diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index e6fb0d1a0d6..d3692d99d54 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -1,4 +1,4 @@
-ARG VARIANT="1.26"
+ARG VARIANT="1.27"
 FROM mcr.microsoft.com/vscode/devcontainers/go:${VARIANT}
 RUN apt-get update && \
     export DEBIAN_FRONTEND=noninteractive && \
diff --git a/.github/workflows/go-version-check.yaml b/.github/workflows/go-version-check.yaml
index 278465b55d7..a2a126e9e52 100644
--- a/.github/workflows/go-version-check.yaml
+++ b/.github/workflows/go-version-check.yaml
@@ -407,8 +407,10 @@ jobs:
 
           # Determine GOEXPERIMENT requirements
           if [ "$TARGET_MIN_NUM" -ge 27 ]; then
-            GOEXP_CGO1="systemcrypto"
-            GOEXP_CGO0="systemcrypto"
+            # Go 1.27+ removed the crypto GOEXPERIMENTs and selects system crypto
+            # automatically, so no GOEXPERIMENT should be set for either CGO mode.
+            GOEXP_CGO1=""
+            GOEXP_CGO0=""
           elif [ "$TARGET_MIN_NUM" -ge 26 ]; then
             GOEXP_CGO1="systemcrypto"
             GOEXP_CGO0="ms_nocgo_opensslcrypto"
@@ -467,7 +469,7 @@ jobs:
           incorrect FIPS configuration for the current Go version.
 
           **FIPS rules:**
-          - CGO_ENABLED=1: GOEXPERIMENT=\`${GOEXP_CGO1}\`
+          - CGO_ENABLED=1: GOEXPERIMENT=\`${GOEXP_CGO1:-<none>}\`
           - CGO_ENABLED=0: GOEXPERIMENT=\`${GOEXP_CGO0:-<none>}\`
 
           **Reference:** https://github.com/microsoft/go/blob/microsoft/main/eng/doc/NocgoOpenSSL.md
@@ -605,8 +607,8 @@ jobs:
 
           # Determine GOEXPERIMENT rules per version
           if [ "$TARGET_MIN_NUM" -ge 27 ]; then
-            echo "goexp_cgo1=systemcrypto" >> "$GITHUB_OUTPUT"
-            echo "goexp_cgo0=systemcrypto" >> "$GITHUB_OUTPUT"
+            echo "goexp_cgo1=" >> "$GITHUB_OUTPUT"
+            echo "goexp_cgo0=" >> "$GITHUB_OUTPUT"
           elif [ "$TARGET_MIN_NUM" -ge 26 ]; then
             echo "goexp_cgo1=systemcrypto" >> "$GITHUB_OUTPUT"
             echo "goexp_cgo0=ms_nocgo_opensslcrypto" >> "$GITHUB_OUTPUT"
@@ -688,19 +690,18 @@ jobs:
           if [ "$FIPS_READY" = "true" ]; then
             FIPS_SECTION="
           ### FIPS Status: ✅ Already configured
-          GOEXPERIMENT and distroless/base are already correctly configured.
+          System crypto and distroless/base are already correctly configured.
           No FIPS changes needed for this upgrade."
           elif [ "$LATEST_MIN_NUM" -ge 27 ]; then
             FIPS_SECTION="
           ### ⚠️ FIPS / System Crypto Requirements
-          Go 1.27+ lifts the cgo requirement for systemcrypto on Linux.
-          \`GOEXPERIMENT=systemcrypto\` can now be set in ALL scripts/Dockerfiles regardless of CGO setting.
+          Go 1.27+ selects system crypto automatically and lifts the cgo requirement on supported Linux architectures.
           Reference: https://github.com/microsoft/go/blob/microsoft/main/eng/doc/NocgoOpenSSL.md
 
