diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 44a741e..aa3d995 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,11 +25,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - go: '1.27.2'
-            version: '1.27.2'
+          - go: '1.27.3'
+            version: '1.27.3'
           - go: '1.27.x'
             # Reject stale manifests and caches below the security baseline.
-            version: '>=1.27.2 <1.28.0'
+            version: '>=1.27.3 <1.28.0'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -73,26 +73,26 @@ jobs:
           if-no-files-found: error
 
   macos-test:
-    name: macOS test (Go 1.27.2)
+    name: macOS test (Go 1.27.3)
     runs-on: macos-14
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.27.2
+          go-version: 1.27.3
           cache: true
       - name: Test
         run: go test -shuffle=on -count=1 ./...
 
   windows-udp-test:
-    name: Windows UDP continuity (Go 1.27.2)
+    name: Windows UDP continuity (Go 1.27.3)
     runs-on: windows-2022
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.27.2
+          go-version: 1.27.3
           cache: true
       - name: Exercise native UDP continuity and platform bind errors
         shell: pwsh
@@ -159,7 +159,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '>=1.27.2 <1.28.0'
+          go-version: '>=1.27.3 <1.28.0'
           check-latest: true
           cache: true
       - run: make race
@@ -171,7 +171,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.27.2
+          go-version: 1.27.3
           cache: true
       - name: Run govulncheck
         run: ./scripts/govulncheck.sh
@@ -231,7 +231,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '>=1.27.2 <1.28.0'
+          go-version: '>=1.27.3 <1.28.0'
           check-latest: true
           cache: true
       - name: Cross-build
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 248e875..54e3faf 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -25,7 +25,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '>=1.27.2 <1.28.0'
+          go-version: '>=1.27.3 <1.28.0'
           check-latest: true
           cache: true
       - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index a636f49..9dc03af 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -40,7 +40,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '>=1.27.2 <1.28.0'
+          go-version: '>=1.27.3 <1.28.0'
           check-latest: true
           cache: true
       - name: Fuzz ${{ matrix.target }}
diff --git a/.github/workflows/netem.yml b/.github/workflows/netem.yml
index 28e7001..2763f0e 100644
--- a/.github/workflows/netem.yml
+++ b/.github/workflows/netem.yml
@@ -22,7 +22,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '>=1.27.2 <1.28.0'
+          go-version: '>=1.27.3 <1.28.0'
           check-latest: true
           cache: true
       - name: Install network test tools
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f26fa35..83949a3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,7 +28,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.27.2
+          go-version: 1.27.3
           cache: true
       - name: Verify tagged source and successful main checks
         id: source
diff --git a/Dockerfile b/Dockerfile
index e1d32dd..35aabac 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM --platform=$BUILDPLATFORM golang:1.27.2-alpine3.24@sha256:85dc1069ac644ea3c527b177303a406eb3358192816cd7f9e5848eb658851673 AS build
+FROM --platform=$BUILDPLATFORM golang:1.27.3-alpine3.24@sha256:d200d2dd76b03a99b52651fd1325aff7dcd35422c35c01bac56571b0507f3deb AS build
 
 ARG TARGETOS
 ARG TARGETARCH
diff --git a/README.md b/README.md
index 8819bcd..d9f8a55 100644
--- a/README.md
+++ b/README.md
@@ -87,7 +87,7 @@ Web cover 的目标是正常网站兼容、减少主动探测暴露并在 UDP 
 
