diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 85169a8..539c64b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,29 +23,29 @@ jobs:
     timeout-minutes: 15
     strategy:
       matrix:
-        go-version: [1.25.x]
+        go-version: [1.26.x, 1.27.x]
         os: [ubuntu-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7.0.0
         with:
           go-version: ${{ matrix.go-version }}
           cache: true
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v9
+        uses: golangci/golangci-lint-action@v9.3.0
         with:
-          version: v2.7.2
+          version: v2.13.2
 
       - name: Build
         run: go build -v ./...
 
       - name: Run govulncheck
-        uses: golang/govulncheck-action@v1
+        uses: golang/govulncheck-action@v1.1.0
         with:
           go-version-input: ${{ matrix.go-version }}
 
diff --git a/decode.go b/decode.go
index 1e251b4..57d181b 100644
--- a/decode.go
+++ b/decode.go
@@ -487,6 +487,10 @@ func (m *msgpackDecoder) decode(s decodeStack) (err error) {
 	}
 
 	mask := func(b byte, m int) int64 {
+		// Validate m is within byte range to prevent overflow
+		if m < 0 || m > 255 {
+			return 0
+		}
 		return int64(b & byte(m))
 	}
 	makeFixedUint := func(b byte, m int) msgpackInt {
@@ -654,6 +658,7 @@ func (m *msgpackDecoder) decode(s decodeStack) (err error) {
 		if err != nil {
 			return err
 		}
+		//nolint:gosec // G115: Intentional byte to int8 conversion per msgpack spec
 		return m.produceInt(s, msgpackInt{typ: intTypeInt8, val: int64(int8(i))})
 
 	// int16
diff --git a/go.mod b/go.mod
index 7dd39c6..987965a 100644
--- a/go.mod
+++ b/go.mod
@@ -1,8 +1,8 @@
 module github.com/keybase/msgpackzip
 
-go 1.23
+go 1.26.0
 
-toolchain go1.25.5
+toolchain go1.27.1
 
 require github.com/stretchr/testify v1.11.1
 
diff --git a/output.go b/output.go
index 06f946c..f9a3128 100644
--- a/output.go
+++ b/output.go
@@ -72,12 +72,20 @@ func (o *outputter) outputPrefixAndBinaryInt(b byte, i any) error {
 func (o *outputter) outputContainerPrefix(i msgpackInt, fixed byte, numFixed byte, u8 byte, u16 byte, u32 byte) (err error) {
 	switch i.typ {
 	case intTypeFixedUint:
+		// Validate value fits in byte range
+		if i.val < 0 || i.val > 255 {
+			return errors.New("integer overflow: value out of range for fixed uint")
+		}
 		if fixed != 0x0 && byte(i.val) <= numFixed {
 			return o.outputByte(fixed | byte(i.val))
 		}
 		fallthrough
 	case intTypeUint8:
 		if u8 != 0x0 {
+			// Validate value fits in byte range
+			if i.val < 0 || i.val > 255 {
+				return errors.New("integer overflow: value out of range for uint8")
+			}
 			var b [2]byte
 			b[0] = u8
 			b[1] = byte(i.val)