diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index b17bec7..f20c62a 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -15,6 +15,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Docker login
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@v1
         with:
           username: ${{ secrets.QUAY_IO_BOT_USERNAME }}
@@ -30,7 +31,7 @@ jobs:
           length: 7
 
       - name: Setup Golang with cache
-        uses: magnetikonline/action-golang-cache@v4
+        uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
 
@@ -58,12 +59,12 @@ jobs:
         if: startsWith(github.ref, 'refs/tags/') == false
         with:
           context: .
-          push: true
+          push: ${{ github.event_name != 'pull_request' }}
           tags: quay.io/subscan-explorer/solidity-verification-tool:sha-${{ env.SHA }}-${{ github.run_number }}
           labels: ${{ steps.meta.outputs.labels }}
 
       - uses: 8398a7/action-slack@v3
-        if: failure()
+        if: failure() && github.event_name != 'pull_request'
         with:
           status: ${{ job.status }}
           fields: repo,author,eventName,workflow,ref,commit
diff --git a/Dockerfile b/Dockerfile
index db1a821..5b12ee3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,6 +3,7 @@ FROM alpine:3
 WORKDIR /app
 RUN apk update && apk add gcompat
 
+# CI builds verification with the Go version pinned in go.mod.
 COPY ./verification verification
 COPY ./*.json ./
 
diff --git a/Dockerfile.local b/Dockerfile.local
index f9fb028..c0e218e 100644
--- a/Dockerfile.local
+++ b/Dockerfile.local
@@ -1,4 +1,4 @@
-FROM golang:1.22-alpine
+FROM golang:1.26.10-alpine
 
 ENV CONF_DIR=/configs
 
diff --git a/README.md b/README.md
index 2991cd3..7c4dae9 100644
--- a/README.md
+++ b/README.md
@@ -14,6 +14,16 @@ bytecode.
 
 ## Installation
 
+Use Go 1.26.10, matching `go.mod`, CI, and `Dockerfile.local`. This includes the
+`crypto/x509` certificate verification fix in
+[GO-2026-6809](https://pkg.go.dev/vuln/GO-2026-6809). With gvm, select the
+toolchain before running Go commands:
+
+```sh
+source ~/.gvm/scripts/gvm
+gvm use go1.26.10
+```
+
 1. Clone the repository:
 ```sh
 git clone https://github.com/subscan-explorer/solidity-verification-tool.git
@@ -36,7 +46,7 @@ go mod tidy
 1. Start the server:
 
 ```sh
-go run main.go
+go run .
 ```
 
 2. Send a POST request to `/verify` with the contract metadata and compiler version.
@@ -65,6 +75,21 @@ Building Solidity contracts for PolkaVM requires installing extra dependencies.
 go run . download # if will auto download latest resolc binary in static folder
 ```
 
+## Development
+
+```sh
+go test -mod=mod -v ./...
+go vet ./...
+make build
+```
+
+The compiler integration tests download amd64 solc binaries. ARM developers need
+an amd64 execution environment to run these tests.
+
+CI compiles `verification` with the Go version in `go.mod` before the production
+`Dockerfile` packages it. `Dockerfile.local` compiles the service inside its Go
+builder image. Updating the production Alpine base alone does not rebuild Go.
+
 ## License
 
 This project is licensed under the MIT License.
diff --git a/go.mod b/go.mod
index 2ff53fd..50396a6 100644
--- a/go.mod
+++ b/go.mod
@@ -1,3 +1,3 @@
 module verify-golang
 
-go 1.22
+go 1.26.10
diff --git a/util/http_test.go b/util/http_test.go
index f9bc6c7..6d9af58 100644
--- a/util/http_test.go
+++ b/util/http_test.go
@@ -2,6 +2,8 @@ package util
 
 import (
 	"context"
+	"crypto/x509"
+	"errors"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -47,3 +49,16 @@ func TestPostWithJson(t *testing.T) {
 		t.Errorf("expected response {\"response\":\"ok\"}, got %s", resp)
 	}
 }
+
+func TestPostWithJsonRejectsUntrustedTLSCertificate(t *testing.T) {
+	ts := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Error("request reached a server with an untrusted certificate")
+	}))
+	defer ts.Close()
+
+	_, err := PostWithJson(context.Background(), []byte(`{"key":"value"}`), ts.URL)
+	var unknownAuthority x509.UnknownAuthorityError
+	if !errors.As(err, &unknownAuthority) {
+		t.Fatalf("expected unknown certificate authority, got %v", err)
+	}
+}