diff --git a/.github/workflows/action-buildpack-compute-metadata.yml b/.github/workflows/action-buildpack-compute-metadata.yml
index 7d7c3cc..7cfe6fe 100644
--- a/.github/workflows/action-buildpack-compute-metadata.yml
+++ b/.github/workflows/action-buildpack-compute-metadata.yml
@@ -2,14 +2,22 @@ name: Action buildpack-compute-metadata
 "on":
   pull_request:
     paths:
+    - .github/workflows/action-buildpack-compute-metadata.yml
     - buildpack/compute-metadata/**
+    - Dockerfile
+    - go.mod
+    - go.sum
     - internal/**
   push:
     branches:
     - main
     - test
     paths:
+    - .github/workflows/action-buildpack-compute-metadata.yml
     - buildpack/compute-metadata/**
+    - Dockerfile
+    - go.mod
+    - go.sum
     - internal/**
   release:
     types:
@@ -58,6 +66,7 @@ jobs:
               docker build \
                 --file Dockerfile \
                 --build-arg "SOURCE=${SOURCE}" \
+                --build-arg "GO_VERSION=$(sed -nE 's/^go ([0-9]+\.[0-9]+).*/\1/p' go.mod)" \
                 --tag "${TARGET}:${VERSION}" \
                 .
             echo "::endgroup::"
diff --git a/.github/workflows/action-buildpackage-verify-metadata.yml b/.github/workflows/action-buildpackage-verify-metadata.yml
index fdd77b0..f582b18 100644
--- a/.github/workflows/action-buildpackage-verify-metadata.yml
+++ b/.github/workflows/action-buildpackage-verify-metadata.yml
@@ -2,14 +2,22 @@ name: Action buildpackage-verify-metadata
 "on":
   pull_request:
     paths:
+    - .github/workflows/action-buildpackage-verify-metadata.yml
     - buildpackage/verify-metadata/**
+    - Dockerfile
+    - go.mod
+    - go.sum
     - internal/**
   push:
     branches:
     - main
     - test
     paths:
+    - .github/workflows/action-buildpackage-verify-metadata.yml
     - buildpackage/verify-metadata/**
+    - Dockerfile
+    - go.mod
+    - go.sum
     - internal/**
   release:
     types:
@@ -58,6 +66,7 @@ jobs:
               docker build \
                 --file Dockerfile \
                 --build-arg "SOURCE=${SOURCE}" \
+                --build-arg "GO_VERSION=$(sed -nE 's/^go ([0-9]+\.[0-9]+).*/\1/p' go.mod)" \
                 --tag "${TARGET}:${VERSION}" \
                 .
             echo "::endgroup::"
diff --git a/.github/workflows/action-registry-add-entry.yml b/.github/workflows/action-registry-add-entry.yml
index 79fb9fe..4717afd 100644
--- a/.github/workflows/action-registry-add-entry.yml
+++ b/.github/workflows/action-registry-add-entry.yml
@@ -2,6 +2,10 @@ name: Action registry-add-entry
 "on":
   pull_request:
     paths:
+    - .github/workflows/action-registry-add-entry.yml
+    - Dockerfile
+    - go.mod
+    - go.sum
     - internal/**
     - registry/add-entry/**
     - registry/internal/**
@@ -10,6 +14,10 @@ name: Action registry-add-entry
     - main
     - test
     paths:
+    - .github/workflows/action-registry-add-entry.yml
+    - Dockerfile
+    - go.mod
+    - go.sum
     - internal/**
     - registry/add-entry/**
     - registry/internal/**
@@ -60,6 +68,7 @@ jobs:
               docker build \
                 --file Dockerfile \
                 --build-arg "SOURCE=${SOURCE}" \
+                --build-arg "GO_VERSION=$(sed -nE 's/^go ([0-9]+\.[0-9]+).*/\1/p' go.mod)" \
                 --tag "${TARGET}:${VERSION}" \
                 .
