diff --git a/os/mkosi/mkosi.conf b/os/mkosi/mkosi.conf
index 185087377..54835a0e9 100644
--- a/os/mkosi/mkosi.conf
+++ b/os/mkosi/mkosi.conf
@@ -6,7 +6,7 @@ MinimumVersion=26
 Distribution=debian
 Release=trixie
 Architecture=x86-64
-Snapshot=20260721T000000Z
+Snapshot=20261021T000000Z
 Repositories=main,contrib,non-free-firmware
 
 [Output]
diff --git a/os/mkosi/mkosi.tools.conf b/os/mkosi/mkosi.tools.conf
index c83a700e3..be614b18f 100644
--- a/os/mkosi/mkosi.tools.conf
+++ b/os/mkosi/mkosi.tools.conf
@@ -1,4 +1,4 @@
 # SPDX-License-Identifier: Apache-2.0
 [Distribution]
-Snapshot=20260721T000000Z
+Snapshot=20261021T000000Z
 Repositories=main
diff --git a/os/mkosi/tests/acceptance.sh b/os/mkosi/tests/acceptance.sh
index 0f34d11ce..aeee04a4f 100755
--- a/os/mkosi/tests/acceptance.sh
+++ b/os/mkosi/tests/acceptance.sh
@@ -268,16 +268,17 @@ grep -q 'scripts/build-components.sh' "$D/mkosi.build"
 grep -q '^BuildPackages=' "$D/mkosi.conf"
 grep -q '^ToolsTree=yes$' "$D/mkosi.conf"
 grep -q '^ToolsTreeProfiles=misc$' "$D/mkosi.conf"
-grep -q '^Snapshot=20260721T000000Z$' "$D/mkosi.tools.conf"
+grep -q '^Snapshot=20261021T000000Z$' "$D/mkosi.tools.conf"
 grep -q 'clean -f' "$D/build.sh"
 grep -q 'install-toolchains.sh' "$D/mkosi.build"
 grep -q '^RUST_TOOLCHAIN_VERSION=1.92.0$' "$D/versions.env"
-# Tracks the Go that oe-core pins for the production Yocto backend, so both
-# backends compile the same Go components with the same toolchain. It must also
-# stay >= the highest 'go' directive among them (nvidia-container-toolkit
+# Go 1.26.10 carries the CVE-2026-111943 fix (crypto/x509 rejects chains with
+# the compromised eMudhra/emSign intermediate CA keys), so this is ahead of the
+# Go that oe-core pins for the production Yocto backend. It must also stay >=
+# the highest 'go' directive among the Go components (nvidia-container-toolkit
 # currently declares go 1.25.0); GOTOOLCHAIN=local turns a violation into a
 # build failure rather than a silent download.
-grep -q '^GO_TOOLCHAIN_VERSION=1.26.2$' "$D/versions.env"
+grep -q '^GO_TOOLCHAIN_VERSION=1.26.10$' "$D/versions.env"
 for component in dstack-rust image-tools container-stack sysbox nvattest kernel nvidia zfs ovmf; do
   definition="$D/components/$component/$component.sh"
   grep -q "^COMPONENT_NAME=$component$" "$definition"
diff --git a/os/mkosi/versions.env b/os/mkosi/versions.env
index fcebc7b15..ff7f0a3e4 100644
--- a/os/mkosi/versions.env
+++ b/os/mkosi/versions.env
@@ -3,7 +3,7 @@
 KERNEL_VERSION=6.18.40
 KERNEL_SHA256=3712fc1ec839e4daac981176c8518912e8f452650aaedfe4381da4419613a431
 DEBIAN_RELEASE=trixie
-DEBIAN_SNAPSHOT=20260721T000000Z
+DEBIAN_SNAPSHOT=20261021T000000Z
 # Base of the kernel module builder image. It must predate DEBIAN_SNAPSHOT:
 # apt pinned to the snapshot cannot downgrade packages the base already ships.
 DEBIAN_BASE_IMAGE=debian:trixie-20260713-slim@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd
@@ -17,8 +17,8 @@ RUST_TOOLCHAIN_VERSION=1.92.0
 RUSTC_TOOLCHAIN_SHA256=78b2dd9c6b1fcd2621fa81c611cf5e2d6950690775038b585c64f364422886e0
 CARGO_TOOLCHAIN_SHA256=e5e12be2c7126a7036c8adf573078a28b92611f5767cc9bd0a6f7c83081df103
 RUST_STD_TOOLCHAIN_SHA256=5f106805ed86ebf8df287039e53a45cf974391ef4d088c2760776b05b8e48b5d
-GO_TOOLCHAIN_VERSION=1.26.2
-GO_TOOLCHAIN_SHA256=990e6b4bbba816dc3ee129eaeaf4b42f17c2800b88a2166c265ac1a200262282
+GO_TOOLCHAIN_VERSION=1.26.10
+GO_TOOLCHAIN_SHA256=ccfe7ae822d2c2f41f4fe7c956199967a4dac22d0ee0d2b2bfdb440aab3b20c5
 NITRO_TPM_TOOLS_REVISION=d76d6eeebd4169b00a3c3af9858852d48f40e748
 DSTACK_VERSION=0.6.1
 DSTACK_CODENAME=trixie