diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3c266133..751336c5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,6 +28,16 @@ jobs:
         with:
           go-version: "1.26"
 
+      - name: Allow Go to fetch the toolchain go.mod pins
+        # actions/setup-go unconditionally exports GOTOOLCHAIN=local, which
+        # forbids Go from fetching the toolchain go.mod requires. go.mod pins
+        # `go 1.26.5`, but setup-go's "1.26" resolves to the newest patch in
+        # its manifest (1.26.4 here), so every `go` command fails with
+        # "go.mod requires go >= 1.26.5 (running go 1.26.4)". Written AFTER
+        # setup-go so it wins the $GITHUB_ENV last-write; `auto` lets Go pull
+        # 1.26.5 on demand. Added after #896 raised the go.mod floor.
+        run: echo "GOTOOLCHAIN=auto" >> "$GITHUB_ENV"
+
       - name: Create web build placeholder for embed
         run: mkdir -p web/build && echo "placeholder" > web/build/.gitkeep
 
@@ -141,6 +151,11 @@ jobs:
         with:
           go-version: "1.26"
 
+      - name: Allow Go to fetch the toolchain go.mod pins
+        # See the identical step in the `go` job — setup-go pins
+        # GOTOOLCHAIN=local, blocking the 1.26.5 fetch go.mod requires.
+        run: echo "GOTOOLCHAIN=auto" >> "$GITHUB_ENV"
+
       - name: Create web build placeholder for embed
         run: mkdir -p web/build && echo "placeholder" > web/build/.gitkeep
 
@@ -223,6 +238,12 @@ jobs:
         with:
           go-version: "1.26"
 
+      - name: Allow Go to fetch the toolchain go.mod pins
+        # See the identical step in the `go` job — setup-go pins
+        # GOTOOLCHAIN=local, blocking the 1.26.5 fetch go.mod requires
+        # (the "Build pad binary" step below fails without this).
+        run: echo "GOTOOLCHAIN=auto" >> "$GITHUB_ENV"
+
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "24"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5debb5c2..9d938f67 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -49,6 +49,13 @@ jobs:
         with:
           go-version: "1.26"
 
+      - name: Allow Go to fetch the toolchain go.mod pins
+        # actions/setup-go pins GOTOOLCHAIN=local, which blocks the toolchain
+        # go.mod requires (`go 1.26.5`) from being fetched. `auto`, written
+        # after setup-go so it wins the $GITHUB_ENV last-write, lets Go pull
+        # it on demand. Mirrors the CI workflow; see #896.
+        run: echo "GOTOOLCHAIN=auto" >> "$GITHUB_ENV"
+
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "24"