             echo "::endgroup::"
diff --git a/.github/workflows/action-registry-compute-metadata.yml b/.github/workflows/action-registry-compute-metadata.yml
index 5232714..b3fb689 100644
--- a/.github/workflows/action-registry-compute-metadata.yml
+++ b/.github/workflows/action-registry-compute-metadata.yml
@@ -2,6 +2,10 @@ name: Action registry-compute-metadata
 "on":
   pull_request:
     paths:
+    - .github/workflows/action-registry-compute-metadata.yml
+    - Dockerfile
+    - go.mod
+    - go.sum
     - internal/**
     - registry/compute-metadata/**
     - registry/internal/**
@@ -10,6 +14,10 @@ name: Action registry-compute-metadata
     - main
     - test
     paths:
+    - .github/workflows/action-registry-compute-metadata.yml
+    - Dockerfile
+    - go.mod
+    - go.sum
     - internal/**
     - registry/compute-metadata/**
     - registry/internal/**
@@ -60,6 +68,7 @@ jobs:
               docker build \
                 --file Dockerfile \
                 --build-arg "SOURCE=${SOURCE}" \
+                --build-arg "GO_VERSION=$(sed -nE 's/^go ([0-9]+\.[0-9]+).*/\1/p' go.mod)" \
                 --tag "${TARGET}:${VERSION}" \
                 .
             echo "::endgroup::"
diff --git a/.github/workflows/action-registry-request-add-entry.yml b/.github/workflows/action-registry-request-add-entry.yml
index 56d3c3d..4cae491 100644
--- a/.github/workflows/action-registry-request-add-entry.yml
+++ b/.github/workflows/action-registry-request-add-entry.yml
@@ -2,6 +2,10 @@ name: Action registry-request-add-entry
 "on":
   pull_request:
     paths:
+    - .github/workflows/action-registry-request-add-entry.yml
+    - Dockerfile
+    - go.mod
+    - go.sum
     - internal/**
     - registry/internal/**
     - registry/request-add-entry/**
@@ -10,6 +14,10 @@ name: Action registry-request-add-entry
     - main
     - test
     paths:
+    - .github/workflows/action-registry-request-add-entry.yml
+    - Dockerfile
+    - go.mod
+    - go.sum
     - internal/**
     - registry/internal/**
     - registry/request-add-entry/**
@@ -60,6 +68,7 @@ jobs:
               docker build \
                 --file Dockerfile \
                 --build-arg "SOURCE=${SOURCE}" \
+                --build-arg "GO_VERSION=$(sed -nE 's/^go ([0-9]+\.[0-9]+).*/\1/p' go.mod)" \
                 --tag "${TARGET}:${VERSION}" \
                 .
             echo "::endgroup::"
diff --git a/.github/workflows/action-registry-request-yank-entry.yml b/.github/workflows/action-registry-request-yank-entry.yml
index 43d0682..6bd9b92 100644
--- a/.github/workflows/action-registry-request-yank-entry.yml
+++ b/.github/workflows/action-registry-request-yank-entry.yml
@@ -2,6 +2,10 @@ name: Action registry-request-yank-entry
 "on":
   pull_request:
     paths:
+    - .github/workflows/action-registry-request-yank-entry.yml
+    - Dockerfile
+    - go.mod
+    - go.sum
     - internal/**
     - registry/internal/**
     - registry/request-yank-entry/**
@@ -10,6 +14,10 @@ name: Action registry-request-yank-entry
     - main
     - test
     paths:
+    - .github/workflows/action-registry-request-yank-entry.yml
+    - Dockerfile
+    - go.mod
+    - go.sum
     - internal/**
     - registry/internal/**
     - registry/request-yank-entry/**
@@ -60,6 +68,7 @@ jobs:
               docker build \
                 --file Dockerfile \
                 --build-arg "SOURCE=${SOURCE}" \
+                --build-arg "GO_VERSION=$(sed -nE 's/^go ([0-9]+\.[0-9]+).*/\1/p' go.mod)" \
                 --tag "${TARGET}:${VERSION}" \
                 .