-          1. Set \`GOEXPERIMENT=systemcrypto\` in ALL Dockerfile templates and pipeline build scripts
-          2. Remove \`MS_GO_NOSYSTEMCRYPTO=1\` from npm Dockerfiles if present
+          1. Remove \`GOEXPERIMENT=systemcrypto\`, \`GOEXPERIMENT=nosystemcrypto\`, and \`GOEXPERIMENT=ms_nocgo_opensslcrypto\` from all build scripts and Dockerfiles; these experiments are removed and cause build errors
+          2. **Keep** \`MS_GO_NOSYSTEMCRYPTO=1\` in the npm build script and npm Dockerfiles. It is an environment variable, **not** a GOEXPERIMENT, and it is still supported in Go 1.27. npm ships on an Ubuntu base without the Microsoft FIPS OpenSSL build, so removing it makes the binary require OpenSSL at startup and panic during initialization
           3. Ensure \`MARINER_DISTROLESS_IMG\` in \`build/images.mk\` is \`distroless/base\`
-          4. Update \`bpf-prog/ipv6-hp-bpf/linux.Dockerfile\` runtime base to \`azurelinux/distroless/base:3.0\`"
+          4. Update \`bpf-prog/ipv6-hp-bpf/linux.Dockerfile\` runtime base to \`mcr.microsoft.com/azurelinux/distroless/base:3.0\` (keep the full registry prefix — a bare \`azurelinux/...\` reference resolves to Docker Hub and is not pullable)"
           elif [ "$LATEST_MIN_NUM" -ge 26 ]; then
             FIPS_SECTION="
           ### ⚠️ FIPS / System Crypto Requirements (CRITICAL — builds will FAIL without this)
@@ -718,7 +719,7 @@ jobs:
           **Steps:**
           1. Add \`GOEXPERIMENT=ms_nocgo_opensslcrypto\` to ALL scripts/Dockerfiles/Makefiles with \`CGO_ENABLED=0\` on Linux
           2. Add \`GOEXPERIMENT=systemcrypto\` to scripts/Dockerfiles with \`CGO_ENABLED=1\` (cilium-log-collector)
-          3. Remove \`MS_GO_NOSYSTEMCRYPTO=1\` from npm Dockerfiles and replace with \`GOEXPERIMENT=ms_nocgo_opensslcrypto\`
+          3. **Keep** \`MS_GO_NOSYSTEMCRYPTO=1\` in the npm build script and npm Dockerfiles — npm ships on an Ubuntu base without the Microsoft FIPS OpenSSL build, so it must stay on the standard Go crypto backend. Do **not** replace it with a GOEXPERIMENT
           4. npm Dockerfiles use **plain Go tags** (e.g., \`golang:1.26.4\`) — do NOT add \`-azurelinux3.0\` suffix
           5. npm/windows.Dockerfile builds on Linux (\`--platform=linux/amd64\`) — it STILL needs GOEXPERIMENT for CGO=0
           6. Ensure \`MARINER_DISTROLESS_IMG\` in \`build/images.mk\` is \`distroless/base\`
diff --git a/.pipelines/build/scripts/azure-ip-masq-merger.sh b/.pipelines/build/scripts/azure-ip-masq-merger.sh
index 325c187080a..8af86bd6f73 100644
--- a/.pipelines/build/scripts/azure-ip-masq-merger.sh
+++ b/.pipelines/build/scripts/azure-ip-masq-merger.sh
@@ -5,7 +5,6 @@ set -eux
 FILE_EXT=''
 
 export CGO_ENABLED=0
-export GOEXPERIMENT=ms_nocgo_opensslcrypto
 
 mkdir -p "$OUT_DIR"/bin
 mkdir -p "$OUT_DIR"/files
diff --git a/.pipelines/build/scripts/azure-ipam.sh b/.pipelines/build/scripts/azure-ipam.sh
index 674e9a207b9..5d29064d1a7 100644
--- a/.pipelines/build/scripts/azure-ipam.sh
+++ b/.pipelines/build/scripts/azure-ipam.sh
@@ -4,7 +4,6 @@ set -eux
 [[ $OS =~ windows ]] && FILE_EXT='.exe' || FILE_EXT=''
 
 export CGO_ENABLED=0
-export GOEXPERIMENT=ms_nocgo_opensslcrypto
 
 mkdir -p "$OUT_DIR"/bin
 mkdir -p "$OUT_DIR"/files
diff --git a/.pipelines/build/scripts/azure-iptables-monitor.sh b/.pipelines/build/scripts/azure-iptables-monitor.sh
index c2ddbf93095..b269f55ee2d 100644
--- a/.pipelines/build/scripts/azure-iptables-monitor.sh
+++ b/.pipelines/build/scripts/azure-iptables-monitor.sh
@@ -5,7 +5,6 @@ set -eux
 FILE_EXT=''
 
 export CGO_ENABLED=0
-export GOEXPERIMENT=ms_nocgo_opensslcrypto
 export C_INCLUDE_PATH=/usr/include/bpf
 
 mkdir -p "$OUT_DIR"/bin
diff --git a/.pipelines/build/scripts/cilium-log-collector.sh b/.pipelines/build/scripts/cilium-log-collector.sh
index d88053b1a53..0c0ec78106d 100644
--- a/.pipelines/build/scripts/cilium-log-collector.sh
+++ b/.pipelines/build/scripts/cilium-log-collector.sh
@@ -4,7 +4,6 @@ set -eux
 [[ $OS =~ windows ]] && { echo "cilium-log-collector is not supported on Windows"; exit 1; }
 # enable cgo for -buildmode=c-shared
 export CGO_ENABLED=1
-export GOEXPERIMENT=systemcrypto
 
 mkdir -p "$OUT_DIR"/bin
 mkdir -p "$OUT_DIR"/files
diff --git a/.pipelines/build/scripts/cni.sh b/.pipelines/build/scripts/cni.sh
index 05a5d71e0c6..d9a88ecdfc2 100644
--- a/.pipelines/build/scripts/cni.sh
+++ b/.pipelines/build/scripts/cni.sh
@@ -7,7 +7,6 @@ mkdir -p "$OUT_DIR"/files
 mkdir -p "$OUT_DIR"/bin
 
 export CGO_ENABLED=0
-export GOEXPERIMENT=ms_nocgo_opensslcrypto
 
 
 CNI_NET_DIR="$REPO_ROOT"/cni/network/plugin
diff --git a/.pipelines/build/scripts/cns.sh b/.pipelines/build/scripts/cns.sh
index 321e07fe809..fa8584c452d 100644
--- a/.pipelines/build/scripts/cns.sh
+++ b/.pipelines/build/scripts/cns.sh
@@ -4,7 +4,6 @@ set -eux
 [[ $OS =~ windows ]] && FILE_EXT='.exe' || FILE_EXT=''
 
