diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml
index b0589019..ae077eb5 100644
--- a/.github/workflows/security-release-gate.yml
+++ b/.github/workflows/security-release-gate.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 120
     env:
-      CANDIDATE_VERSION: 0.38.7
+      CANDIDATE_VERSION: 0.38.8
       DAPPER_IMAGE: pasturestack-host-api-dapper:security-gate
       TRIVY_IMAGE: ghcr.io/aquasecurity/trivy:0.73.0@sha256:7cced7cae583819fc7806d4cbc0dbbc7cad18b99f7d3e235192e6da8c091045c
       COSIGN_IMAGE: ghcr.io/sigstore/cosign/cosign:v3.1.3@sha256:9e5c2f2edc34351160407ca3416c61855bdf9403c3c5936e0f0be7fc261611b8
@@ -35,8 +35,9 @@ jobs:
           set -euo pipefail
           test -z "$(git status --porcelain)"
           test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
-          # Exactly one reviewed maintenance commit after the existing published main.
-          test "$(git rev-list --count 67d1e58d1999730f106ba76c3ee3cf03bbf495d6..HEAD)" = 1
+          # Preserve the published history while allowing a reviewed maintenance series.
+          git merge-base --is-ancestor 67d1e58d1999730f106ba76c3ee3cf03bbf495d6 HEAD
+          test "$(git rev-list --count 67d1e58d1999730f106ba76c3ee3cf03bbf495d6..HEAD)" -ge 1
           test "$(git rev-list --count --merges 67d1e58d1999730f106ba76c3ee3cf03bbf495d6..HEAD)" = 0
           private_pattern=$(printf '%s|%s|%s' 'chen''21019' '10\.0\.0\.''125' 'C:\\''Users\\')
           if git grep -n -E "$private_pattern" -- .; then
diff --git a/Dockerfile.dapper b/Dockerfile.dapper
index 5b47e6d8..068296ba 100644
--- a/Dockerfile.dapper
+++ b/Dockerfile.dapper
@@ -35,6 +35,7 @@ ADD --checksum=sha256:6965aafe69e0a49ef34d2e26f8e83d09d1c6037b7e9ee37f19b292a3c6
 ADD --checksum=sha256:51cf418571059831096abd40e0bd5debaa1ae48a6f8d87d9e4e5f7f12aa4db52 https://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl-provider-legacy_3.5.5-1ubuntu3.7_amd64.deb /tmp/openssl-provider-legacy.deb
 ADD --checksum=sha256:0498bc9510149ef06abd6c09b8932e43c5bc71b68634b4b8f84488b2e0a20e82 https://security.ubuntu.com/ubuntu/pool/main/l/linux/linux-libc-dev_7.0.0-38.38_amd64.deb /tmp/linux-libc-dev.deb
 
+ADD --checksum=sha256:5b6326f1932cfd7be57130561dc78192f09ed9f58bfbe6606ed0c50510c3b6cd https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260816ubuntu0.26.04.1_all.deb /opt/pasturestack-ca-certificates.deb
 RUN set -eux; \
     . /licenses/ubuntu-apt.lock; \
     find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \) -exec sed -i \
@@ -45,7 +46,7 @@ RUN set -eux; \
     apt-get --snapshot "${UBUNTU_APT_SNAPSHOT}" install -y --no-install-recommends \
         bash="${UBUNTU_APT_BASH_VERSION}" \
         busybox-static="${UBUNTU_APT_BUSYBOX_STATIC_VERSION}" \
-        ca-certificates="${UBUNTU_APT_CA_CERTIFICATES_VERSION}" \
+        ca-certificates="${UBUNTU_APT_CA_CERTIFICATES_BOOTSTRAP_VERSION}" \
         containerd="${UBUNTU_APT_CONTAINERD_VERSION}" \
         curl="${UBUNTU_APT_CURL_VERSION}" \
         docker.io="${UBUNTU_APT_DOCKER_IO_VERSION}" \
@@ -81,6 +82,11 @@ RUN set -eux; \
         test "$(dpkg-query -W -f='${Version}' "$package")" = "$expected"; \
         rm -f "/tmp/${package}.deb"; \
     done; \
+    dpkg -i /opt/pasturestack-ca-certificates.deb && \
+    update-ca-certificates --fresh && \
+    test "$(dpkg-query -W -f='${Version}' ca-certificates)" = '20260816ubuntu0.26.04.1' && \
+    test ! -e /usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt && \
+    rm -f /opt/pasturestack-ca-certificates.deb && \
     { \
         printf 'snapshot\t%s\n' "${UBUNTU_APT_SNAPSHOT}"; \
         dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort; \
diff --git a/README.md b/README.md
index c1d1dad7..9467cf78 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ PastureStack is an independent community effort to preserve, audit, and moderniz
 