             echo "::endgroup::"
diff --git a/.github/workflows/action-registry-verify-namespace-owner.yml b/.github/workflows/action-registry-verify-namespace-owner.yml
index bd936d1..6e07170 100644
--- a/.github/workflows/action-registry-verify-namespace-owner.yml
+++ b/.github/workflows/action-registry-verify-namespace-owner.yml
@@ -2,6 +2,10 @@ name: Action registry-verify-namespace-owner
 "on":
   pull_request:
     paths:
+    - .github/workflows/action-registry-verify-namespace-owner.yml
+    - Dockerfile
+    - go.mod
+    - go.sum
     - internal/**
     - registry/internal/**
     - registry/verify-namespace-owner/**
@@ -10,6 +14,10 @@ name: Action registry-verify-namespace-owner
     - main
     - test
     paths:
+    - .github/workflows/action-registry-verify-namespace-owner.yml
+    - Dockerfile
+    - go.mod
+    - go.sum
     - internal/**
     - registry/internal/**
     - registry/verify-namespace-owner/**
@@ -60,6 +68,7 @@ jobs:
               docker build \
                 --file Dockerfile \
                 --build-arg "SOURCE=${SOURCE}" \
+                --build-arg "GO_VERSION=$(sed -nE 's/^go ([0-9]+\.[0-9]+).*/\1/p' go.mod)" \
                 --tag "${TARGET}:${VERSION}" \
                 .
             echo "::endgroup::"
diff --git a/.github/workflows/action-registry-yank-entry.yml b/.github/workflows/action-registry-yank-entry.yml
index 46df4ca..7b671bb 100644
--- a/.github/workflows/action-registry-yank-entry.yml
+++ b/.github/workflows/action-registry-yank-entry.yml
@@ -2,17 +2,25 @@ name: Action registry-yank-entry
 "on":
   pull_request:
     paths:
+    - .github/workflows/action-registry-yank-entry.yml
+    - Dockerfile
+    - go.mod
+    - go.sum
     - internal/**
-    - registry/yank-entry/**
     - registry/internal/**
+    - registry/yank-entry/**
   push:
     branches:
     - main
     - test
     paths:
+    - .github/workflows/action-registry-yank-entry.yml
+    - Dockerfile
+    - go.mod
+    - go.sum
     - internal/**
-    - registry/yank-entry/**
     - registry/internal/**
+    - registry/yank-entry/**
   release:
     types:
     - published
@@ -60,6 +68,7 @@ jobs:
               docker build \
                 --file Dockerfile \
                 --build-arg "SOURCE=${SOURCE}" \
+                --build-arg "GO_VERSION=$(sed -nE 's/^go ([0-9]+\.[0-9]+).*/\1/p' go.mod)" \
                 --tag "${TARGET}:${VERSION}" \
                 .
             echo "::endgroup::"
diff --git a/.github/workflows/pb-tests.yml b/.github/workflows/pb-tests.yml
index f91f4cd..15c088f 100644
--- a/.github/workflows/pb-tests.yml
+++ b/.github/workflows/pb-tests.yml
@@ -21,9 +21,14 @@ jobs:
                 key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
                 path: ${{ env.HOME }}/go/pkg/mod
                 restore-keys: ${{ runner.os }}-go-
+            # Uses only the major.minor from `go.mod`, since setup-go would otherwise install the
+            # exact (and often outdated) patch version in the `go` directive, such as `1.27.0`.
+            - id: go-version
+              run: echo "version=$(sed -nE 's/^go ([0-9]+\.[0-9]+).*/\1/p' go.mod)" >> "${GITHUB_OUTPUT}"
             - uses: actions/setup-go@v7
               with:
-                go-version: "1.26"
+                go-version: ${{ steps.go-version.outputs.version }}
+                check-latest: true
             - name: Install richgo
               run: |
                 #!/usr/bin/env bash
diff --git a/Dockerfile b/Dockerfile
index 8f0ed3e..d3297e2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,6 @@
-FROM golang:1.26 as build-stage
+# The major.minor of the `go` directive in `go.mod`, passed by the `action-*.yml` workflows.
+ARG GO_VERSION
+FROM golang:${GO_VERSION} as build-stage
 
 WORKDIR /src
 ENV GO111MODULE=on CGO_ENABLED=0
diff --git a/go.mod b/go.mod
index 6cd49bc..e1e2533 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,9 @@
 module github.com/buildpacks/github-actions
 
-go 1.26.0
+// This must use the full `1.N.0` form, since that's what Go's tooling (and so Dependabot)
+// rewrites it to. The GitHub Actions workflows use only the major.minor from this line for
+// `setup-go` and the `golang` image tag, so that they get the latest patch release.
+go 1.27.0
 
 require (
 	github.com/buildpacks/libcnb v1.30.4