 export CGO_ENABLED=0
-export GOEXPERIMENT=ms_nocgo_opensslcrypto
 
 mkdir -p "$OUT_DIR"/files
 mkdir -p "$OUT_DIR"/bin
diff --git a/.pipelines/build/scripts/dropgz.sh b/.pipelines/build/scripts/dropgz.sh
index e65f3421466..894db89d9b2 100644
--- a/.pipelines/build/scripts/dropgz.sh
+++ b/.pipelines/build/scripts/dropgz.sh
@@ -21,7 +21,6 @@ function files::remove_exe_extensions() {
 [[ $OS =~ windows ]] && FILE_EXT='.exe' || FILE_EXT=''
 
 export CGO_ENABLED=0
-export GOEXPERIMENT=ms_nocgo_opensslcrypto
 
 mkdir -p "$GEN_DIR"
 mkdir -p "$OUT_DIR"/bin
diff --git a/.pipelines/build/scripts/install-go.sh b/.pipelines/build/scripts/install-go.sh
index 82729f20d55..d1ed50d1989 100755
--- a/.pipelines/build/scripts/install-go.sh
+++ b/.pipelines/build/scripts/install-go.sh
@@ -11,9 +11,9 @@ set -eux
 #   3. Hardcoded fallback digest below
 #
 # To update the fallback, run:
-#   IMG=mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0
+#   IMG=mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0
 #   echo "${IMG}@$(skopeo inspect docker://${IMG} --format '{{.Digest}}')"
-DEFAULT_IMAGE="mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0@sha256:8f638b09830f92f4005c56756cbafdd56d6460f41d2c1fd12b9bc02a5c85434c"
+DEFAULT_IMAGE="mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0@sha256:b40d1e7ecd4acb36102444f787bd626a2b08287fc385bf48ec609053f29f4558"
 
 # Resolves the golang image from the source Dockerfile for the given $name.
 # Echoes the image reference, or empty string if it cannot be determined.
diff --git a/.pipelines/build/scripts/ipv6-hp-bpf.sh b/.pipelines/build/scripts/ipv6-hp-bpf.sh
index 055d35f5e8a..648540d7c40 100644
--- a/.pipelines/build/scripts/ipv6-hp-bpf.sh
+++ b/.pipelines/build/scripts/ipv6-hp-bpf.sh
@@ -38,7 +38,6 @@ function findcp::shared_library() {
 [[ $OS =~ windows ]] && FILE_EXT='.exe' || FILE_EXT=''
 
 export CGO_ENABLED=0
-export GOEXPERIMENT=ms_nocgo_opensslcrypto
 export C_INCLUDE_PATH=/usr/include/bpf
 
 mkdir -p "$OUT_DIR"/bin
diff --git a/.pipelines/build/scripts/npm.sh b/.pipelines/build/scripts/npm.sh
index a48d3751ef9..4d36a4985d6 100644
--- a/.pipelines/build/scripts/npm.sh
+++ b/.pipelines/build/scripts/npm.sh
@@ -3,14 +3,12 @@ set -eux
 
 [[ $OS =~ windows ]] && FILE_EXT='.exe' || FILE_EXT=''
 
-export CGO_ENABLED=0
-# npm ships on the Ubuntu base image (it needs iptables/ipset at runtime), which
-# does not provide Microsoft's FIPS-capable OpenSSL. GOEXPERIMENT=ms_nocgo_openssl
-# crypto would make the binary require that OpenSSL and crash-loop on FIPS-enabled
-# clusters, so use the standard Go crypto backend (matches npm/*.Dockerfile and
-# the shipped release/v1.6 image). Components on the AzureLinux distroless base
-# use ms_nocgo_opensslcrypto instead.
+# npm ships on an Ubuntu base that does not carry the Microsoft FIPS OpenSSL
+# build, so use the standard Go crypto backend (matches npm/*.Dockerfile).
+# Components on the AzureLinux distroless base use the default system crypto
+# backend instead.
 export MS_GO_NOSYSTEMCRYPTO=1
+export CGO_ENABLED=0
 
 mkdir -p "$OUT_DIR"/files
 mkdir -p "$OUT_DIR"/bin
diff --git a/.pipelines/cni/cilium/nightly-release-test.yml b/.pipelines/cni/cilium/nightly-release-test.yml
index 34f18996f5e..daa5db1ddaf 100644
--- a/.pipelines/cni/cilium/nightly-release-test.yml
+++ b/.pipelines/cni/cilium/nightly-release-test.yml
@@ -64,15 +64,6 @@ stages:
                 ALPINE_ARGS="--build-arg ALPINE_IMAGE=${alpineACR} "
               fi
 
-              if [ "$(type)" = "docker-operator-generic-image" ]; then
-                # Apply patch to Dockerfile
-                DOCKERFILE_PATH="./images/$(directory)/Dockerfile"
-                echo "Patching Dockerfile: $DOCKERFILE_PATH"
-
-                # Add ARG and ENV statements to disable systemcrypto for Microsoft Go
-                sed -i '/^FROM.*builder/a ARG GOEXPERIMENT=boringcrypto \nENV GOEXPERIMENT=${GOEXPERIMENT}' "$DOCKERFILE_PATH"
-              fi
-
               BUILD_ARGS=${GO_ARGS}${ALPINE_ARGS}
               DOCKER_FLAGS="$BUILD_ARGS" \
               make $(type)
diff --git a/azure-ip-masq-merger/Dockerfile b/azure-ip-masq-merger/Dockerfile
index fbd7ceb2785..77dd3e011bf 100644
--- a/azure-ip-masq-merger/Dockerfile
+++ b/azure-ip-masq-merger/Dockerfile
@@ -3,8 +3,8 @@
 ARG ARCH
 ARG OS
 
-# mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0
-FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0@sha256:3c78e9858004d1c43aea08829306c76c3bf870c26b98c8c07ea6ca74c54787cf AS go
+# mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0
+FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0@sha256:b40d1e7ecd4acb36102444f787bd626a2b08287fc385bf48ec609053f29f4558 AS go
 
 # mcr.microsoft.com/azurelinux/distroless/base:3.0
 FROM --platform=linux/${ARCH} mcr.microsoft.com/azurelinux/distroless/base:3.0@sha256:4377af4aa7a810b7d59f691eae5066895a71aa3eee4cfb4eba527bbebff16479 AS mariner-distroless
@@ -12,7 +12,6 @@ FROM --platform=linux/${ARCH} mcr.microsoft.com/azurelinux/distroless/base:3.0@s
 FROM go AS azure-ip-masq-merger
 ARG OS
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-ip-masq-merger
 COPY ./azure-ip-masq-merger .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/ip-masq-merger -trimpath -ldflags "-s -w -X main.version="$VERSION"" -gcflags="-dwarflocationlists=true" .
diff --git a/azure-ip-masq-merger/Dockerfile.tmpl b/azure-ip-masq-merger/Dockerfile.tmpl
index e6b25a44839..66ad79145b2 100644
--- a/azure-ip-masq-merger/Dockerfile.tmpl
+++ b/azure-ip-masq-merger/Dockerfile.tmpl
@@ -12,7 +12,6 @@ FROM --platform=linux/${ARCH} {{.MARINER_DISTROLESS_PIN}} AS mariner-distroless
 FROM go AS azure-ip-masq-merger
 ARG OS
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-ip-masq-merger
 COPY ./azure-ip-masq-merger .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/ip-masq-merger -trimpath -ldflags "-s -w -X main.version="$VERSION"" -gcflags="-dwarflocationlists=true" .
diff --git a/azure-ip-masq-merger/go.mod b/azure-ip-masq-merger/go.mod
index f988e1f4a33..13b594296ba 100644
--- a/azure-ip-masq-merger/go.mod
+++ b/azure-ip-masq-merger/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/azure-container-networking/azure-ip-masq-merger
 
 go 1.26.0
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require (
 	github.com/stretchr/testify v1.12.1
diff --git a/azure-ipam/Dockerfile b/azure-ipam/Dockerfile
index 6c3ec643602..dd610e5baf1 100644
--- a/azure-ipam/Dockerfile
+++ b/azure-ipam/Dockerfile
@@ -5,8 +5,8 @@ ARG DROPGZ_VERSION=v0.0.12
 ARG OS_VERSION
 ARG OS
 
-# mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0
-FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0@sha256:3c78e9858004d1c43aea08829306c76c3bf870c26b98c8c07ea6ca74c54787cf AS go
+# mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0
+FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0@sha256:b40d1e7ecd4acb36102444f787bd626a2b08287fc385bf48ec609053f29f4558 AS go
 
 # mcr.microsoft.com/azurelinux/base/core:3.0
 FROM --platform=linux/${ARCH} mcr.microsoft.com/azurelinux/base/core:3.0@sha256:34a22db497ff34a0f35ca5fc54bd38711d04238a2c1b2f65d35dc9d45dd82584 AS mariner-core
@@ -17,7 +17,6 @@ FROM --platform=linux/${ARCH} mcr.microsoft.com/azurelinux/distroless/base:3.0@s
 FROM go AS azure-ipam
 ARG OS
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-ipam
 COPY ./azure-ipam .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/azure-ipam -trimpath -ldflags "-s -w -X main.version="$VERSION" -X github.com/Azure/azure-container-networking/azure-ipam/internal/buildinfo.Version="$VERSION"" -gcflags="-dwarflocationlists=true" .
@@ -34,7 +33,6 @@ FROM go AS dropgz
 ARG DROPGZ_VERSION
 ARG OS
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 RUN go mod download github.com/azure/azure-container-networking/dropgz@$DROPGZ_VERSION
 WORKDIR /go/pkg/mod/github.com/azure/azure-container-networking/dropgz\@$DROPGZ_VERSION
 COPY --from=compressor /payload/* pkg/embed/fs/
diff --git a/azure-ipam/Dockerfile.tmpl b/azure-ipam/Dockerfile.tmpl
index 0100468fe86..a732ff2fa22 100644
--- a/azure-ipam/Dockerfile.tmpl
+++ b/azure-ipam/Dockerfile.tmpl
@@ -17,7 +17,6 @@ FROM --platform=linux/${ARCH} {{.MARINER_DISTROLESS_PIN}} AS mariner-distroless
 FROM go AS azure-ipam
 ARG OS
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-ipam
 COPY ./azure-ipam .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/azure-ipam -trimpath -ldflags "-s -w -X main.version="$VERSION" -X github.com/Azure/azure-container-networking/azure-ipam/internal/buildinfo.Version="$VERSION"" -gcflags="-dwarflocationlists=true" .
@@ -34,7 +33,6 @@ FROM go AS dropgz
 ARG DROPGZ_VERSION
 ARG OS
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 RUN go mod download github.com/azure/azure-container-networking/dropgz@$DROPGZ_VERSION
 WORKDIR /go/pkg/mod/github.com/azure/azure-container-networking/dropgz\@$DROPGZ_VERSION
 COPY --from=compressor /payload/* pkg/embed/fs/
diff --git a/azure-ipam/go.mod b/azure-ipam/go.mod
index b232f91f4e1..5d13cfc40ab 100644
--- a/azure-ipam/go.mod
+++ b/azure-ipam/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/azure-container-networking/azure-ipam
 
