diff --git a/.github/workflows/codeql-verification.yml b/.github/workflows/codeql-verification.yml
index d1013ba2..c8c0f46f 100644
--- a/.github/workflows/codeql-verification.yml
+++ b/.github/workflows/codeql-verification.yml
@@ -32,12 +32,12 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          archive="$RUNNER_TEMP/go1.27.0.linux-amd64.tar.gz"
+          archive="$RUNNER_TEMP/go1.27.2.linux-amd64.tar.gz"
           curl --fail --silent --show-error --location \
             --output "$archive" \
-            'https://go.dev/dl/go1.27.0.linux-amd64.tar.gz'
+            'https://go.dev/dl/go1.27.2.linux-amd64.tar.gz'
           printf '%s  %s\n' \
-            '675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685' \
+            'ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5' \
             "$archive" | sha256sum --check
           tar -C "$RUNNER_TEMP" -xzf "$archive"
           "$RUNNER_TEMP/go/bin/go" version
diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml
index 7d8d8ac7..d0314a44 100644
--- a/.github/workflows/security-release-gate.yml
+++ b/.github/workflows/security-release-gate.yml
@@ -23,7 +23,7 @@ jobs:
     env:
       DAPPER_IMAGE: pasturestack/host-provisioner-dapper:${{ github.sha }}
       TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969
-      VERSION_OVERRIDE: v0.39.7
+      VERSION_OVERRIDE: v0.39.8
       SOURCE_DATE_EPOCH: '0'
     steps:
       - name: Check out candidate
@@ -47,21 +47,21 @@ jobs:
         run: |
           set -euo pipefail
           make DAPPER_IMAGE="$DAPPER_IMAGE" ci
-          test -s dist/artifacts/host-provisioner-0.39.7-linux-amd64.tar.xz
-          package_dir='host-provisioner-0.39.7-linux-amd64'
-          tar -tJf dist/artifacts/host-provisioner-0.39.7-linux-amd64.tar.xz | grep -Fx "${package_dir}/host-provisioner"
-          tar -tJf dist/artifacts/host-provisioner-0.39.7-linux-amd64.tar.xz | grep -Fx "${package_dir}/LICENSE"
-          tar -tJf dist/artifacts/host-provisioner-0.39.7-linux-amd64.tar.xz | grep -Fx "${package_dir}/ORIGIN.md"
+          test -s dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz
+          package_dir='host-provisioner-0.39.8-linux-amd64'
+          tar -tJf dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz | grep -Fx "${package_dir}/host-provisioner"
+          tar -tJf dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz | grep -Fx "${package_dir}/LICENSE"
+          tar -tJf dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz | grep -Fx "${package_dir}/ORIGIN.md"
           expected_legal=$(find vendor -type f \( \
             -name 'LICENSE' -o -name 'LICENSE.*' -o \
             -name 'NOTICE' -o -name 'NOTICE.*' -o \
             -name 'COPYING' -o -name 'COPYING.*' -o \
             -name 'AUTHORS' -o -name 'AUTHORS.*' \
           \) | wc -l)
-          actual_legal=$(tar -tJf dist/artifacts/host-provisioner-0.39.7-linux-amd64.tar.xz | grep -Ec "^${package_dir}/licenses/.+/(LICENSE|LICENSE\..*|NOTICE|NOTICE\..*|COPYING|COPYING\..*|AUTHORS|AUTHORS\..*)$")
+          actual_legal=$(tar -tJf dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz | grep -Ec "^${package_dir}/licenses/.+/(LICENSE|LICENSE\..*|NOTICE|NOTICE\..*|COPYING|COPYING\..*|AUTHORS|AUTHORS\..*)$")
           test "$expected_legal" -gt 0
           test "$actual_legal" -eq "$expected_legal"
-          sha256sum dist/artifacts/host-provisioner-0.39.7-linux-amd64.tar.xz bin/host-provisioner > evidence/product-artifacts.sha256
+          sha256sum dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz bin/host-provisioner > evidence/product-artifacts.sha256
           docker run --rm --entrypoint go -v "$PWD:/work:ro" "$DAPPER_IMAGE" \
             version -m /work/bin/host-provisioner > evidence/product-go-version.txt
           grep -F $'build\tCGO_ENABLED=0' evidence/product-go-version.txt >/dev/null
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 589ca4a4..a4162cd0 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -33,19 +33,19 @@ jobs:
           set -euo pipefail
           test -z "$(git status --porcelain)"
           git merge-base --is-ancestor 22d7baca609c18589f08225a97bf8c5e00109204 HEAD
-          grep -Fq 'VERSION_OVERRIDE: v0.39.7' .github/workflows/validate.yml
+          grep -Fq 'VERSION_OVERRIDE: v0.39.8' .github/workflows/validate.yml
 
