diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index c172c94..b3b1a4c 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,6 +1,6 @@
 {
   "name": "MKurator DevContainer",
-  "image": "golang:1.26.9-bookworm",
+  "image": "golang:1.26.10-bookworm",
   "features": {
     "ghcr.io/devcontainers/features/docker-in-docker:3": {
       "moby": true,
diff --git a/Dockerfile b/Dockerfile
index 226b75a..e452fd4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,6 @@
 # Build the manager binary
-FROM golang:1.26.9@sha256:d7722066f0b60ceccb6c0643cbed1f5f9e15506ac237146c95333504d7805d89 AS builder
+# golang 1.26.10 (digest-only pin: Sonar docker:S8431 rejects tag plus digest)
+FROM golang@sha256:670bb5aa5349ae03b8516764718486f4f16399134bdc9acd0c46a23f043ab05c AS builder
 ARG TARGETOS
 ARG TARGETARCH
 
@@ -23,7 +24,8 @@ RUN CGO_ENABLED=0 GOOS="${TARGETOS:-linux}" GOARCH="${TARGETARCH}" go build -a -
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/static:nonroot@sha256:f7f8f729987ad0fdf6b05eeeae94b26e6a0f613bdf46feea7fc40f7bd72953e6
+# distroless static, nonroot variant (digest-only pin, see above)
+FROM gcr.io/distroless/static@sha256:f7f8f729987ad0fdf6b05eeeae94b26e6a0f613bdf46feea7fc40f7bd72953e6
 WORKDIR /
 COPY --from=builder /workspace/manager .
 USER 65532:65532
diff --git a/docs/LOCAL_SETUP.md b/docs/LOCAL_SETUP.md
index f5de596..e7bf72b 100644
--- a/docs/LOCAL_SETUP.md
+++ b/docs/LOCAL_SETUP.md
@@ -36,7 +36,7 @@ separately — they ship via `go.mod` `tool` directives (see below).
 
 | Tool | Pinned version (CI) | Where defined |
 |------|---------------------|---------------|
-| Go | **1.26.9** | `go.mod` (Taskfile derives `GOTOOLCHAIN` from it) |
+| Go | **1.26.10** | `go.mod` (Taskfile derives `GOTOOLCHAIN` from it) |
 | Task | **3.51.1** | `Taskfile.yml` (`TASK_VERSION`) + CI `arduino/setup-task` |
 | kind | **v0.32.0** | `Taskfile.yml` (`KIND_VERSION`) |
 | mkcert | **v1.4.4** | `Taskfile.yml` (`MKCERT_VERSION`) |
@@ -49,7 +49,7 @@ release. Terraform must be **≥ 1.5.0** (`hack/kind-cluster/terraform/versions.
 
 ## Go toolchain (pinned in go.mod)
 
-Install Go **1.26.9** (or enable auto-download — `task` sets `GOTOOLCHAIN` from `go.mod`).
+Install Go **1.26.10** (or enable auto-download — `task` sets `GOTOOLCHAIN` from `go.mod`).
 
 These tools are **already pinned** in `go.mod` and invoked with `go tool …` —
 no separate install step:
@@ -146,7 +146,7 @@ mkcert -install   # trust local CA (may prompt for password)
 ```sh
 # Go — use https://go.dev/dl/ or your distro if it ships 1.26+
 # Example (adjust arch/version):
-# curl -fsSL https://go.dev/dl/go1.26.9.linux-amd64.tar.gz | sudo tar -C /usr/local -xz
+# curl -fsSL https://go.dev/dl/go1.26.10.linux-amd64.tar.gz | sudo tar -C /usr/local -xz
 
 # Tier A — Task
 sh -c "$(curl --location https://taskfile.dev/install.sh)" -- -d -b ~/.local/bin v3.51.1
@@ -204,7 +204,7 @@ Run from the repository root after installing your tier:
 
 ```sh
 TOOLS_TIER=A task tools:check
-go version          # go1.26.9
+go version          # go1.26.10
 task --version      # 3.x (3.51.1 matches CI)
 task install
 task lint
diff --git a/go.mod b/go.mod
index 7b82730..5bc0eaf 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/platformrelay/mkurator
 
-go 1.26.9
+go 1.26.10
 
 require (
 	github.com/go-logr/logr v1.4.4
diff --git a/hack/test/sonar_mk_11_dockerfile_digest_test.sh b/hack/test/sonar_mk_11_dockerfile_digest_test.sh
index 58cdfec..bc6508f 100755
--- a/hack/test/sonar_mk_11_dockerfile_digest_test.sh
+++ b/hack/test/sonar_mk_11_dockerfile_digest_test.sh
@@ -16,8 +16,8 @@ require_digest() {
   fi
 }
 
-require_digest "${ROOT}/Dockerfile" "golang:"
-require_digest "${ROOT}/Dockerfile" "gcr.io/distroless/static:"
+require_digest "${ROOT}/Dockerfile" "golang"
+require_digest "${ROOT}/Dockerfile" "gcr.io/distroless/static"
 require_digest "${ROOT}/test/e2e/fixtures/metrics-curl/Dockerfile" "alpine:"
 
 # ARG expansion must be quoted so a malicious/empty TARGETOS cannot word-split.