diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 2396a83707..d2e1385b3b 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -62,10 +62,10 @@ repos:
     rev: v2.13.2
     hooks:
       - id: golangci-lint
-        language_version: 1.26.6
+        language_version: 1.26.8
         args: ["--timeout=10m"]
       - id: golangci-lint-fmt
-        language_version: 1.26.6
+        language_version: 1.26.8
   - repo: local
     hooks:
       - id: golangci-lint-ci-parity
diff --git a/e2e/tests/build/testdata/docker-compose-features-context/.devcontainer/devcontainer.json b/e2e/tests/build/testdata/docker-compose-features-context/.devcontainer/devcontainer.json
index 4cc3d64e9c..88c60d6e6c 100644
--- a/e2e/tests/build/testdata/docker-compose-features-context/.devcontainer/devcontainer.json
+++ b/e2e/tests/build/testdata/docker-compose-features-context/.devcontainer/devcontainer.json
@@ -7,7 +7,7 @@
     "ghcr.io/devcontainers/features/common-utils:2": {
       "installZsh": true,
       "configureZshAsDefaultShell": true,
-      "upgradePackages": true,
+      "upgradePackages": false,
       "installOhMyZsh": false,
       "installOhMyZshConfig": false,
       "username": "example",
diff --git a/go.mod b/go.mod
index 15adc43c8d..cff795ba11 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/devsy-org/devsy
 
-go 1.26.6
+go 1.26.8
 
 require (
 	al.essio.dev/pkg/shellescape v1.6.0
diff --git a/mise.lock b/mise.lock
index ed337896ff..246bcd2657 100644
--- a/mise.lock
+++ b/mise.lock
@@ -20,13 +20,17 @@ url_api = "https://api.github.com/repos/cli/cli/releases/assets/542974295"
 provenance = "github-attestations"
 
 [[tools.go]]
-version = "1.26.6"
+version = "1.26.8"
 backend = "core:go"
-specifiers = ["1.26.6"]
+specifiers = ["1.26.8"]
 
 [tools.go."platforms.linux-x64"]
-checksum = "sha256:708effb774be8237570d0add163225abbdfaf4fca28b2611df167beba4feef89"
-url = "https://dl.google.com/go/go1.26.6.linux-amd64.tar.gz"
+checksum = "sha256:d0f743b33e8d8945e6b1f432edd15785c70507121d6e2a723b21285eddf8b57b"
+url = "https://dl.google.com/go/go1.26.8.linux-amd64.tar.gz"
+
+[tools.go."platforms.macos-arm64"]
+checksum = "sha256:a012b25b571bd0138a03dcd25375ceba866fe5ca822f426d2c66a4de56fd3f4b"
+url = "https://dl.google.com/go/go1.26.8.darwin-arm64.tar.gz"
 
 [[tools.golangci-lint]]
 version = "2.13.2"
@@ -39,6 +43,12 @@ url = "https://github.com/golangci/golangci-lint/releases/download/v2.13.2/golan
 url_api = "https://api.github.com/repos/golangci/golangci-lint/releases/assets/532995333"
 provenance = "github-attestations"
 
+[tools.golangci-lint."platforms.macos-arm64"]
+checksum = "sha256:f4bf83f0b64f055c42b28fc9a38861839f69c096e61c788e72dfaae412011789"
+url = "https://github.com/golangci/golangci-lint/releases/download/v2.13.2/golangci-lint-2.13.2-darwin-arm64.tar.gz"
+url_api = "https://api.github.com/repos/golangci/golangci-lint/releases/assets/532995398"
+provenance = "github-attestations"
+
 [[tools.node]]
 version = "24.20.0"
 backend = "core:node"
diff --git a/mise.toml b/mise.toml
index 8b0c68ab71..b730560849 100644
--- a/mise.toml
+++ b/mise.toml
@@ -1,13 +1,13 @@
 [settings]
 experimental = true
 lockfile = true
-lockfile_platforms = ["linux-x64"]
+lockfile_platforms = ["linux-x64", "macos-arm64"]
 
 [tool_config]
 locked = true
 
 [tools]
-go = "1.26.6"
+go = "1.26.8"
 node = "24"
 task = "3.53.1"
 golangci-lint = "2.13.2"
diff --git a/renovate.json b/renovate.json
index 404c19e402..14634ed42f 100644
--- a/renovate.json
+++ b/renovate.json
@@ -39,7 +39,16 @@
       "matchFileNames": [".pre-commit-config.yaml"],
       "allowedVersions": "v2.13.2",
       "automerge": false,
-      "description": "keep golangci-lint aligned with the pinned Go 1.26.6 toolchain"
+      "description": "keep golangci-lint aligned with the pinned Go 1.26.8 toolchain"
+    },
+    {
+      "matchManagers": ["mise"],
+      "matchDatasources": ["go"],
+      "matchDepNames": ["go"],
+      "matchFileNames": ["mise.toml"],
+      "allowedVersions": "<1.27.0",
+      "automerge": false,
+      "description": "keep the mise Go toolchain on the Go 1.26 major line"
     },
 
     {