diff --git a/.github/workflows/boulder-ci.yml b/.github/workflows/boulder-ci.yml
index 9239d3152b7..cbc8276c7b0 100644
--- a/.github/workflows/boulder-ci.yml
+++ b/.github/workflows/boulder-ci.yml
@@ -36,7 +36,7 @@ jobs:
       matrix:
         # Add additional docker image tags here and all tests will be run with the additional image.
         BOULDER_TOOLS_TAG:
-          - go1.27.2_2026-10-14
+          - go1.27.3_2026-10-19
         # Tests command definitions. Use the entire "docker compose" command you want to run.
         tests:
           # Run ./test.sh --help for a description of each of the flags.
@@ -143,7 +143,7 @@ jobs:
       # When set to true, GitHub cancels all in-progress jobs if any matrix job fails. Default: true
       fail-fast: false
       matrix:
-        go-version: [ '1.27.2' ]
+        go-version: [ '1.27.3' ]
 
     steps:
       # Checks out your repository under $GITHUB_WORKSPACE, so your job can access it
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 924c884ac7e..370ed65c660 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,7 +35,7 @@ jobs:
       fail-fast: false
       matrix:
         GO_VERSION:
-          - "1.27.2"
+          - "1.27.3"
     runs-on: ubuntu-24.04
     permissions:
       contents: write
diff --git a/.github/workflows/try-release.yml b/.github/workflows/try-release.yml
index 7ca32b491dd..9e0fa8c0ed7 100644
--- a/.github/workflows/try-release.yml
+++ b/.github/workflows/try-release.yml
@@ -20,7 +20,7 @@ jobs:
       fail-fast: false
       matrix:
         GO_VERSION:
-          - "1.27.2"
+          - "1.27.3"
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
diff --git a/docker-compose.yml b/docker-compose.yml
index 0e7ec58180d..848931fddd2 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -8,7 +8,7 @@ services:
       context: test/boulder-tools/
       # Should match one of the GO_CI_VERSIONS in test/boulder-tools/tag_and_upload.sh.
       args:
-        GO_VERSION: 1.27.2
+        GO_VERSION: 1.27.3
     environment:
       # To solve HTTP-01 and TLS-ALPN-01 challenges, change the IP in FAKE_DNS
       # to the IP address where your ACME client's solver is listening. This is
diff --git a/test/boulder-tools/tag_and_upload.sh b/test/boulder-tools/tag_and_upload.sh
index 6db7e4bb022..cfda7400239 100755
--- a/test/boulder-tools/tag_and_upload.sh
+++ b/test/boulder-tools/tag_and_upload.sh
@@ -12,7 +12,7 @@ DOCKER_REPO="letsencrypt/boulder-tools"
 # .github/workflows/release.yml,
 # .github/workflows/try-release.yml if appropriate,
 # and .github/workflows/boulder-ci.yml with the new container tag.
-GO_CI_VERSIONS=( "1.27.2" )
+GO_CI_VERSIONS=( "1.27.3" )
 
 echo "Please login to allow push to DockerHub"
 docker login
diff --git a/test/sunlight/Dockerfile b/test/sunlight/Dockerfile
index 9b981c66f76..062e26b8b82 100644
--- a/test/sunlight/Dockerfile
+++ b/test/sunlight/Dockerfile
@@ -1,6 +1,6 @@
 ARG SUNLIGHT_TAG=v0.10.0
 
-FROM golang:1.27.1-trixie AS build
+FROM golang:1.27.3-trixie AS build
 ARG SUNLIGHT_TAG
 RUN CGO_ENABLED=1 go install filippo.io/sunlight/cmd/sunlight@${SUNLIGHT_TAG}
 
diff --git a/test/vtcomboserver/Dockerfile b/test/vtcomboserver/Dockerfile
index a158f0bca39..9bbe291f922 100644
--- a/test/vtcomboserver/Dockerfile
+++ b/test/vtcomboserver/Dockerfile
@@ -2,7 +2,7 @@
 ARG VITESS_TAG=v24.0.3
 ARG MYSQL_BASE_IMAGE=mysql:8.4
 
-FROM golang:1.27.1-trixie AS build
+FROM golang:1.27.3-trixie AS build
 ARG VITESS_TAG
 ENV CGO_ENABLED=0