 go 1.26.1
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require (
 	github.com/Azure/azure-container-networking v1.8.12
diff --git a/azure-iptables-monitor/Dockerfile b/azure-iptables-monitor/Dockerfile
index 38150abd727..a153f988dcd 100644
--- a/azure-iptables-monitor/Dockerfile
+++ b/azure-iptables-monitor/Dockerfile
@@ -8,14 +8,13 @@ FROM mcr.microsoft.com/azurelinux/base/core:3.0@sha256:34a22db497ff34a0f35ca5fc5
 # mcr.microsoft.com/azurelinux/distroless/base:3.0
 FROM mcr.microsoft.com/azurelinux/distroless/base:3.0@sha256:4377af4aa7a810b7d59f691eae5066895a71aa3eee4cfb4eba527bbebff16479 AS mariner-distroless
 
-# mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0
-FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0@sha256:3c78e9858004d1c43aea08829306c76c3bf870c26b98c8c07ea6ca74c54787cf AS go
+# mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0
+FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0@sha256:b40d1e7ecd4acb36102444f787bd626a2b08287fc385bf48ec609053f29f4558 AS go
 
 
 FROM go AS azure-iptables-monitor
 ARG OS
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-iptables-monitor
 COPY ./azure-iptables-monitor .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/iptables-monitor -trimpath -ldflags "-s -w -X main.version="$VERSION"" -gcflags="-dwarflocationlists=true" .
@@ -31,7 +30,6 @@ COPY ./go.mod ./go.sum ./
 RUN tdnf install -y llvm clang libbpf-devel gcc binutils glibc
 # Set up C include path for BPF
 ENV C_INCLUDE_PATH=/usr/include/bpf
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 # Set up architecture-specific symlinks for cross-compilation support
 RUN if [ "$ARCH" = "amd64" ]; then \
         ARCH_DIR=x86_64-linux-gnu; \
diff --git a/azure-iptables-monitor/Dockerfile.tmpl b/azure-iptables-monitor/Dockerfile.tmpl
index 45b35afe5b3..4215441bb35 100644
--- a/azure-iptables-monitor/Dockerfile.tmpl
+++ b/azure-iptables-monitor/Dockerfile.tmpl
@@ -15,7 +15,6 @@ FROM --platform=linux/${ARCH} {{.GO_PIN}} AS go
 FROM go AS azure-iptables-monitor
 ARG OS
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-iptables-monitor
 COPY ./azure-iptables-monitor .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/iptables-monitor -trimpath -ldflags "-s -w -X main.version="$VERSION"" -gcflags="-dwarflocationlists=true" .
@@ -31,7 +30,6 @@ COPY ./go.mod ./go.sum ./
 RUN tdnf install -y llvm clang libbpf-devel gcc binutils glibc
 # Set up C include path for BPF
 ENV C_INCLUDE_PATH=/usr/include/bpf
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 # Set up architecture-specific symlinks for cross-compilation support
 RUN if [ "$ARCH" = "amd64" ]; then \
         ARCH_DIR=x86_64-linux-gnu; \
diff --git a/azure-iptables-monitor/go.mod b/azure-iptables-monitor/go.mod
index 8e2a6a4c666..6440ce80c27 100644
--- a/azure-iptables-monitor/go.mod
+++ b/azure-iptables-monitor/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/azure-container-networking/azure-iptables-monitor
 
 go 1.26.0
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require (
 	github.com/coreos/go-iptables v0.8.0
diff --git a/bpf-prog/ipv6-hp-bpf/go.mod b/bpf-prog/ipv6-hp-bpf/go.mod
index f13a763afd6..0aef7f1cf0b 100644
--- a/bpf-prog/ipv6-hp-bpf/go.mod
+++ b/bpf-prog/ipv6-hp-bpf/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/azure-container-networking/bpf-prog/ipv6-hp-bpf
 
 go 1.25.0
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require (
 	github.com/cilium/ebpf v0.22.0
diff --git a/bpf-prog/ipv6-hp-bpf/linux.Dockerfile b/bpf-prog/ipv6-hp-bpf/linux.Dockerfile
index d61357d9ab7..635862308fb 100644
--- a/bpf-prog/ipv6-hp-bpf/linux.Dockerfile
+++ b/bpf-prog/ipv6-hp-bpf/linux.Dockerfile
@@ -1,7 +1,7 @@
 ARG ARCH
-# IMG=mcr.microsoft.com/oss/go/microsoft/golang:1.26.7
+# IMG=mcr.microsoft.com/oss/go/microsoft/golang:1.27.1
 # echo "${IMG}@$(skopeo inspect docker://${IMG} --format '{{.Digest}}')"
-FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.26.7@sha256:be14ce4ce048adf5584ce3a0919d21987284e2235b6e7e9bb0e6a01133870be9 AS go
+FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.27.1@sha256:edd9a9ae78ad898771bc506ae596e67b6db7f4f055616982805ebd75764d3f77 AS go
 ARG VERSION
 ARG DEBUG
 ARG OS
@@ -36,7 +36,6 @@ RUN if [ "$ARCH" = "arm64" ]; then \
     cp /lib/"$ARCH"/libbsd.so.0 /tmp/lib/ && \
     cp /lib/"$ARCH"/libmd.so.0 /tmp/lib/
 ENV C_INCLUDE_PATH=/usr/include/bpf
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 RUN if [ "$DEBUG" = "true" ]; then echo "\n#define DEBUG" >> /bpf-prog/ipv6-hp-bpf/include/helper.h; fi
 RUN GOOS=$OS CGO_ENABLED=0 go generate ./...
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/ipv6-hp-bpf -trimpath -ldflags "-s -w -X main.version="$VERSION"" -gcflags="-dwarflocationlists=true" .
diff --git a/build/images.mk b/build/images.mk
index 22cdfc0d441..4cb6ad4b536 100644
--- a/build/images.mk
+++ b/build/images.mk
@@ -1,7 +1,7 @@
 # Source images
 GOPATH						?= $(shell go env GOPATH)
 
