diff --git a/.github/workflows/codeql-verification.yml b/.github/workflows/codeql-verification.yml
index 1b95d803..8fa27463 100644
--- a/.github/workflows/codeql-verification.yml
+++ b/.github/workflows/codeql-verification.yml
@@ -45,12 +45,12 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          archive="$RUNNER_TEMP/go1.27.2.linux-amd64.tar.gz"
+          archive="$RUNNER_TEMP/go1.27.3.linux-amd64.tar.gz"
           curl --fail --silent --show-error --location \
             --output "$archive" \
-            'https://go.dev/dl/go1.27.2.linux-amd64.tar.gz'
+            'https://go.dev/dl/go1.27.3.linux-amd64.tar.gz'
           printf '%s  %s\n' \
-            'ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5' \
+            '65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40' \
             "$archive" | sha256sum --check
           tar -C "$RUNNER_TEMP" -xzf "$archive"
           "$RUNNER_TEMP/go/bin/go" version
diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml
index 026092ff..4d43a7a7 100644
--- a/.github/workflows/security-release-gate.yml
+++ b/.github/workflows/security-release-gate.yml
@@ -21,7 +21,7 @@ jobs:
     env:
       DAPPER_IMAGE: pasturestack/compose-cli-dapper:${{ github.sha }}
       TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969
-      VERSION_OVERRIDE: 0.14.37
+      VERSION_OVERRIDE: 0.14.38
       PLATFORM_COMPAT_JAR_URL: https://github.com/PastureStack/orchestration-engine/releases/download/v0.183.281/orchestration-engine-0.183.281.jar
       PLATFORM_COMPAT_JAR_SHA256: da2a8a51562ed16e296f7e29e99482bb44042ff0834cca679bbe01d951ba1682
 
@@ -69,7 +69,7 @@ jobs:
           }
 
           run_ci
-          artifact="dist/artifacts/compose-executor-0.14.37-linux-amd64.gz"
+          artifact="dist/artifacts/compose-executor-0.14.38-linux-amd64.gz"
           test -s "$artifact"
           cp "$artifact" /tmp/compose-executor-first.gz
 
@@ -81,7 +81,7 @@ jobs:
           mkdir -p evidence/product
           gzip -cd "$artifact" > evidence/product/compose-executor
           chmod +x evidence/product/compose-executor
-          evidence/product/compose-executor --version | grep -F '0.14.37' >/dev/null
+          evidence/product/compose-executor --version | grep -F '0.14.38' >/dev/null
           cp "$artifact" evidence/
           (
             cd evidence
@@ -92,6 +92,7 @@ jobs:
             "$DAPPER_IMAGE" \
             version -m /work/evidence/product/compose-executor \
             > evidence/product-go-version.txt
+          grep -F 'go1.27.3' evidence/product-go-version.txt >/dev/null
 
       - name: Record resolved build inputs
         shell: bash
diff --git a/Dockerfile.dapper b/Dockerfile.dapper
index 021949da..e7b243f7 100644
--- a/Dockerfile.dapper
+++ b/Dockerfile.dapper
@@ -3,9 +3,9 @@ FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea264
 COPY ubuntu-apt.lock /licenses/ubuntu-apt.lock
 ADD --checksum=sha256:6077d27c6b6f8b23590cb01ff877ed8c804a67a5442cc32b5a33da10d2bd0e90 https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260601~26.04.1_all.deb /tmp/ca-certificates.deb
 
-ARG GO_VERSION=1.27.2
-ARG GO_SHA256_amd64=ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5
-ARG GO_SHA256_arm64=94f3e30b8e374bc285e7dadc11e0865726b9bc6e85b841ccceaabc0214c6b7c8
+ARG GO_VERSION=1.27.3
+ARG GO_SHA256_amd64=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40
+ARG GO_SHA256_arm64=a06e99309dbcbdca1a8ccd2282c3ee146e55930886e26b4f1193269587165f49
 ARG DAPPER_HOST_ARCH=amd64
 