 ## 快速开始
 
-客户端和服务端分别在各自机器上构建，需要 Go 1.27.2 或更高版本：
+客户端和服务端分别在各自机器上构建，需要 Go 1.27.3 或更高版本：
 
 ```bash
 git clone https://github.com/cppla/autocar.git
diff --git a/docs/DEPENDENCY-MAINTENANCE.md b/docs/DEPENDENCY-MAINTENANCE.md
index 81978b3..c48ee90 100644
--- a/docs/DEPENDENCY-MAINTENANCE.md
+++ b/docs/DEPENDENCY-MAINTENANCE.md
@@ -25,7 +25,7 @@ web-H3 adapter's transitive imports. It is not a local source override.
 The upstream baseline is
 `v1.8.3-0.20261006222701-ff1b50fbbe9a`
 (`ff1b50fbbe9a6dff1dcb1cfc0493bd5b0f073f67`). It requires Go 1.27;
-AutoCAR's minimum supported toolchain is Go 1.27.2.
+AutoCAR's minimum supported toolchain is Go 1.27.3.
 
 The initial compatibility patch queue fixes custom-QUIC shutdown signaling and
 transport-parameter ownership after preset cloning. Its deterministic shutdown
@@ -178,7 +178,7 @@ This is an update/release procedure, not a background monitoring service.
 
 The October 9 pre-merge scan reported 11 reachable advisory IDs in the Go
 1.27.1 / `x/net v0.59.0` build, following the October 8 advisory publication.
-Current builds require [Go 1.27.2](https://go.dev/doc/devel/release#go1.27.0)
+Current builds require [Go 1.27.3](https://go.dev/doc/devel/release#go1.27.0)
 and select `x/net v0.60.0`, including the
 [HTTP/2 HPACK race fix](https://pkg.go.dev/vuln/GO-2026-6617). CI, release builds
 and all current Go builder images are updated together; historical validation
diff --git a/docs/WEB_COVER.md b/docs/WEB_COVER.md
index 47f9513..0e70b3a 100644
--- a/docs/WEB_COVER.md
+++ b/docs/WEB_COVER.md
@@ -231,7 +231,7 @@ the upstream cannot be reached. Consequently, an upstream that requires an
 `Authorization` request header is not suitable without a separate authorized
 front end.
 
-With the minimum Go 1.27.2 security update, the standard reverse proxy rejects
+With the minimum Go 1.27.3 security update, the standard reverse proxy rejects
 `CONNECT` before contacting the upstream, addressing
 [GO-2026-6605](https://pkg.go.dev/vuln/GO-2026-6605). Unauthenticated or invalid
 CONNECT/CONNECT-UDP requests delegated to a reverse-proxy cover therefore get
diff --git a/go.mod b/go.mod
index ca53685..4474c26 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/cppla/autocar
 
-go 1.27.2
+go 1.27.3
 
 // Preserve upstream type identity for H2 and the web-H3 adapter. See docs/DEPENDENCY-MAINTENANCE.md.
 replace github.com/refraction-networking/utls => github.com/cppla/utls v0.0.0-20261009031926-14c2a4cb1403
diff --git a/scripts/stealth-build-info/main_test.go b/scripts/stealth-build-info/main_test.go
index 74e215b..da1ba4c 100644
--- a/scripts/stealth-build-info/main_test.go
+++ b/scripts/stealth-build-info/main_test.go
@@ -22,7 +22,7 @@ import (
 
 func fixtureBuildInfo(spec binarySpec) *debug.BuildInfo {
 	info := &debug.BuildInfo{
-		GoVersion: "go1.27.2",
+		GoVersion: "go1.27.3",
 		Path:      spec.path,
 		Main:      debug.Module{Path: "github.com/cppla/autocar", Version: "(devel)"},
 		Settings: []debug.BuildSetting{
@@ -57,7 +57,7 @@ func TestInspectBuildInfoReplacement(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if len(got.Modules) != 3 || got.Package != autocarSpec.path || got.GoVersion != "go1.27.2" || got.GOOS != "linux" || got.GOARCH != "arm64" {
+	if len(got.Modules) != 3 || got.Package != autocarSpec.path || got.GoVersion != "go1.27.3" || got.GOOS != "linux" || got.GOARCH != "arm64" {
 		t.Fatalf("unexpected binary provenance: %+v", got)
 	}
 	for i, path := range selectedModules {
@@ -249,7 +249,7 @@ func TestProvenanceRequiresMatchingCompilerAndTarget(t *testing.T) {
 	for _, edit := range []func(*binaryProvenance){
 		func(b *binaryProvenance) { b.GOOS = "darwin" },
 		func(b *binaryProvenance) { b.GOARCH = "amd64" },
-		func(b *binaryProvenance) { b.GoVersion = "go1.27.3" },
+		func(b *binaryProvenance) { b.GoVersion = "go1.27.4" },
 	} {
 		changed := control
 		edit(&changed)
@@ -329,7 +329,7 @@ func TestReadRealCompiledBinaryOfflineWithoutExecuting(t *testing.T) {
 	if err := os.MkdirAll(commandDir, 0700); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(dir, "go.mod"), []byte("module github.com/cppla/autocar\n\ngo 1.27.2\n"), 0600); err != nil {
+	if err := os.WriteFile(filepath.Join(dir, "go.mod"), []byte("module github.com/cppla/autocar\n\ngo 1.27.3\n"), 0600); err != nil {
 		t.Fatal(err)
 	}
 	marker := filepath.Join(dir, "must-not-run")
