diff --git a/companions/proto/Dockerfile b/companions/proto/Dockerfile
index e04e5a38..b040805a 100644
--- a/companions/proto/Dockerfile
+++ b/companions/proto/Dockerfile
@@ -1,7 +1,7 @@
 # Proto compilation companion for `codefly generate proto`.
 #
 # Size strategy:
-#   1. Multi-stage: build all the Go plugins in a golang:1.26-alpine
+#   1. Multi-stage: build all the Go plugins in a golang:1.27-alpine
 #      builder stage, copy only the static binaries into the runtime.
 #   2. Strip Go binaries with -ldflags="-s -w" during install — drops
 #      DWARF + symbol tables, typically 20-30% smaller per binary.
@@ -14,7 +14,7 @@
 
 # --- Builder stage: compile every Go plugin from source --------------
 
-FROM golang:1.26-alpine AS builder
+FROM golang:1.27-alpine AS builder
 
 RUN apk add --no-cache git python3 py3-pip nodejs npm protobuf
 
diff --git a/companions/proto/flake.lock b/companions/proto/flake.lock
new file mode 100644
index 00000000..9c5c0166
--- /dev/null
+++ b/companions/proto/flake.lock
@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1787360063,
+        "narHash": "sha256-dt4WdcvsA8/RCe+VZZwqU0X+XMM3wBbGCWA0/sFWzGo=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "2c423e03bbafcff28bfadc6781a4a8257f205cb5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/companions/proto/flake.nix b/companions/proto/flake.nix
index c43defd3..6ea17224 100644
--- a/companions/proto/flake.nix
+++ b/companions/proto/flake.nix
@@ -4,7 +4,7 @@
 #
 #   - Reproducible: Nix pins every transitive dependency by content
 #     hash via flake.lock. Two builds from the same commit produce
-#     bit-identical images. The Dockerfile pinned `golang:1.26-alpine`
+#     bit-identical images. The Dockerfile pinned `golang:1.27-alpine`
 #     and `apk add` package versions on a best-effort basis only.
 #
 #   - Layered cache: dockerTools.streamLayeredImage produces an image
@@ -136,8 +136,10 @@
           # Swagger client generator — needs `go` in PATH at runtime
           # to format its output, hence go below.
           go-swagger
-          # Bring `go`/`gofmt` for swagger's source formatter.
-          go
+          # Bring `go`/`gofmt` for swagger's source formatter. Pinned to
+          # go_1_27 to match the rest of the ecosystem (nixpkgs' default
+          # `go` still resolves to 1.26.x); only swagger's gofmt uses it.
+          go_1_27
           # Python grpcio-tools — for grpc_python_plugin et al.
           (python3.withPackages (ps: with ps; [ grpcio-tools ]))
           # protoc-gen-es, version-pinned to the ecosystem runtime (built