 ENV DEBIAN_FRONTEND=noninteractive \
@@ -41,7 +41,13 @@ RUN set -eux; \
         git="${UBUNTU_APT_GIT_VERSION}" \
         gzip="${UBUNTU_APT_GZIP_VERSION}" \
         libc6-dev="${UBUNTU_APT_LIBC6_DEV_VERSION}" \
+        libcurl3t64-gnutls="${UBUNTU_APT_CURL_VERSION}" \
+        libcurl4t64="${UBUNTU_APT_CURL_VERSION}" \
+        libssl3t64="${UBUNTU_APT_OPENSSL_VERSION}" \
+        linux-libc-dev="${UBUNTU_APT_LINUX_LIBC_DEV_VERSION}" \
         make="${UBUNTU_APT_MAKE_VERSION}" \
+        openssl="${UBUNTU_APT_OPENSSL_VERSION}" \
+        openssl-provider-legacy="${UBUNTU_APT_OPENSSL_VERSION}" \
         python3="${UBUNTU_APT_PYTHON3_VERSION}" \
         python3-virtualenv="${UBUNTU_APT_PYTHON3_VIRTUALENV_VERSION}" \
         rsync="${UBUNTU_APT_RSYNC_VERSION}" \
diff --git a/README.md b/README.md
index 7541a78e..1d21bd10 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ PastureStack is an independent community effort to preserve, audit, and moderniz
 
 ## Project status
 
-The candidate source uses Ubuntu 26.04, Go 1.27.2, and Python 3.14.7 for integration-source verification. Ubuntu build packages, the base image, and Go archives are fixed by snapshot, exact version, and SHA-256. Go dependencies are managed by `go.mod` and a reproducible module vendor tree. AWS access uses AWS SDK for Go v2; container structures use the maintained Moby API module; the command parser uses urfave/cli v3. The abandoned AWS SDK v1, Rancher generated-client modules, event-subscriber module, `docker/libcompose`, and other GOPATH-era dependencies have been removed. The small Rancher 1.6 protocol boundary retained by this compatibility CLI is maintained and tested locally. The Dapper builder does not embed a Docker CLI or mount a Docker socket; Docker is required only on the host to create and run the isolated builder. The maintained binaries are `pasturestack-compose` and `compose-executor`; `platform-compose.yml` is the preferred companion file. Releases are built and verified from the preserved source history; this repository does not enable automated deployment.
+The candidate source uses Ubuntu 26.04, Go 1.27.3, and Python 3.14.7 for integration-source verification. Ubuntu build packages, the base image, and Go archives are fixed by snapshot, exact version, and SHA-256. Go dependencies are managed by `go.mod` and a reproducible module vendor tree. AWS access uses AWS SDK for Go v2; container structures use the maintained Moby API module; the command parser uses urfave/cli v3. The abandoned AWS SDK v1, Rancher generated-client modules, event-subscriber module, `docker/libcompose`, and other GOPATH-era dependencies have been removed. The small Rancher 1.6 protocol boundary retained by this compatibility CLI is maintained and tested locally. The Dapper builder does not embed a Docker CLI or mount a Docker socket; Docker is required only on the host to create and run the isolated builder. The maintained binaries are `pasturestack-compose` and `compose-executor`; `platform-compose.yml` is the preferred companion file. Releases are built and verified from the preserved source history; this repository does not enable automated deployment.
 
