diff --git a/.forgejo/workflows/validate.yml b/.forgejo/workflows/validate.yml
index 3bbc850..b12e563 100644
--- a/.forgejo/workflows/validate.yml
+++ b/.forgejo/workflows/validate.yml
@@ -119,7 +119,9 @@ jobs:
     runs-on: ubuntu-latest
     container:
       # Alpine image: git 2.45+, speaks sha256 wire protocol; small footprint.
-      image: golang:1.23-alpine3.21
+      # Pinned to 1.26 because signing-service depends on
+      # github.com/open-policy-agent/opa v1.21.4 which requires Go >= 1.26.0.
+      image: golang:1.26-alpine3.23
     steps:
       - name: Install git + bash in container
         run: |
diff --git a/services/signing-service/Dockerfile b/services/signing-service/Dockerfile
index 47d79d8..70b1b77 100644
--- a/services/signing-service/Dockerfile
+++ b/services/signing-service/Dockerfile
@@ -1,7 +1,9 @@
 # syntax=docker/dockerfile:1.7
 
 # ---------- build ----------
-FROM golang:1.23-alpine3.21 AS build
+# Pinned to 1.26 because this module depends on
+# github.com/open-policy-agent/opa v1.21.4 which requires Go >= 1.26.0.
+FROM golang:1.26-alpine3.23 AS build
 
 ENV CGO_ENABLED=0 \
     GOOS=linux \