diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 237be4bfd2..bb6e752889 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,8 +25,6 @@ concurrency:
 
 env:
   TAG: ${{ inputs.tag || github.ref_name }}
-  # Go release used for the binaries: the newest patch of go.mod's version.
-  GO_VERSION: "1.26"
 
 jobs:
   build:
@@ -54,6 +52,11 @@ jobs:
         run: |
           echo "$TAG" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?$' || { echo "not a release tag: $TAG" >&2; exit 1; }
           echo "VERSION=${TAG#v}" >> "$GITHUB_ENV"
+          # Go release used for the binaries: exactly the tag's go.mod version
+          # (a bare "1.26" can resolve to an older cached patch on the runner).
+          go_version="$(awk '$1 == "go" { print $2 }' go.mod)"
+          test -n "$go_version" || { echo "no go directive in go.mod" >&2; exit 1; }
+          echo "GO_VERSION=$go_version" >> "$GITHUB_ENV"
           # Same version string as `make build` from the tag.
           echo "LDFLAGS=-s -w -X github.com/sqlc-dev/sqlc/internal/info.Version=${TAG}-wicked-fork" >> "$GITHUB_ENV"
 
diff --git a/docs/changelogs/2026-11-04-release-binaries.md b/docs/changelogs/2026-11-04-release-binaries.md
index 1c6b923bcd..2a5a3867e2 100644
--- a/docs/changelogs/2026-11-04-release-binaries.md
+++ b/docs/changelogs/2026-11-04-release-binaries.md
@@ -45,7 +45,9 @@ binaries for several platforms with an install script that checks the SHA-256.
 - D3 The build steps live in the workflow, not the Makefile, so a manual run
   can build tags older than this change (v2.4.0); the version flag matches the
   Makefile's.
-- D4 Go: newest patch of 1.26 (go.mod's version).
+- D4 Go: exactly the tag's go.mod version (`go 1.26.10` for v2.4.1). The first
+  v2.4.1 run used `1.26`, which setup-go resolved to a cached 1.26.7 on
+  `macos-15-intel`; go.mod refused it.
 - R1 GitHub runner labels (`macos-15-intel`, `ubuntu-24.04-arm`) are checked
   only when the workflow first runs.