diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index bee3fbd54..ca007708e 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -302,6 +302,10 @@ jobs:
           image: ${{ env.REGISTRY_PROD_ADDR }}/${{ env.UNTESTED_IMAGE_NAME }}:${{ steps.meta.outputs.version }}
           fail-build: true
           severity-cutoff: high
+          # Print findings to the log. The action otherwise defaults to
+          # SARIF written to a temp file nothing here reads, so a failure
+          # says findings exist without saying what they are.
+          output-format: table
 
   k8s-version-matrix-tests:
     # These should match the permissions in the called workflow.
diff --git a/.github/workflows/scan-images.yml b/.github/workflows/scan-images.yml
index 89d6d8849..6c12caf84 100644
--- a/.github/workflows/scan-images.yml
+++ b/.github/workflows/scan-images.yml
@@ -47,3 +47,7 @@ jobs:
           image: ${{ env.REGISTRY }}:${{ matrix.tag }}
           fail-build: true
           severity-cutoff: high
+          # Print findings to the log. The action otherwise defaults to
+          # SARIF written to a temp file nothing here reads, so a failure
+          # says findings exist without saying what they are.
+          output-format: table
diff --git a/.tools/go.mod b/.tools/go.mod
index 82350a9d9..70ab7a487 100644
--- a/.tools/go.mod
+++ b/.tools/go.mod
@@ -1,6 +1,6 @@
 module github.com/cloudzero/cloudzero-agent/.tools
 
-go 1.26.5
+go 1.26.7
 
 require (
 	github.com/homeport/dyff v1.12.0
diff --git a/docker/Dockerfile b/docker/Dockerfile
index a137a25b7..2b1d270df 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -2,7 +2,7 @@ ARG DEPLOY_IMAGE=scratch
 
 # prometheus-config-reloader version, built from source in the "reloader" stage.
 # Git tag — Dependabot can't track it, so bump by hand (see DEVELOPMENT.md).
-ARG RELOADER_VERSION=v0.91.0
+ARG RELOADER_VERSION=v0.93.1
 
 # Multi-stage Docker build with platform-specific cache optimization:
 # 1. base-tools: Install system packages and tools (cached per platform)
@@ -14,7 +14,7 @@ ARG RELOADER_VERSION=v0.91.0
 # 7. final: Minimal runtime image with compiled binaries
 
 # Stage 1: Base tools installation
-FROM --platform=$BUILDPLATFORM golang:1.26.5-alpine AS base-tools
+FROM --platform=$BUILDPLATFORM golang:1.26.7-alpine AS base-tools
 ARG TARGETPLATFORM
 ARG TARGETOS TARGETARCH
 
@@ -76,7 +76,7 @@ RUN --mount=type=cache,target=/go/pkg/mod,id=gomod-$TARGETPLATFORM \
 FROM gcr.io/distroless/static-debian12:debug@sha256:e60a053e6dd251ece065cc35e08c28f4ed55c559eeeb9102553bb09d5c0b0ad1 AS certs
 
 # Stage 5: Extract Alloy binary from CloudZero Alloy image
-FROM ghcr.io/cloudzero/alloy:v1.18.1 AS alloy
+FROM ghcr.io/cloudzero/alloy:v1.19.2-patch-1 AS alloy
 
 # Stage 6: Build prometheus-config-reloader from upstream source. We build it
 # (not copy the prebuilt image) to control the toolchain and bump vulnerable
@@ -90,9 +90,12 @@ WORKDIR /reloader-src
 RUN git clone --depth 1 --branch "${RELOADER_VERSION}" \
         https://github.com/prometheus-operator/prometheus-operator.git .
 
-# Bump vulnerable deps ahead of upstream's pins so the scan passes; drop when upstream catches up.
+# Upstream still ships x/crypto v0.54.0, which has GO-2026-6303, GO-2026-6354
+# and GO-2026-6355 open against it. This is an exact version and so downgrades
+# as readily as it upgrades: check what upstream resolves before touching it,
+# and delete it once upstream passes it rather than bumping it forever.
 RUN --mount=type=cache,target=/go/pkg/mod,id=gomod-reloader-$TARGETPLATFORM \
-    go get golang.org/x/crypto@v0.53.0 golang.org/x/net@v0.56.0 golang.org/x/text@v0.39.0
+    go get golang.org/x/crypto@v0.56.0
 
 RUN --mount=type=cache,target=/go/pkg/mod,id=gomod-reloader-$TARGETPLATFORM \
     --mount=type=cache,target=/root/.cache/go-build,id=gobuild-reloader-$TARGETPLATFORM \
diff --git a/go.mod b/go.mod
index 1bf3fe05e..1e4c6668d 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/cloudzero/cloudzero-agent
 
-go 1.26.5
+go 1.26.7
 
 require (
 	github.com/google/go-cmp v0.7.0
diff --git a/tests/docker/Dockerfile.smoke-tests b/tests/docker/Dockerfile.smoke-tests
index c94fbd515..850e745b2 100644
--- a/tests/docker/Dockerfile.smoke-tests
+++ b/tests/docker/Dockerfile.smoke-tests
@@ -8,7 +8,7 @@
 # components, avoiding the need to build and coordinate multiple images.
 
 # Stage 1: Base tools installation
-FROM golang:1.26.5-alpine AS base-tools
+FROM golang:1.26.7-alpine AS base-tools
 WORKDIR /app
 
 # Install system packages needed for building
diff --git a/tests/go.mod b/tests/go.mod
index ed5a6605b..e149b25ba 100644
--- a/tests/go.mod
+++ b/tests/go.mod
@@ -1,6 +1,6 @@
 module github.com/cloudzero/cloudzero-agent/tests
 
-go 1.26.5
+go 1.26.7
 
 require (
 	github.com/andybalholm/brotli v1.2.2
diff --git a/tests/integration/test_server/Dockerfile b/tests/integration/test_server/Dockerfile
index c17823fbe..3a1c083cd 100644
--- a/tests/integration/test_server/Dockerfile
+++ b/tests/integration/test_server/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.26.5
+FROM golang:1.26.7
 
 WORKDIR /app
 
diff --git a/tests/integration/test_server/go.mod b/tests/integration/test_server/go.mod
index 8c652bf2d..f74579297 100644
--- a/tests/integration/test_server/go.mod
+++ b/tests/integration/test_server/go.mod
@@ -1,5 +1,5 @@
 module main
 
-go 1.26.5
+go 1.26.7
 
 require github.com/golang/snappy v1.0.0