diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2c1cb62..04dbc8e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- Go toolchain bumped to 1.26.7 (from 1.26.5), clearing five stdlib vulnerabilities flagged by govulncheck (GO-2026-6218, GO-2026-6090, GO-2026-6089, GO-2026-5972, GO-2026-5026; all fixed by 1.26.6). The release image builder is pinned to `golang:1.26.7-alpine` so the shipped binary is built with the same toolchain CI tests with. Local builds now require Go >= 1.26.7.
+- `make vendor-core-crds` downloads the `sigs.k8s.io/karpenter` module before resolving its directory, fixing `generate` CI failures on any PR that changes `go.mod`/`go.sum` (cold module cache made `go list -m` return an empty dir).
+
 ## [2.1.0] - 2026-08-01
 
 ### Fixed
diff --git a/Dockerfile b/Dockerfile
index 1796300..3ee632e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 # Cross-compile from the native build platform to the target platform so multi-arch
 # builds don't run `go build` under slow QEMU emulation.
-FROM --platform=$BUILDPLATFORM golang:1.26-alpine AS builder
+FROM --platform=$BUILDPLATFORM golang:1.26.7-alpine AS builder
 ARG TARGETOS
 ARG TARGETARCH
 WORKDIR /app
diff --git a/Makefile b/Makefile
index e8fddd2..3ce2e9a 100644
--- a/Makefile
+++ b/Makefile
@@ -30,7 +30,9 @@ generate: vendor-core-crds
 # feature gates that default to false, and this chart does not expose them.
 vendor-core-crds:
 	@set -eu; \
+	go mod download sigs.k8s.io/karpenter; \
 	dir="$$(go list -m -f '{{.Dir}}' sigs.k8s.io/karpenter)"; \
+	[ -n "$$dir" ] || { echo "sigs.k8s.io/karpenter not found in module cache" >&2; exit 1; }; \
 	for crd in karpenter.sh_nodepools.yaml karpenter.sh_nodeclaims.yaml; do \
 		cp "$$dir/pkg/apis/crds/$$crd" charts/karpenter-provider-hetzner/crds/$$crd; \
 		chmod u+w charts/karpenter-provider-hetzner/crds/$$crd; \
diff --git a/go.mod b/go.mod
index 73df91f..9ed3187 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/paperclipinc/karpenter-provider-hetzner
 
-go 1.26.5
+go 1.26.7
 
 require (
 	github.com/awslabs/operatorpkg v0.0.0-20260708223819-4da4c353c5fa