-export GO_IMG					?= mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0
+export GO_IMG					?= mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0
 export MARINER_CORE_IMG			?= mcr.microsoft.com/azurelinux/base/core:3.0
 export MARINER_DISTROLESS_IMG	?= mcr.microsoft.com/azurelinux/distroless/base:3.0
 export WIN_HPC_IMG				?= mcr.microsoft.com/oss/kubernetes/windows-host-process-containers-base-image:v1.0.0
diff --git a/cilium-log-collector/Dockerfile b/cilium-log-collector/Dockerfile
index fa4eeca02f9..33a71031a78 100644
--- a/cilium-log-collector/Dockerfile
+++ b/cilium-log-collector/Dockerfile
@@ -3,12 +3,11 @@
 ARG ARCH
 ARG OS
 
-# mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0
-FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0@sha256:3c78e9858004d1c43aea08829306c76c3bf870c26b98c8c07ea6ca74c54787cf AS go
+# mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0
+FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0@sha256:b40d1e7ecd4acb36102444f787bd626a2b08287fc385bf48ec609053f29f4558 AS go
 
 FROM go AS fluent-bit-plugin
 ARG VERSION
-ENV GOEXPERIMENT=systemcrypto
 WORKDIR /cilium-log-collector
 COPY ./cilium-log-collector .
 RUN go build -buildmode=c-shared -a -o out_azure_app_insights.so -trimpath -ldflags "-X main.version=$VERSION" -gcflags="-dwarflocationlists=true" .
diff --git a/cilium-log-collector/Dockerfile.tmpl b/cilium-log-collector/Dockerfile.tmpl
index 1e5f432926e..0f73100b8a8 100644
--- a/cilium-log-collector/Dockerfile.tmpl
+++ b/cilium-log-collector/Dockerfile.tmpl
@@ -8,7 +8,6 @@ FROM --platform=linux/${ARCH} {{.GO_PIN}} AS go
 
 FROM go AS fluent-bit-plugin
 ARG VERSION
-ENV GOEXPERIMENT=systemcrypto
 WORKDIR /cilium-log-collector
 COPY ./cilium-log-collector .
 RUN go build -buildmode=c-shared -a -o out_azure_app_insights.so -trimpath -ldflags "-X main.version=$VERSION" -gcflags="-dwarflocationlists=true" .
diff --git a/cilium-log-collector/Makefile b/cilium-log-collector/Makefile
index 5d6eae78299..62180cc2f8a 100755
--- a/cilium-log-collector/Makefile
+++ b/cilium-log-collector/Makefile
@@ -14,7 +14,7 @@ cilium-log-collector-version: ## prints the cilium-log-collector version
 # Build the cilium-log-collector plugin "so" file
 cilium-log-collector-binary:
 	$(MKDIR) $(CILIUM_LOG_COLLECTOR_BUILD_DIR)
-	cd $(CILIUM_LOG_COLLECTOR_DIR) && CGO_ENABLED=1 GOEXPERIMENT=systemcrypto go build -buildmode=c-shared -a -o $(CILIUM_LOG_COLLECTOR_BUILD_DIR)/out_azure_app_insights.so -trimpath -ldflags "-X main.version=$(CILIUM_LOG_COLLECTOR_VERSION)" -gcflags="-dwarflocationlists=true" .
+	cd $(CILIUM_LOG_COLLECTOR_DIR) && CGO_ENABLED=1 go build -buildmode=c-shared -a -o $(CILIUM_LOG_COLLECTOR_BUILD_DIR)/out_azure_app_insights.so -trimpath -ldflags "-X main.version=$(CILIUM_LOG_COLLECTOR_VERSION)" -gcflags="-dwarflocationlists=true" .
 
 
 CILIUM_LOG_COLLECTOR_IMAGE = cilium-log-collector
diff --git a/cilium-log-collector/go.mod b/cilium-log-collector/go.mod
index 87cd77cf629..6ae77020cfb 100644
--- a/cilium-log-collector/go.mod
+++ b/cilium-log-collector/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/azure-container-networking/cilium-log-collector
 
 go 1.26.1
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require (
 	github.com/Azure/azure-container-networking v1.8.12
diff --git a/cni/Dockerfile b/cni/Dockerfile
index a6f8549115f..281858861cb 100644
--- a/cni/Dockerfile
+++ b/cni/Dockerfile
@@ -5,8 +5,8 @@ ARG DROPGZ_VERSION=v0.0.12
 ARG OS_VERSION
 ARG OS
 
-# mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0
-FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0@sha256:3c78e9858004d1c43aea08829306c76c3bf870c26b98c8c07ea6ca74c54787cf AS go
+# mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0
+FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0@sha256:b40d1e7ecd4acb36102444f787bd626a2b08287fc385bf48ec609053f29f4558 AS go
 
