diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml
index c021bd8..ec0664c 100644
--- a/.github/workflows/security-release-gate.yml
+++ b/.github/workflows/security-release-gate.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 60
     env:
-      VERSION_OVERRIDE: v0.23.14
+      VERSION_OVERRIDE: v0.23.16
       SOURCE_DATE_EPOCH: "0"
       TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969
       BUILDER_IMAGE: pasturestack-websocket-proxy-dapper:ubuntu26
@@ -22,7 +22,11 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare evidence directory
-        run: mkdir -p evidence
+        run: |
+          mkdir -p evidence
+          test -z "$(git status --porcelain --untracked-files=no)"
+          git rev-parse HEAD >evidence/source-revision.txt
+          git rev-parse HEAD^{tree} >evidence/source-tree.txt
 
       - name: Build, test with the race detector, validate, and package
         id: build
@@ -30,7 +34,11 @@ jobs:
           set -o pipefail
           make ci 2>&1 | tee evidence/build-test.log
           cp bin/websocket-proxy evidence/websocket-proxy-linux-amd64
-          cp dist/artifacts/websocket-proxy-0.23.14-linux-amd64.tar.xz evidence/first-build.tar.xz
+          cp dist/artifacts/websocket-proxy-0.23.16-linux-amd64.tar.xz evidence/first-build.tar.xz
+          docker run --rm --entrypoint /bin/bash \
+            -v "$PWD/evidence:/evidence:ro" "$BUILDER_IMAGE" \
+            -lc 'go version -m /evidence/websocket-proxy-linux-amd64' >evidence/product.buildinfo
+          test "$(awk 'NR==1 {print $2}' evidence/product.buildinfo)" = go1.27.3
 
       - name: Verify a byte-identical second package
         id: reproduce
@@ -38,7 +46,7 @@ jobs:
           set -o pipefail
           rm -rf bin dist
           make package 2>&1 | tee evidence/reproducible-build.log
-          cp dist/artifacts/websocket-proxy-0.23.14-linux-amd64.tar.xz evidence/second-build.tar.xz
+          cp dist/artifacts/websocket-proxy-0.23.16-linux-amd64.tar.xz evidence/second-build.tar.xz
           cmp evidence/first-build.tar.xz evidence/second-build.tar.xz
           sha256sum evidence/first-build.tar.xz evidence/second-build.tar.xz \
             | tee evidence/package-sha256.txt
diff --git a/Dockerfile.dapper b/Dockerfile.dapper
index 0bbc0bc..8f8e943 100644
--- a/Dockerfile.dapper
+++ b/Dockerfile.dapper
@@ -4,9 +4,9 @@ COPY ubuntu-apt.lock /licenses/ubuntu-apt.lock
 ADD --checksum=sha256:6077d27c6b6f8b23590cb01ff877ed8c804a67a5442cc32b5a33da10d2bd0e90 https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260601~26.04.1_all.deb /tmp/ca-certificates.deb
 
 ARG DAPPER_HOST_ARCH=amd64
-ARG GO_VERSION=1.27.2
-ARG GO_SHA256_amd64=ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5
-ARG GO_SHA256_arm=e25a174051d8675f87ac720aedcd25bf89ac652c4b82f26aa47919524725ed95
+ARG GO_VERSION=1.27.3
+ARG GO_SHA256_amd64=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40
+ARG GO_SHA256_arm=d6f4e11dd7157030d7ac11c51c8f73201a2db932d593c3106b1da11cc32bfdf8
 ARG DOCKER_VERSION=29.7.2
 ARG DOCKER_SHA256_amd64=803d433f226db4776e1768fd319fc6c6e4935a456acf84fcc0080818b854bc8f
 ARG DOCKER_SHA256_arm=e9d0ba1b419d0c7a83ecec33c4c1ca8ac1e4f36b41c7254d5a816f766f106a59
diff --git a/README.md b/README.md
index df69e15..1fff40b 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ PastureStack is an independent community effort to preserve, audit, and moderniz
 
 ## Capabilities
 
-The source package version is `0.23.15`. Target-bound API Key tickets require exact target, operation, revision, expiry, and ticket digest matches from the trusted Engine. Handshake and periodic live checks fail closed. Persistent console secrets cannot extend an expired or revoked ticket; revocation also clears replay data. Legacy and full-without-expiry token authentication remains unchanged.
+The source package version is `0.23.16`, rebuilt with Go 1.27.3 for the crypto/x509 fix CVE-2026-111943. Target-bound API Key tickets require exact target, operation, revision, expiry, and ticket digest matches from the trusted Engine. Handshake and periodic live checks fail closed. Persistent console secrets cannot extend an expired or revoked ticket; revocation also clears replay data. Legacy and full-without-expiry token authentication remains unchanged.
 