 ## Configuration
 
@@ -26,20 +26,19 @@ make test
 make package
 ```
 
-Release `v0.14.36` is the current reviewed maintenance version and is consumed
-by PastureStack Server `v1.6.410`. For published installations, use its
-`compose-executor-0.14.36-linux-amd64.gz` release asset. Packaging from that
-published source uses `VERSION_OVERRIDE=0.14.36`.
+Release `v0.14.37` is the currently published maintenance version. Its
+`compose-executor-0.14.37-linux-amd64.gz` asset and earlier releases remain
+immutable; the compiler-only rebuild does not replace their bytes.
 
-Set `VERSION_OVERRIDE=0.14.37` only for the current maintenance candidate.
-Candidate packaging produces `compose-executor-0.14.37-linux-amd64.gz` for a
+Set `VERSION_OVERRIDE=0.14.38` only for the current maintenance candidate.
+Candidate packaging produces `compose-executor-0.14.38-linux-amd64.gz` for a
 matching future `PastureStack/server` GitHub Release; candidate publication
 and matching Server acceptance are not yet complete. Existing published tags
 and assets remain immutable. The Python integration suite must run against an
 isolated compatible Server before integration; it must never target an
 operator's live control plane.
 
-Go 1.27.2 compiler archives are checksum-pinned for Linux/amd64 and Linux/arm64.
+Go 1.27.3 compiler archives are checksum-pinned for Linux/amd64 and Linux/arm64.
 This candidate's artifact qualification covers Linux/amd64 only, not an ARM64
 binary build.
 
diff --git a/scripts/check-pasturestack-source b/scripts/check-pasturestack-source
index d5db6013..b0fba59e 100755
--- a/scripts/check-pasturestack-source
+++ b/scripts/check-pasturestack-source
@@ -39,9 +39,12 @@ require_line scripts/build 'OS_ARCH_ARG[linux]="amd64"'
 require_line scripts/build 'OS_ARCH_ARG[windows]="amd64"'
 require_line scripts/build 'OS_ARCH_ARG[darwin]="amd64"'
 require_line Dockerfile.dapper 'FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b'
-require_line Dockerfile.dapper 'ARG GO_VERSION=1.27.2'
-require_line Dockerfile.dapper 'ARG GO_SHA256_amd64=ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5'
-require_line Dockerfile.dapper 'ARG GO_SHA256_arm64=94f3e30b8e374bc285e7dadc11e0865726b9bc6e85b841ccceaabc0214c6b7c8'
+require_line Dockerfile.dapper 'ARG GO_VERSION=1.27.3'
+require_line Dockerfile.dapper 'ARG GO_SHA256_amd64=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40'
+require_line Dockerfile.dapper 'ARG GO_SHA256_arm64=a06e99309dbcbdca1a8ccd2282c3ee146e55930886e26b4f1193269587165f49'
+require_line .github/workflows/codeql-verification.yml '          archive="$RUNNER_TEMP/go1.27.3.linux-amd64.tar.gz"'
+require_line .github/workflows/codeql-verification.yml "            '65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40' \\"
+require_line .github/workflows/security-release-gate.yml "          grep -F 'go1.27.3' evidence/product-go-version.txt >/dev/null"
 require_line Dockerfile.dapper '    GO111MODULE=on \'
 require_line Dockerfile.dapper '    GOFLAGS=-mod=vendor \'
 require_line Dockerfile.dapper "    printf 'Types: deb\\nURIs: https://archive.ubuntu.com/ubuntu\\nSuites: resolute resolute-updates resolute-backports\\nComponents: main universe restricted multiverse\\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\\nSnapshot: no\\n\\nTypes: deb\\nURIs: https://security.ubuntu.com/ubuntu\\nSuites: resolute-security\\nComponents: main universe restricted multiverse\\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\\nSnapshot: no\\n' \\"