 ## Capabilities
 
-The source package version is `0.38.7`, built with Go 1.27.3. Use a published release only after its source, reproducibility, vulnerability, and packaged-binary checks pass; a source version is not publication evidence. Target-bound API Key tickets require matching Engine introspection at handshake and during logs, exec, and statistics streams. Revocation or expiry closes the stream; it does not stop its container or kill an already started exec process. Legacy and full-without-expiry tokens retain their authentication contract.
+The source package version is `0.38.8`, built with Go 1.27.3. Use a published release only after its source, reproducibility, vulnerability, and packaged-binary checks pass; a source version is not publication evidence. Target-bound API Key tickets require matching Engine introspection at handshake and during logs, exec, and statistics streams. Revocation or expiry closes the stream; it does not stop its container or kill an already started exec process. Legacy and full-without-expiry tokens retain their authentication contract.
 
 The authenticated backend connection declares the exact `key-audit-v1,key-delegation-v1` capabilities. A compatible Proxy requires that declaration for every verified API Key stream, including full keys, so an older embedded backend cannot bypass terminal audit. Ordinary non-Key streams retain their existing backend compatibility.
 
@@ -41,3 +41,7 @@ See [COMPATIBILITY.md](COMPATIBILITY.md), [SECURITY.md](SECURITY.md), and [ORIGI
 ## License and attribution
 
 The inherited project remains licensed under [Apache License 2.0](LICENSE). Copyright and attribution for inherited work and vendored dependencies remain with their respective authors and contributors. PastureStack contributors claim authorship only for their own changes.
+
+## October 2026 security maintenance
+
+Maintained Go builds select the patched Go 1.27.3 compiler without raising the existing Go language requirement. Ubuntu build/runtime stages apply the checksum-pinned `ca-certificates 20260816ubuntu0.26.04.1` security package after their frozen APT baseline; the final trust store and installed version are verified. Release artifacts must pass the repository's existing checks before publication.
diff --git a/package/ubuntu-apt.lock b/package/ubuntu-apt.lock
index d3447ebc..473a32a0 100644
--- a/package/ubuntu-apt.lock
+++ b/package/ubuntu-apt.lock
@@ -5,7 +5,9 @@ UBUNTU_APT_SNAPSHOT='20260808T000000Z'
 
 UBUNTU_APT_BASH_VERSION='5.3-2ubuntu1'
 UBUNTU_APT_BUSYBOX_STATIC_VERSION='1:1.37.0-7ubuntu1'
-UBUNTU_APT_CA_CERTIFICATES_VERSION='20260601~26.04.1'
+# Frozen APT baseline; the checksum-pinned security overlay below is the final installed CA.
+UBUNTU_APT_CA_CERTIFICATES_BOOTSTRAP_VERSION='20260601~26.04.1'
+UBUNTU_APT_CA_CERTIFICATES_VERSION='20260816ubuntu0.26.04.1'
 UBUNTU_APT_CONTAINERD_VERSION='2.2.2-0ubuntu1.1'
 UBUNTU_APT_CURL_VERSION='8.18.0-1ubuntu2.3'
 UBUNTU_APT_DOCKER_IO_VERSION='29.1.3-0ubuntu4.1'
diff --git a/scripts/build b/scripts/build
index 883e363b..e67fa1ce 100755
--- a/scripts/build
+++ b/scripts/build
@@ -8,7 +8,7 @@ if [ -f ./build/bootstrap.envs ];then
     . ./build/bootstrap.envs
 fi
 
-BUILD_VERSION=${VERSION_OVERRIDE:-0.38.7}
+BUILD_VERSION=${VERSION_OVERRIDE:-0.38.8}
 BUILD_VERSION=${BUILD_VERSION#v}
 if [[ ! "$BUILD_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
     echo 'VERSION_OVERRIDE must use MAJOR.MINOR.PATCH with no suffix' >&2
diff --git a/scripts/package b/scripts/package
index 2eec2165..6b4d6837 100755
--- a/scripts/package
+++ b/scripts/package
@@ -8,7 +8,7 @@ cd "$(dirname "$0")/.."
 ARCH=${ARCH:?"ARCH not set"}
 SUFFIX=""
 [ "${ARCH}" != "amd64" ] && SUFFIX="_${ARCH}"
-RELEASE_VERSION=${VERSION_OVERRIDE:-v0.38.7}
+RELEASE_VERSION=${VERSION_OVERRIDE:-v0.38.8}
 RELEASE_VERSION=${RELEASE_VERSION#v}
 CONTENT=${PASTURESTACK_PACKAGE_ID:-$(git rev-parse --short=32 HEAD)}
 SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH:-$(git show -s --format=%ct HEAD)}