 Every verified API Key stream requires an authenticated Host API `0.38.5` connection declaring `key-audit-v1,key-delegation-v1`. Missing capabilities prevent forwarding any execution payload. The Proxy submits only the signed stream ticket and that connection's signed backend ticket to the Engine's fixed audit-only failure endpoint; it returns `BackendAuditCapabilityUnavailable` (503) only after durable acceptance, or `AuditUnavailable` (503) when evidence cannot be accepted. Ordinary non-Key streams do not gain this capability requirement.
 
@@ -34,7 +34,7 @@ retention, and total sessions are bounded.
 
 ## Build and test
 
-From a Docker-capable Linux host, the checksum-pinned builder uses Go `1.27.2`:
+From a Docker-capable Linux host, the checksum-pinned builder uses Go `1.27.3`:
 
 ```sh
 make test
@@ -42,9 +42,9 @@ make build
 make package
 ```
 
-The default producer version is `0.23.15`; `VERSION_OVERRIDE` accepts only numeric semantic versions. Packaging
+The default producer version is `0.23.16`; `VERSION_OVERRIDE` accepts only numeric semantic versions. Packaging
 rejects brand or maintenance suffixes and produces the deterministic,
-versioned `websocket-proxy-0.23.15-linux-amd64.tar.xz` asset. Install it with the matching official Engine and host-api package; scoped stream protection cannot be provided by replacing the proxy alone. Package publication and deployment are explicit operations.
+versioned `websocket-proxy-0.23.16-linux-amd64.tar.xz` asset. Install it with the matching official Engine and host-api package; scoped stream protection cannot be provided by replacing the proxy alone. Package publication and deployment are explicit operations.
 
 See [COMPATIBILITY.md](COMPATIBILITY.md), [SECURITY.md](SECURITY.md), and [ORIGIN.md](ORIGIN.md).
 
diff --git a/scripts/validate b/scripts/validate
index 27feb8e..61bc112 100755
--- a/scripts/validate
+++ b/scripts/validate
@@ -30,7 +30,7 @@ if [ "${#maintained_go_files[@]}" -gt 0 ]; then
 fi
 
 echo Running: version and dependency policy
-test "$(VERSION_OVERRIDE=v0.23.15 bash -c 'source scripts/version; printf %s "$VERSION"')" = "0.23.15"
+test "$(VERSION_OVERRIDE=v0.23.16 bash -c 'source scripts/version; printf %s "$VERSION"')" = "0.23.16"
 if VERSION_OVERRIDE=v0.23.12-maintenance.1 bash -c 'source scripts/version' >/dev/null 2>&1; then
     echo "non-numeric version suffix was accepted" >&2
     exit 1
@@ -89,7 +89,9 @@ fi
 
 echo Running: reproducible builder and release-gate policy
 grep -Fx 'FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b' Dockerfile.dapper >/dev/null
-grep -Fx 'ARG GO_VERSION=1.27.2' Dockerfile.dapper >/dev/null
+grep -Fx 'ARG GO_VERSION=1.27.3' Dockerfile.dapper >/dev/null
+test "$(go env GOVERSION)" = go1.27.3
+test "$(go version bin/websocket-proxy | awk '{print $2}')" = go1.27.3
 grep -Fx 'ARG DOCKER_VERSION=29.7.2' Dockerfile.dapper >/dev/null
 grep -Fx "UBUNTU_APT_SNAPSHOT='20260808T000000Z'" ubuntu-apt.lock >/dev/null
 
diff --git a/scripts/version b/scripts/version
index 0084017..00935e5 100755
--- a/scripts/version
+++ b/scripts/version
@@ -12,5 +12,5 @@ if [ -n "${VERSION_OVERRIDE:-}" ]; then
 	fi
 	VERSION=${VERSION_OVERRIDE#v}
 else
-	VERSION="0.23.15"
+	VERSION="0.23.16"
 fi