diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
index 26cd50a..85835f5 100644
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -19,7 +19,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.26.6"
+          go-version: "1.26.9"
 
       - name: Run converting
         run: make e2e
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index c684863..ea55c8f 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -16,7 +16,7 @@ jobs:
       fail-fast: false
       matrix:
         go-version:
-          - "1.26.6"
+          - "1.26.9"
     steps:
       - uses: actions/checkout@v7
         with:
@@ -44,7 +44,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.26.6"
+          go-version: "1.26.9"
 
       - name: Verify modules
         run: go mod verify
@@ -74,5 +74,5 @@ jobs:
       - id: govulncheck
         uses: golang/govulncheck-action@v1
         with:
-          go-version-input: "1.26.6"
+          go-version-input: "1.26.9"
           go-package: ./...
diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml
index 6c456b5..15014bf 100644
--- a/.github/workflows/goreleaser.yml
+++ b/.github/workflows/goreleaser.yml
@@ -20,7 +20,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.26.6"
+          go-version: "1.26.9"
 
       - name: Verify tag matches the app version
         run: |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 33df259..5122336 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -31,13 +31,22 @@ Planned release: 2.1.0.
   dumped configuration. **If you ran `gh-md-toc --debug` in CI or any environment with
   shared logs, rotate that token.** The debug output now only reports whether a token was
   configured. ([#60](https://github.com/ekalinin/github-markdown-toc.go/pull/60))
-- CI and releases now build with Go 1.26.6. Go 1.26.5 carried four standard-library
+- CI and releases now build with Go 1.26.9. Go 1.26.5 carried four standard-library
   vulnerabilities that `govulncheck` reports as reachable from this code:
   [GO-2026-6218](https://pkg.go.dev/vuln/GO-2026-6218) (`net/url`),
   [GO-2026-6090](https://pkg.go.dev/vuln/GO-2026-6090) (`crypto/tls`),
   [GO-2026-5972](https://pkg.go.dev/vuln/GO-2026-5972) (`encoding/asn1`) and
-  [GO-2026-5026](https://pkg.go.dev/vuln/GO-2026-5026) (`net/http`). Binaries you built
-  yourself with Go 1.26.5 or earlier should be rebuilt.
+  [GO-2026-5026](https://pkg.go.dev/vuln/GO-2026-5026) (`net/http`). Go 1.26.8 carried
+  nine more: [GO-2026-6617](https://pkg.go.dev/vuln/GO-2026-6617),
+  [GO-2026-6613](https://pkg.go.dev/vuln/GO-2026-6613),
+  [GO-2026-6612](https://pkg.go.dev/vuln/GO-2026-6612),
+  [GO-2026-6611](https://pkg.go.dev/vuln/GO-2026-6611),
+  [GO-2026-6610](https://pkg.go.dev/vuln/GO-2026-6610),
+  [GO-2026-6605](https://pkg.go.dev/vuln/GO-2026-6605) and
+  [GO-2026-6603](https://pkg.go.dev/vuln/GO-2026-6603) (`net/http`),
+  [GO-2026-6608](https://pkg.go.dev/vuln/GO-2026-6608) (`net/textproto`, `mime/multipart`)
+  and [GO-2026-6607](https://pkg.go.dev/vuln/GO-2026-6607) (`crypto/tls`). Binaries you
+  built yourself with Go 1.26.8 or earlier should be rebuilt.
 
 ### Changed