 # mcr.microsoft.com/azurelinux/base/core:3.0
 FROM --platform=linux/${ARCH} mcr.microsoft.com/azurelinux/base/core:3.0@sha256:34a22db497ff34a0f35ca5fc54bd38711d04238a2c1b2f65d35dc9d45dd82584 AS mariner-core
@@ -19,7 +19,6 @@ ARG OS
 ARG VERSION
 ARG CNI_AI_PATH
 ARG CNI_AI_ID
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-container-networking
 COPY . .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/azure-vnet -trimpath -ldflags "-s -w -X main.version="$VERSION"" -gcflags="-dwarflocationlists=true" cni/network/plugin/main.go
@@ -52,7 +51,6 @@ FROM go AS dropgz
 ARG DROPGZ_VERSION
 ARG OS
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 RUN go mod download github.com/azure/azure-container-networking/dropgz@$DROPGZ_VERSION
 WORKDIR /go/pkg/mod/github.com/azure/azure-container-networking/dropgz\@$DROPGZ_VERSION
 COPY --from=compressor /payload/* pkg/embed/fs/
diff --git a/cni/Dockerfile.tmpl b/cni/Dockerfile.tmpl
index 65a3f2da89a..ca967715fdf 100644
--- a/cni/Dockerfile.tmpl
+++ b/cni/Dockerfile.tmpl
@@ -19,7 +19,6 @@ ARG OS
 ARG VERSION
 ARG CNI_AI_PATH
 ARG CNI_AI_ID
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-container-networking
 COPY . .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/azure-vnet -trimpath -ldflags "-s -w -X main.version="$VERSION"" -gcflags="-dwarflocationlists=true" cni/network/plugin/main.go
@@ -52,7 +51,6 @@ FROM go AS dropgz
 ARG DROPGZ_VERSION
 ARG OS
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 RUN go mod download github.com/azure/azure-container-networking/dropgz@$DROPGZ_VERSION
 WORKDIR /go/pkg/mod/github.com/azure/azure-container-networking/dropgz\@$DROPGZ_VERSION
 COPY --from=compressor /payload/* pkg/embed/fs/
diff --git a/cns/Dockerfile b/cns/Dockerfile
index 56cad017db2..298abac2551 100644
--- a/cns/Dockerfile
+++ b/cns/Dockerfile
@@ -4,8 +4,8 @@ ARG ARCH
 ARG OS_VERSION
 ARG OS
 
-# mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0
-FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0@sha256:3c78e9858004d1c43aea08829306c76c3bf870c26b98c8c07ea6ca74c54787cf AS go
+# mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0
+FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0@sha256:b40d1e7ecd4acb36102444f787bd626a2b08287fc385bf48ec609053f29f4558 AS go
 
 # mcr.microsoft.com/azurelinux/base/core:3.0
 FROM mcr.microsoft.com/azurelinux/base/core:3.0@sha256:34a22db497ff34a0f35ca5fc54bd38711d04238a2c1b2f65d35dc9d45dd82584 AS mariner-core
@@ -18,7 +18,6 @@ ARG OS
 ARG CNS_AI_ID
 ARG CNS_AI_PATH
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-container-networking
 COPY . .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/azure-cns -ldflags "-s -w -X main.version="$VERSION" -X "$CNS_AI_PATH"="$CNS_AI_ID"" -gcflags="-dwarflocationlists=true" cns/service/*.go
diff --git a/cns/Dockerfile.tmpl b/cns/Dockerfile.tmpl
index 591418b8ef5..06a414c276d 100644
--- a/cns/Dockerfile.tmpl
+++ b/cns/Dockerfile.tmpl
@@ -18,7 +18,6 @@ ARG OS
 ARG CNS_AI_ID
 ARG CNS_AI_PATH
 ARG VERSION
-ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-container-networking
 COPY . .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/azure-cns -ldflags "-s -w -X main.version="$VERSION" -X "$CNS_AI_PATH"="$CNS_AI_ID"" -gcflags="-dwarflocationlists=true" cns/service/*.go
diff --git a/cns/deviceplugin/server.go b/cns/deviceplugin/server.go
index fe22607fa23..65da82767f5 100644
--- a/cns/deviceplugin/server.go
+++ b/cns/deviceplugin/server.go
@@ -97,7 +97,7 @@ func (s *Server) Ready(ctx context.Context) error {
 // of the steps to make the Device available in the container
 // We are not using this functionality currently
 func (s *Server) Allocate(_ context.Context, req *v1beta1.AllocateRequest) (*v1beta1.AllocateResponse, error) {
-	s.logger.Info("allocate request", zap.Any("req", *req))
+	s.logger.Info("allocate request", zap.Any("req", req))
 	crs := req.GetContainerRequests()
 	resps := make([]*v1beta1.ContainerAllocateResponse, len(crs))
 	for i, containerReq := range crs {
diff --git a/cns/restserver/util_test.go b/cns/restserver/util_test.go
index a1aea670ce1..ba986e7cdef 100644
--- a/cns/restserver/util_test.go
+++ b/cns/restserver/util_test.go
@@ -16,44 +16,50 @@ import (
 func TestAreNCsPresent(t *testing.T) {
 	present := ncList("present")
 	tests := []struct {
-		name    string
-		service HTTPRestService
-		want    bool
+		name       string
+		newService func() HTTPRestService
+		want       bool
 	}{
 		{
 			name: "container status present",
-			service: HTTPRestService{
-				state: &httpRestServiceState{
-					ContainerStatus: map[string]containerstatus{
-						"nc1": {},
+			newService: func() HTTPRestService {
+				return HTTPRestService{
+					state: &httpRestServiceState{
+						ContainerStatus: map[string]containerstatus{
+							"nc1": {},
+						},
 					},
-				},
+				}
 			},
 			want: true,
 		},
 		{
 			name: "containerIDByOrchestorContext present",
-			service: HTTPRestService{
-				state: &httpRestServiceState{
-					ContainerIDByOrchestratorContext: map[string]*ncList{
-						"nc1": &present,
+			newService: func() HTTPRestService {
+				return HTTPRestService{
+					state: &httpRestServiceState{
+						ContainerIDByOrchestratorContext: map[string]*ncList{
+							"nc1": &present,
+						},
 					},
-				},
+				}
 			},
 			want: true,
 		},
 		{
 			name: "neither containerStatus nor containerIDByOrchestratorContext present",
-			service: HTTPRestService{
-				state: &httpRestServiceState{},
+			newService: func() HTTPRestService {
+				return HTTPRestService{
+					state: &httpRestServiceState{},
+				}
 			},
 			want: false,
 		},
 	}
-	for _, tt := range tests { //nolint:govet // this mutex copy is to keep a local reference to this variable in the test func closure, and is ok
-		tt := tt //nolint:govet // this mutex copy is to keep a local reference to this variable in the test func closure, and is ok
+	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got := tt.service.areNCsPresent()
+			service := tt.newService()
+			got := service.areNCsPresent()
 			assert.Equal(t, got, tt.want)
 		})
 	}
diff --git a/dropgz/go.mod b/dropgz/go.mod
index 8137918a3c2..37cf1534bff 100644
--- a/dropgz/go.mod
+++ b/dropgz/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/azure-container-networking/dropgz
 
