diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index aeb8492..ba3049b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -64,6 +64,12 @@ jobs:
           govulncheck ./...
       - name: osv-scanner (OSV.dev cross-ecosystem scan)
         uses: google/osv-scanner-action/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
+        env:
+          # setup-go exports GOTOOLCHAIN=local, which leaks into the scanner
+          # container. Its bundled Go is older than our go directive, so the
+          # reachability analysis can't load packages and every vuln in the
+          # module graph gets reported as if it were called.
+          GOTOOLCHAIN: auto
         with:
           scan-args: |-
             --recursive
diff --git a/go.mod b/go.mod
index 342f3f8..0bc0ef0 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/0-draft/mcp-opa
 
-go 1.26.4
+go 1.26.5
 
 require (
 	github.com/mark3labs/mcp-go v0.55.1