diff --git a/.goreleaser.yml b/.goreleaser.yml
index 51092011..63a1b9a8 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -2,7 +2,7 @@
 version: 2
 before:
   hooks:
-    - go mod tidy -compat=1.26
+    - go mod tidy -compat=1.27
     - go mod vendor
 
 release:
diff --git a/AGENTS.md b/AGENTS.md
index 8f3428ac..5a3f070b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -66,7 +66,7 @@ similar lines of code is better than a premature abstraction.
 ## Quick Start
 
 ```bash
-# Enter the nix dev shell (Go 1.26.1, buf, golangci-lint, prek)
+# Enter the nix dev shell (Go 1.27.0, buf, golangci-lint, prek)
 nix develop
 
 # Full development workflow: fmt + lint + test + build
@@ -89,7 +89,7 @@ go run ./cmd/hi doctor
 go run ./cmd/hi run "TestName"
 ```
 
-Go 1.26.1 minimum (per `go.mod:3`). `nix develop` pins the exact toolchain
+Go 1.27.0 minimum (per `go.mod:3`). `nix develop` pins the exact toolchain
 used in CI.
 
 ## Pre-Commit with prek
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5300e23d..c981c816 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -44,6 +44,7 @@ keys remain all-access.
 
 - Expiring or deleting a non-existent pre-auth key now returns an error instead of silently succeeding [#3324](https://github.com/juanfont/headscale/pull/3324)
 - Improve systemd service file hardening [#3341](https://github.com/juanfont/headscale/pull/3341)
+- Headscale now requires Go 1.27 to build
 
 ## 0.29.3 (2026-07-29)
 
diff --git a/Dockerfile.derper b/Dockerfile.derper
index b4c91b0a..ce27c3f1 100644
--- a/Dockerfile.derper
+++ b/Dockerfile.derper
@@ -1,6 +1,6 @@
 # For testing purposes only
 
-FROM golang:1.26.5-alpine AS build-env
+FROM golang:1.27.0-alpine AS build-env
 
 WORKDIR /go/src
 
diff --git a/Dockerfile.integration b/Dockerfile.integration
index 7e55643e..bf02f5fe 100644
--- a/Dockerfile.integration
+++ b/Dockerfile.integration
@@ -2,7 +2,7 @@
 # and are in no way endorsed by Headscale's maintainers as an
 # official nor supported release or distribution.
 
-FROM docker.io/golang:1.26.5-trixie AS builder
+FROM docker.io/golang:1.27.0-trixie AS builder
 ARG VERSION=dev
 ENV GOPATH /go
 WORKDIR /go/src/headscale
diff --git a/Dockerfile.tailscale-HEAD b/Dockerfile.tailscale-HEAD
index 7c251f35..b8779dfc 100644
--- a/Dockerfile.tailscale-HEAD
+++ b/Dockerfile.tailscale-HEAD
@@ -4,7 +4,7 @@
 # This Dockerfile is more or less lifted from tailscale/tailscale
 # to ensure a similar build process when testing the HEAD of tailscale.
 
-FROM golang:1.26.5-alpine AS build-env
+FROM golang:1.27.0-alpine AS build-env
 
 WORKDIR /go/src
 
diff --git a/Dockerfile.wasmclient b/Dockerfile.wasmclient
index ba8714fa..6cc405b6 100644
--- a/Dockerfile.wasmclient
+++ b/Dockerfile.wasmclient
@@ -7,7 +7,7 @@
 # to drive a real browser-style WebSocket GET against headscale's /ts2021,
 # guarding the regression in issue #3357.
 
-FROM golang:1.26.5-alpine AS build
+FROM golang:1.27.0-alpine AS build
 
 WORKDIR /src
 
diff --git a/cmd/hi/README.md b/cmd/hi/README.md
index 7678111d..6c105cfd 100644
--- a/cmd/hi/README.md
+++ b/cmd/hi/README.md
@@ -55,7 +55,7 @@ changing.
 | `--timeout`         | `120m`         | Total test timeout. Use the built-in flag — never wrap with bash `timeout`. |
 | `--postgres`        | `false`        | Use PostgreSQL instead of SQLite                                            |
 | `--failfast`        | `true`         | Stop on first test failure                                                  |
-| `--go-version`      | auto           | Detected from `go.mod` (currently 1.26.1)                                   |
+| `--go-version`      | auto           | Detected from `go.mod` (currently 1.27.0)                                   |
 | `--clean-before`    | `true`         | Clean stale (stopped/exited) containers before starting                     |
 | `--clean-after`     | `true`         | Clean this run's containers after completion                                |
 | `--keep-on-failure` | `false`        | Preserve containers for manual inspection on failure                        |
diff --git a/cmd/hi/run.go b/cmd/hi/run.go
index 35214e3c..e0fbd1c0 100644
--- a/cmd/hi/run.go
+++ b/cmd/hi/run.go
@@ -71,7 +71,7 @@ func detectGoVersion() string {
 	if err != nil {
 		content, err = os.ReadFile(filepath.Join("..", "..", "go.mod"))
 		if err != nil {
-			return "1.26.1"
+			return "1.27.0"
 		}
 	}
 
@@ -83,5 +83,5 @@ func detectGoVersion() string {
 		}
 	}
 
-	return "1.26.1"
+	return "1.27.0"
 }
diff --git a/docs/setup/install/source.md b/docs/setup/install/source.md
index b46931af..87ff9433 100644
--- a/docs/setup/install/source.md
+++ b/docs/setup/install/source.md
@@ -43,7 +43,7 @@ cp headscale /usr/local/sbin
 
 ```shell
 # Install prerequisites
-# 1. go v1.20+: headscale newer than 0.21 needs go 1.20+ to compile
+# 1. go v1.27+: see the go directive in go.mod for the exact minimum
 # 2. gmake: Makefile in the headscale repo is written in GNU make syntax
 
 git clone https://github.com/juanfont/headscale.git