 go 1.25.0
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require (
 	github.com/jsternberg/zap-logfmt v1.3.0
diff --git a/go.mod b/go.mod
index fabfc860f3d..ea9cd19ec61 100644
--- a/go.mod
+++ b/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/azure-container-networking
 
 go 1.26.0
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require (
 	github.com/Azure/azure-container-networking/zapai v0.0.3
diff --git a/npm/linux.Dockerfile b/npm/linux.Dockerfile
index 85229cb47d2..0bff831203b 100644
--- a/npm/linux.Dockerfile
+++ b/npm/linux.Dockerfile
@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.26.7 AS builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.27.1 AS builder
 ARG VERSION
 ARG NPM_AI_PATH
 ARG NPM_AI_ID
diff --git a/npm/windows.Dockerfile b/npm/windows.Dockerfile
index 46c6a6422a8..6e5c2b039b9 100644
--- a/npm/windows.Dockerfile
+++ b/npm/windows.Dockerfile
@@ -1,5 +1,5 @@
 ARG OS_VERSION
-FROM --platform=linux/amd64 mcr.microsoft.com/oss/go/microsoft/golang:1.26.7 AS builder
+FROM --platform=linux/amd64 mcr.microsoft.com/oss/go/microsoft/golang:1.27.1 AS builder
 ARG VERSION
 ARG NPM_AI_PATH
 ARG NPM_AI_ID
diff --git a/pkgerrlint/go.mod b/pkgerrlint/go.mod
index 6eda1b58a03..91192209acb 100644
--- a/pkgerrlint/go.mod
+++ b/pkgerrlint/go.mod
@@ -2,6 +2,6 @@ module github.com/Azure/azure-container-networking/pkgerrlint
 
 go 1.25.0
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require github.com/pkg/errors v0.9.1
diff --git a/tools.go.mod b/tools.go.mod
index 6cbcfa0b6d4..eada43e2138 100644
--- a/tools.go.mod
+++ b/tools.go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/azure-container-networking
 
 go 1.25.0
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 // To use/update leverage -modfile=tools.go.mod field in respective go commands
 tool (
diff --git a/tools/azure-npm-to-cilium-validator/go.mod b/tools/azure-npm-to-cilium-validator/go.mod
index efdd9201898..2d584960fb7 100644
--- a/tools/azure-npm-to-cilium-validator/go.mod
+++ b/tools/azure-npm-to-cilium-validator/go.mod
@@ -2,7 +2,7 @@ module azure-npm-to-cilium-validator
 
 go 1.26.1
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require (
 	github.com/Azure/azure-container-networking v1.8.12
diff --git a/tools/failure-agent/go.mod b/tools/failure-agent/go.mod
index b1e2cc1756f..cbfdcbdeba6 100644
--- a/tools/failure-agent/go.mod
+++ b/tools/failure-agent/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/azure-container-networking/tools/failure-agent
 
 go 1.25.0
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require (
 	github.com/google/uuid v1.6.0
diff --git a/tools/release/go.mod b/tools/release/go.mod
index efacde0772d..820d1fecc37 100644
--- a/tools/release/go.mod
+++ b/tools/release/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/azure-container-networking/tools/release
 
 go 1.25.0
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require github.com/spf13/cobra v1.10.2
 
diff --git a/zapai/go.mod b/zapai/go.mod
index 77a8101103f..f90f4826584 100644
--- a/zapai/go.mod
+++ b/zapai/go.mod
@@ -2,7 +2,7 @@ module github.com/Azure/azure-container-networking/zapai
 
 go 1.25.0
 
-toolchain go1.26.7
+toolchain go1.27.1
 
 require (
 	github.com/jsternberg/zap-logfmt v1.3.0