diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index fe70c95..5bdd728 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -6,8 +6,10 @@ name: test
 # pre-tag step (see Settled decisions in AGENTS.md).
 
 # Every push and pull request runs it, and gh workflow run test.yml
-# [--ref <branch>] starts it by hand. A private copy of the repository runs
-# its jobs only when started by hand, because its Actions minutes are billed.
+# [--ref <branch>] starts it by hand. While the repository is private its
+# Actions minutes are billed, so a branch push runs nothing and a pull request
+# runs only test, lint and package, the checks main's ruleset requires;
+# install-scripts runs only when started by hand.
 # Run it before tagging; a version tag runs release.yml, which vets and tests
 # on Linux before it builds, so running this as well on the tag would
 # duplicate it.
@@ -22,7 +24,7 @@ permissions:
 
 jobs:
   test:
-    if: ${{ github.event_name == 'workflow_dispatch' || !github.event.repository.private }}
+    if: ${{ github.event_name != 'push' || !github.event.repository.private }}
     strategy:
       fail-fast: false
       matrix:
@@ -55,7 +57,7 @@ jobs:
   lint:
     # just fmt-check lint: formatting, golangci-lint, govulncheck, licenses, PSScriptAnalyzer, ShellCheck, prettier and
     # cspell, at the versions in mise.toml and package-lock.json.
-    if: ${{ github.event_name == 'workflow_dispatch' || !github.event.repository.private }}
+    if: ${{ github.event_name != 'push' || !github.event.repository.private }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -68,9 +70,10 @@ jobs:
   # The install scripts, run on each platform against archives goreleaser
   # packages from this commit and served locally, so they are tested before a
   # release exists. A tampered archive must be rejected. install-scripts is
-  # skipped whenever package is.
+  # skipped whenever package is, and on a private repository it runs only when
+  # started by hand.
   package:
-    if: ${{ github.event_name == 'workflow_dispatch' || !github.event.repository.private }}
+    if: ${{ github.event_name != 'push' || !github.event.repository.private }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -101,6 +104,7 @@ jobs:
 
   install-scripts:
     needs: package
+    if: ${{ github.event_name == 'workflow_dispatch' || !github.event.repository.private }}
     strategy:
       fail-fast: false
       matrix:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b6d9061..f4b9081 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,13 @@ may change, and every such change is listed here.
 
 ## [Unreleased]
 
+### Security
+
+- Release binaries and the container image are built with Go 1.27.3, whose certificate verification distrusts
+  compromised intermediate certificates when the CLI connects over HTTPS
+  ([GO-2026-6809](https://pkg.go.dev/vuln/GO-2026-6809)). A `go install` build uses your own Go, so update it to get the
+  same fix.
+
 ## [0.1.0-beta.1] - 2026-10-21
 
 The first public beta of the SaladCloud CLI: a thin, non-interactive-first command-line wrapper over the SaladCloud
diff --git a/go.mod b/go.mod
index e78fafa..42df0ff 100644
--- a/go.mod
+++ b/go.mod
@@ -2,7 +2,7 @@ module github.com/saladtechnologies/salad-cloud-cli
 
 go 1.25
 
-toolchain go1.27.2
+toolchain go1.27.3
 
 // Prettier and cSpell live here; nothing under it is part of this module.
 ignore ./node_modules
diff --git a/mise.toml b/mise.toml
index 603c9dd..e238bbc 100644
--- a/mise.toml
+++ b/mise.toml
@@ -1,5 +1,5 @@
 [tools]
-go = "1.27.2"
+go = "1.27.3"
 go-licenses = "2.0.1"
 golangci-lint = "2.14.0"
 govulncheck = "1.9.0"