@@ -57,6 +60,15 @@ require_line vendor/modules.txt '# github.com/moby/moby/api v1.55.0'
 require_line security/openvex.json '        "name": "GO-2026-5932"'
 require_line security/openvex.json '      "justification": "vulnerable_code_not_present",'
 require_line ubuntu-apt.lock "UBUNTU_APT_GCC_VERSION='4:15.2.0-5ubuntu1'"
+require_line ubuntu-apt.lock "UBUNTU_APT_CURL_VERSION='8.18.0-1ubuntu2.8'"
+require_line ubuntu-apt.lock "UBUNTU_APT_OPENSSL_VERSION='3.5.5-1ubuntu3.7'"
+require_line ubuntu-apt.lock "UBUNTU_APT_LINUX_LIBC_DEV_VERSION='7.0.0-38.38'"
+require_line Dockerfile.dapper '        libcurl3t64-gnutls="${UBUNTU_APT_CURL_VERSION}" \'
+require_line Dockerfile.dapper '        libcurl4t64="${UBUNTU_APT_CURL_VERSION}" \'
+require_line Dockerfile.dapper '        libssl3t64="${UBUNTU_APT_OPENSSL_VERSION}" \'
+require_line Dockerfile.dapper '        linux-libc-dev="${UBUNTU_APT_LINUX_LIBC_DEV_VERSION}" \'
+require_line Dockerfile.dapper '        openssl="${UBUNTU_APT_OPENSSL_VERSION}" \'
+require_line Dockerfile.dapper '        openssl-provider-legacy="${UBUNTU_APT_OPENSSL_VERSION}" \'
 require_line .python-version '3.14.7'
 require_line tests/integration/requirements.txt 'pytest==9.1.1'
 require_line tests/integration/requirements.txt 'setuptools==84.0.0'
@@ -110,4 +122,4 @@ fi
 require_line README.md 'PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.'
 require_line ORIGIN.md '- Migration model: unchanged upstream history followed by one PastureStack maintenance commit'
 
-printf 'PASTURESTACK_COMPOSE_SOURCE_GATE_OK modules=vendor aws_sdk=v2 moby_api=1.55.0 archived_go_dependencies=absent system_images=ghcr local_resource_boundary=root_scoped unused_docker_cli=absent ubuntu=26.04 apt_direct_versions=locked language_floor=1.26.0 toolchain=1.27.2 module_toolchain=1.27.0 python=3.14.7\n'
+printf 'PASTURESTACK_COMPOSE_SOURCE_GATE_OK modules=vendor aws_sdk=v2 moby_api=1.55.0 archived_go_dependencies=absent system_images=ghcr local_resource_boundary=root_scoped unused_docker_cli=absent ubuntu=26.04 apt_direct_versions=locked language_floor=1.26.0 toolchain=1.27.3 module_toolchain=1.27.0 python=3.14.7\n'
diff --git a/ubuntu-apt.lock b/ubuntu-apt.lock
index a4c09615..299e5768 100644
--- a/ubuntu-apt.lock
+++ b/ubuntu-apt.lock
@@ -2,14 +2,16 @@
 # Refresh every exact version together after validating the supported pockets.
 
 UBUNTU_APT_BASH_VERSION='5.3-2ubuntu1'
-UBUNTU_APT_CA_CERTIFICATES_VERSION='20260601~26.04.1'
-UBUNTU_APT_CURL_VERSION='8.18.0-1ubuntu2.4'
+UBUNTU_APT_CA_CERTIFICATES_VERSION='20260816ubuntu0.26.04.1'
+UBUNTU_APT_CURL_VERSION='8.18.0-1ubuntu2.8'
 UBUNTU_APT_DEFAULT_JRE_VERSION='2:1.25-77'
 UBUNTU_APT_GCC_VERSION='4:15.2.0-5ubuntu1'
 UBUNTU_APT_GIT_VERSION='1:2.53.0-1ubuntu1'
 UBUNTU_APT_GZIP_VERSION='1.14-1~exp2ubuntu1.1'
-UBUNTU_APT_LIBC6_DEV_VERSION='2.43-2ubuntu2.3'
+UBUNTU_APT_LIBC6_DEV_VERSION='2.43-2ubuntu2.4'
+UBUNTU_APT_LINUX_LIBC_DEV_VERSION='7.0.0-38.38'
 UBUNTU_APT_MAKE_VERSION='4.4.1-3'
+UBUNTU_APT_OPENSSL_VERSION='3.5.5-1ubuntu3.7'
 UBUNTU_APT_PYTHON3_VERSION='3.14.3-0ubuntu2'
 UBUNTU_APT_PYTHON3_VIRTUALENV_VERSION='20.36.1+ds-1'
 UBUNTU_APT_RSYNC_VERSION='3.4.1+ds1-7ubuntu0.3'