       - name: Run complete tests, validation, and package
         env:
-          VERSION_OVERRIDE: v0.39.7
+          VERSION_OVERRIDE: v0.39.8
           SOURCE_DATE_EPOCH: '0'
         shell: bash
         run: |
           set -euo pipefail
           make ci
-          asset='dist/artifacts/host-provisioner-0.39.7-linux-amd64.tar.xz'
+          asset='dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz'
           test -s "$asset"
-          package_dir='host-provisioner-0.39.7-linux-amd64'
+          package_dir='host-provisioner-0.39.8-linux-amd64'
           tar -tJf "$asset" | grep -Fx "${package_dir}/host-provisioner"
           tar -tJf "$asset" | grep -Fx "${package_dir}/LICENSE"
           tar -tJf "$asset" | grep -Fx "${package_dir}/ORIGIN.md"
@@ -61,28 +61,28 @@ jobs:
           mkdir -p evidence extracted
           tar -xJf "$asset" -C extracted
           test -x "extracted/${package_dir}/host-provisioner"
-          test "$("extracted/${package_dir}/host-provisioner" -v)" = $'host-provisioner\t gitcommit=v0.39.7'
+          test "$("extracted/${package_dir}/host-provisioner" -v)" = $'host-provisioner\t gitcommit=v0.39.8'
           sha256sum "$asset" "extracted/${package_dir}/host-provisioner" > evidence/product-artifacts.sha256
 
       - name: Verify reproducible artifact
         env:
-          VERSION_OVERRIDE: v0.39.7
+          VERSION_OVERRIDE: v0.39.8
           SOURCE_DATE_EPOCH: '0'
         shell: bash
         run: |
           set -euo pipefail
-          cp dist/artifacts/host-provisioner-0.39.7-linux-amd64.tar.xz /tmp/first.tar.xz
+          cp dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz /tmp/first.tar.xz
           rm -rf bin dist
           make ci
-          cmp /tmp/first.tar.xz dist/artifacts/host-provisioner-0.39.7-linux-amd64.tar.xz
+          cmp /tmp/first.tar.xz dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz
           printf 'HOST_PROVISIONER_VALIDATION_OK source=%s version=%s\n' "$GITHUB_SHA" "$VERSION_OVERRIDE"
 
       - name: Retain reviewed release candidate
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: host-provisioner-0.39.7
+          name: host-provisioner-0.39.8
           path: |
-            dist/artifacts/host-provisioner-0.39.7-linux-amd64.tar.xz
+            dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz
             evidence/product-artifacts.sha256
           if-no-files-found: error
           retention-days: 30
diff --git a/Dockerfile.dapper b/Dockerfile.dapper
index 7e83f1c4..95201a13 100644
--- a/Dockerfile.dapper
+++ b/Dockerfile.dapper
@@ -2,9 +2,9 @@
 FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b
 
 ENV DEBIAN_FRONTEND=noninteractive
-ARG GO_VERSION=1.27.0
-ARG GO_SHA256=675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685
-ARG UBUNTU_SNAPSHOT=20260909T000000Z
+ARG GO_VERSION=1.27.2
+ARG GO_SHA256=ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5
+ARG UBUNTU_SNAPSHOT=20261010T200000Z
 
 ADD --checksum=sha256:6077d27c6b6f8b23590cb01ff877ed8c804a67a5442cc32b5a33da10d2bd0e90 \
     https://snapshot.ubuntu.com/ubuntu/20260909T000000Z/pool/main/c/ca-certificates/ca-certificates_20260601~26.04.1_all.deb \
@@ -31,7 +31,10 @@ RUN set -eux; \
     apt-get install -y --no-install-recommends \
         ca-certificates \
         build-essential \
-        linux-libc-dev=7.0.0-31.31 \
+        linux-libc-dev=7.0.0-38.38 \
+        libssl3t64=3.5.5-1ubuntu3.7 \
+        openssl=3.5.5-1ubuntu3.7 \
+        openssl-provider-legacy=3.5.5-1ubuntu3.7 \
         curl \
         git \
         tar \
diff --git a/README.md b/README.md
index ba415579..1ad670a8 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ PastureStack is an independent community effort to preserve, audit, and moderniz
 
