v0.47.0
+	golang.org/x/term v0.45.0
+	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
diff --git a/go.sum b/go.sum
index 72a5dd3..4599c12 100644
--- a/go.sum
+++ b/go.sum
@@ -367,11 +367,15 @@ golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
 golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
 golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
 golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
 golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
 golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=