diff --git a/scripts/stealth-campaign-toy.Dockerfile b/scripts/stealth-campaign-toy.Dockerfile
index e4a37bc..1c32520 100644
--- a/scripts/stealth-campaign-toy.Dockerfile
+++ b/scripts/stealth-campaign-toy.Dockerfile
@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1
-FROM golang:1.27.2-alpine3.24@sha256:85dc1069ac644ea3c527b177303a406eb3358192816cd7f9e5848eb658851673 AS build
+FROM golang:1.27.3-alpine3.24@sha256:d200d2dd76b03a99b52651fd1325aff7dcd35422c35c01bac56571b0507f3deb AS build
 WORKDIR /src
 COPY scripts/stealth-campaign-toy/main.go .
 RUN CGO_ENABLED=0 GO111MODULE=off go build -trimpath -o /out/stealth-campaign-toy ./main.go
diff --git a/scripts/stealth-capture.Dockerfile b/scripts/stealth-capture.Dockerfile
index 760d33c..cc3d398 100644
--- a/scripts/stealth-capture.Dockerfile
+++ b/scripts/stealth-capture.Dockerfile
@@ -3,7 +3,7 @@
 # This helper is never a workload endpoint.  The campaign driver uses its
 # tcpdump/ip/tc binaries only inside explicitly labelled container namespaces.
 # Reuse the already-pinned Alpine base used by stealth-lab.Dockerfile.
-FROM golang:1.27.2-alpine3.24@sha256:85dc1069ac644ea3c527b177303a406eb3358192816cd7f9e5848eb658851673
+FROM golang:1.27.3-alpine3.24@sha256:d200d2dd76b03a99b52651fd1325aff7dcd35422c35c01bac56571b0507f3deb
 
 RUN apk add --no-cache iproute2 tcpdump
 
diff --git a/scripts/stealth-full-runner.Dockerfile b/scripts/stealth-full-runner.Dockerfile
index a1fd29a..68b8cfe 100644
--- a/scripts/stealth-full-runner.Dockerfile
+++ b/scripts/stealth-full-runner.Dockerfile
@@ -3,7 +3,7 @@
 # Build both formal-campaign clients from the same pinned Go toolchain and
 # module graph. The launcher records the resulting immutable image ID, then
 # extracts the two binaries for campaign provenance.
-FROM --platform=$BUILDPLATFORM golang:1.27.2-alpine3.24@sha256:85dc1069ac644ea3c527b177303a406eb3358192816cd7f9e5848eb658851673 AS build
+FROM --platform=$BUILDPLATFORM golang:1.27.3-alpine3.24@sha256:d200d2dd76b03a99b52651fd1325aff7dcd35422c35c01bac56571b0507f3deb AS build
 
 ARG TARGETOS
 ARG TARGETARCH
diff --git a/scripts/stealth-lab.Dockerfile b/scripts/stealth-lab.Dockerfile
index a79768f..a2677ce 100644
--- a/scripts/stealth-lab.Dockerfile
+++ b/scripts/stealth-lab.Dockerfile
@@ -3,7 +3,7 @@
 # Keep the builder aligned with the product Dockerfile so the probe uses the
 # same module graph and Go toolchain. The runtime is scratch: the test gateway,
 # origin, probe, and control server require no shell or ambient packages.
-FROM --platform=$BUILDPLATFORM golang:1.27.2-alpine3.24@sha256:85dc1069ac644ea3c527b177303a406eb3358192816cd7f9e5848eb658851673 AS build
+FROM --platform=$BUILDPLATFORM golang:1.27.3-alpine3.24@sha256:d200d2dd76b03a99b52651fd1325aff7dcd35422c35c01bac56571b0507f3deb AS build
 
 ARG TARGETOS
 ARG TARGETARCH
diff --git a/scripts/stealth-pilot-config.py b/scripts/stealth-pilot-config.py
index 2d5f90c..215d589 100755
--- a/scripts/stealth-pilot-config.py
+++ b/scripts/stealth-pilot-config.py
@@ -623,7 +623,7 @@ def self_test_build_provenance(root: Path) -> Dict[str, Any]:
     report: Dict[str, Any] = {"schema_version": 1, "kind": BUILD_INFO_KIND}
     for role, filename in (("autocar", "autocar"), ("control", "stealth-pilot")):
         report[role] = {
-            "binary_sha256": sha256(root / filename), "go_version": "go1.27.2",
+            "binary_sha256": sha256(root / filename), "go_version": "go1.27.3",
             "goos": "linux", "goarch": "arm64", "package": BUILD_PACKAGES[role],
             "modules": [{
                 "module_path": identity, "requested_version": "v0.63.0" if identity == NATIVE_QUIC else "v1.2.3",
diff --git a/scripts/test_dependency_boundary.py b/scripts/test_dependency_boundary.py
index bf33758..548a803 100644
--- a/scripts/test_dependency_boundary.py
+++ b/scripts/test_dependency_boundary.py
@@ -41,7 +41,7 @@ def setUp(self):
             f"replace {self.quic_upstream} => {self.quic_fork} {QUIC_FORK_VERSION}"
         )
         self.module = (
-            "module example.invalid/fixture\n\ngo 1.27.2\n\nrequire (\n"
+            "module example.invalid/fixture\n\ngo 1.27.3\n\nrequire (\n"
             f"\t{PINS['ALLOWED_WEB_QUIC_MODULE']} {PINS['ALLOWED_WEB_QUIC_VERSION']}\n"
             f"\t{self.upstream} {PINS['ALLOWED_UTLS_UPSTREAM_VERSION']}\n"
             ")\n\n" + self.replacement + "\n" + self.quic_replacement + "\n"