 ## Project status
 
-The current reviewed compatibility release is `v0.39.7`, based on the preserved upstream `v0.39.4` boundary and consumed by PastureStack Server `v1.6.410`. Existing Ubuntu 26.04, Go 1.27.0, dependency, driver checksum, jailer, and test maintenance is retained. The build container contains only the tools used by compilation and tests; Docker remains on the outer build runner and is not duplicated inside the container. Product-owned imports, executable names, state defaults, router identities, and operator messages use PastureStack naming. Machine storage is constrained to its configured root and restored configuration archives reject traversal, links, and special files.
+This is the `v0.39.8` release candidate based on the preserved upstream `v0.39.4` boundary. Existing Ubuntu 26.04, dependency, driver checksum, jailer, and test maintenance is retained, with the compiler updated to checksum-pinned Go 1.27.2 for Linux/amd64. Published tags and assets remain immutable. The build container contains only the tools used by compilation and tests; Docker remains on the outer build runner and is not duplicated inside the container. Product-owned imports, executable names, state defaults, router identities, and operator messages use PastureStack naming. Machine storage is constrained to its configured root and restored configuration archives reject traversal, links, and special files. Driver publication and production deployment remain disabled while the complete Server release is assembled.
 
 ## Configuration
 
@@ -26,7 +26,9 @@ make package
 
 Dependencies are locked by `go.mod` and `go.sum`, and builds use the checked-in `vendor/` tree without network access. The machine RPC layer follows the maintained GitLab Docker Machine fork at `v0.16.2-gitlab.52`; only the packages used by Host Provisioner are shipped. The Rancher 1.6 event and API clients are retained as explicit compatibility modules under `third_party/`, so their frozen protocol surface is reviewable without treating abandoned upstream repositories as live package sources.
 
-The build container does not receive the host Docker socket. For the reviewed Server release, build with `VERSION_OVERRIDE=v0.39.7` and `SOURCE_DATE_EPOCH=0`; packaging produces the deterministic Release asset `host-provisioner-0.39.7-linux-amd64.tar.xz`. The archive contains the executable, root license, origin record, and preserved bundled-dependency legal files. PastureStack Server downloads that asset from its versioned GitHub Release and verifies its SHA-256 digest before installation. Users do not need to host a package mirror.
+The build container does not receive the host Docker socket. For the reviewed Server release, build with `VERSION_OVERRIDE=v0.39.8` and `SOURCE_DATE_EPOCH=0`; packaging produces the deterministic Release asset `host-provisioner-0.39.8-linux-amd64.tar.xz`. The archive contains the executable, root license, origin record, and preserved bundled-dependency legal files. PastureStack Server downloads that asset from its versioned GitHub Release and verifies its new SHA-256 digest before installation. Users do not need to host a package mirror.
+
+The build-only Ubuntu snapshot is fixed at `20261010T200000Z`, with kernel headers `7.0.0-38.38` and OpenSSL `3.5.5-1ubuntu3.7`. CI builds and scans that container separately from the static product executable; available upstream fixes must pass the existing security gate rather than be classified as pending vendor fixes.
 
 See [COMPATIBILITY.md](COMPATIBILITY.md), [SECURITY.md](SECURITY.md), and [ORIGIN.md](ORIGIN.md).
 
diff --git a/scripts/validate b/scripts/validate
index 091a4dba..360cbab2 100755
--- a/scripts/validate
+++ b/scripts/validate
@@ -5,8 +5,13 @@ cd $(dirname $0)/..
 
 echo Running validation
 
-grep -Fq 'ARG GO_VERSION=1.27.0' Dockerfile.dapper
-grep -Fq 'ARG GO_SHA256=675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685' Dockerfile.dapper
+grep -Fq 'ARG GO_VERSION=1.27.2' Dockerfile.dapper
+grep -Fq 'ARG GO_SHA256=ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5' Dockerfile.dapper
+grep -Fq 'ARG UBUNTU_SNAPSHOT=20261010T200000Z' Dockerfile.dapper
+grep -Fq 'linux-libc-dev=7.0.0-38.38' Dockerfile.dapper
+for package in libssl3t64 openssl openssl-provider-legacy; do
+  grep -Fq "${package}=3.5.5-1ubuntu3.7" Dockerfile.dapper
+done
 grep -Fq 'aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969' .github/workflows/security-release-gate.yml
 if grep -E 'ARG DOCKER_VERSION=|download\.docker\.com/linux/static|tar xzf /tmp/docker\.tgz' Dockerfile.dapper; then
   echo 'Unused Docker CLI must not be bundled in the build container.' >&2