diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 633e3c0f..96f3bcef 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -52,6 +52,9 @@ Maintainers can create a new release by following these instructions:
 2. Determine the appropriate version number for the release
    following [SemVer] guidelines.
 3. Click the <kbd>Draft a new release</kbd> button
+   Include the minimum Go version in the release notes whenever it changes,
+   including changes required by dependencies. Keep the README installation
+   requirements and the minimum-version CI job in sync with `go.mod`.
 4. Click the <kbd>Choose a tag</kbd> button
 5. Type in the version number for the release preceded by a `v`
 6. Click the <kbd>Publish release</kbd> button
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 10f65145..192c1e3e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,6 +12,8 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
+    env:
+      GOTOOLCHAIN: local
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
@@ -20,7 +22,8 @@ jobs:
 
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version-file: go.mod
+          # Pin the supported minimum so go.mod bumps require an explicit CI change.
+          go-version: '1.27.0'
 
       - name: Build
         run: go version && go build -v ./...
diff --git a/.gitignore b/.gitignore
index c682cbe6..c25c5e86 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,5 +3,6 @@ testdata/caches
 cache
 out.yaml
 /dependabot
+/cmd/dependabot/dependabot
 dependabot.exe
 .env
diff --git a/README.md b/README.md
index 3605b955..2926f824 100644
--- a/README.md
+++ b/README.md
@@ -12,11 +12,17 @@ The `dependabot` CLI is a tool for running Dependabot update jobs.
 
 Use any of the following for a pain-free installation:
 
-* If you have [`go`](https://go.dev/doc/install) installed, you can run:
+* If you have [`Go 1.27.0 or newer`](https://go.dev/doc/install) installed, you can run:
    ```shell
    go install github.com/dependabot/cli/cmd/dependabot@latest
    ```
    The benefit of this method is that re-running the command will always update to the latest version.
+   The minimum Go version is required by the CLI's Sigstore dependencies.
+   If `GOTOOLCHAIN=local` is set, Go cannot download a newer toolchain automatically;
+   upgrade Go before installing, or use a pre-built binary instead.
+   If you must build with Go 1.26, use
+   `go install github.com/dependabot/cli/cmd/dependabot@v1.95.0`.
+   This older release omits subsequent fixes and features; prefer a current pre-built binary.
 * You can download a pre-built binary from the [releases] page.
 * On Mac or Linux, you can run `brew install dependabot`