diff --git a/.gitea/workflows/release-nightly.yml b/.gitea/workflows/release-nightly.yml
index 4b383240..7aa0a279 100644
--- a/.gitea/workflows/release-nightly.yml
+++ b/.gitea/workflows/release-nightly.yml
@@ -27,6 +27,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: "go.mod"
+          check-latest: true
       - name: import gpg
         id: import_gpg
         uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
diff --git a/.gitea/workflows/release-tag.yml b/.gitea/workflows/release-tag.yml
index b7a3dafc..67821d19 100644
--- a/.gitea/workflows/release-tag.yml
+++ b/.gitea/workflows/release-tag.yml
@@ -28,6 +28,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: 'go.mod'
+          check-latest: true
       - name: import gpg
         id: import_gpg
         uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
diff --git a/.gitea/workflows/test-pr.yml b/.gitea/workflows/test-pr.yml
index b1fa1355..b5c81466 100644
--- a/.gitea/workflows/test-pr.yml
+++ b/.gitea/workflows/test-pr.yml
@@ -20,6 +20,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: 'go.mod'
+          check-latest: true
       - name: lint and build
         run: |
           make clean
@@ -45,6 +46,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: 'go.mod'
+          check-latest: true
       - name: wait for the gitea instance to be ready
         run: |
           for i in $(seq 1 30); do
diff --git a/Makefile b/Makefile
index 6eaa2ae2..0376dbdf 100644
--- a/Makefile
+++ b/Makefile
@@ -118,7 +118,12 @@ unit-test-coverage:
 
 .PHONY: tidy
 tidy:
+	$(eval GO_TOOLCHAIN := $(shell grep -Eo '^toolchain\s+go[0-9.]+' go.mod | cut -d' ' -f2))
 	$(GO) mod tidy
+	@# workaround https://github.com/golang/go/issues/75331: restore toolchain if tidy dropped it
+	@if [ -n "$(GO_TOOLCHAIN)" ] && ! grep -qE '^toolchain\s' go.mod; then \
+		$(GO) mod edit -toolchain=$(GO_TOOLCHAIN); \
+	fi
 
 .PHONY: check
 check: test
diff --git a/go.mod b/go.mod
index dcb30bc3..fba7910c 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,8 @@
 module gitea.dev/tea
 
-go 1.26
+go 1.26.0
+
+toolchain go1.26.5
 
 require (
 	charm.land/glamour/v2 v2.0.1
diff --git a/renovate.json5 b/renovate.json5
index 72388496..c7e09e46 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -1,8 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "local>gitea/renovate-config",
-    "local>gitea/renovate-config:security",
-    "local>gitea/renovate-config:go-deps"
+    "local>gitea/renovate-config"
   ]
 }