diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 55bf1674..b1ba93fb 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -3,7 +3,7 @@
   "image": "mcr.microsoft.com/devcontainers/typescript-node:1-22-bookworm",
   "features": {
     "ghcr.io/devcontainers/features/go:1": {
-      "version": "1.26"
+      "version": "1.27"
     }
   },
   "customizations": {
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 12820898..0bb43440 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -74,7 +74,7 @@ If you use [Dev Containers](https://code.visualstudio.com/docs/remote/containers
 If you don't use Dev Containers, you need to install the following tools manually:
 
 - [Node.js](https://nodejs.org/en/download/) >= 24
-- [Go](https://golang.org/doc/install) >= 1.26
+- [Go](https://golang.org/doc/install) >= 1.27
 - [Git](https://git-scm.com/downloads)
 
 #### 2. Setup
diff --git a/backend/go.mod b/backend/go.mod
index 48c77242..3c78345f 100644
--- a/backend/go.mod
+++ b/backend/go.mod
@@ -1,6 +1,6 @@
 module github.com/pocket-id/pocket-id/backend
 
-go 1.26.6
+go 1.27.0
 
 require (
 	github.com/aws/aws-sdk-go-v2 v1.43.7
diff --git a/backend/internal/dto/oidc_dto_test.go b/backend/internal/dto/oidc_dto_test.go
index 2e9596bc..1174f2d3 100644
--- a/backend/internal/dto/oidc_dto_test.go
+++ b/backend/internal/dto/oidc_dto_test.go
@@ -79,7 +79,7 @@ func TestOidcClientDto_secrets(t *testing.T) {
 	expired := datatype.DateTime(time.Now().Add(-time.Hour))
 	valid := datatype.DateTime(time.Now().Add(time.Hour))
 	client := model.OidcClient{
-		Base: model.Base{ID: "client-id"},
+		ID:   "client-id",
 		Name: "Test Client",
 		Credentials: model.OidcClientCredentials{
 			Secrets: []model.OidcClientSecret{
@@ -109,7 +109,7 @@ func TestOidcClientDto_secrets(t *testing.T) {
 
 func TestOidcClientDto_secretsAlwaysSerialized(t *testing.T) {
 	client := model.OidcClient{
-		Base: model.Base{ID: "client-id"},
+		ID:   "client-id",
 		Name: "Test Client",
 	}
 
diff --git a/backend/internal/dto/validations.go b/backend/internal/dto/validations.go
index b2917d67..552d6b7d 100644
--- a/backend/internal/dto/validations.go
+++ b/backend/internal/dto/validations.go
@@ -31,7 +31,7 @@ func init() {
 
 	// Use JSON tags to keep client-visible validation field names stable
 	engine.RegisterTagNameFunc(func(field reflect.StructField) string {
-		name := strings.SplitN(field.Tag.Get("json"), ",", 2)[0]
+		name, _, _ := strings.Cut(field.Tag.Get("json"), ",")
 		if name == "" || name == "-" {
 			return field.Name
 		}
diff --git a/backend/internal/utils/callback_url_util.go b/backend/internal/utils/callback_url_util.go
index 6f8ae07d..c8481a95 100644
--- a/backend/internal/utils/callback_url_util.go
+++ b/backend/internal/utils/callback_url_util.go
@@ -49,8 +49,8 @@ func validateCallbackURLPatternURL(pattern string) error {
 }
 
 func callbackURLPatternForURLParse(pattern string) string {
-	if strings.HasPrefix(pattern, "*://") {
-		pattern = "https://" + strings.TrimPrefix(pattern, "*://")
+	if after, ok := strings.CutPrefix(pattern, "*://"); ok {
+		pattern = "https://" + after
 	}
 
 	scheme, rest, ok := strings.Cut(pattern, "://")
diff --git a/backend/internal/utils/csp.go b/backend/internal/utils/csp.go
index ce42f41d..f16fe0f0 100644
--- a/backend/internal/utils/csp.go
+++ b/backend/internal/utils/csp.go
@@ -37,14 +37,15 @@ func BuildFormPostCSP(nonce, redirectURI, scriptHash string) string {
 
 func buildCSP(nonce string, formActionExtra, scriptSrcExtra []string) string {
 	formAction := "'self'"
-	scriptSrc := "script-src 'self'"
+	var scriptSrc strings.Builder
+	scriptSrc.WriteString("script-src 'self'")
 	if nonce != "" {
-		scriptSrc += " 'nonce-" + nonce + "'"
+		scriptSrc.WriteString(" 'nonce-" + nonce + "'")
 	}
 
 	for _, extra := range scriptSrcExtra {
 		if extra != "" {
-			scriptSrc += " " + extra
+			scriptSrc.WriteString(" " + extra)
 		}
 	}
 
@@ -69,7 +70,7 @@ func buildCSP(nonce string, formActionExtra, scriptSrcExtra []string) string {
 		"img-src * blob:;" +
 		"font-src 'self'; " +
 		"style-src 'self' 'unsafe-inline'; " +
-		scriptSrc
+		scriptSrc.String()
 }
 
 // GenerateCSPNonce returns a random base64 nonce for use in a CSP header.