diff --git a/.github/workflows/ci-outpost.yml b/.github/workflows/ci-outpost.yml
index d12b017be1d2..52a6ae5d810d 100644
--- a/.github/workflows/ci-outpost.yml
+++ b/.github/workflows/ci-outpost.yml
@@ -38,11 +38,6 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v8
         with:
-          # latest (v2.13.0) bundles honnef.co/go/tools v0.8.0-rc.1, whose nilness
-          # analyzer panics on getsentry/sentry-go ("unhandled builtin recover",
-          # https://github.com/dominikh/go-tools/issues/1725). Unpin once a
-          # release with the fix ships.
-          version: v2.12.2
           args: --timeout 5000s --verbose
           skip-cache: true
   test-unittest:
diff --git a/go.mod b/go.mod
index 365c484779d5..73ffa02ac9c3 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module goauthentik.io
 
-go 1.26.0
+go 1.27.0
 
 require (
 	beryju.io/ldap v0.2.2
diff --git a/internal/utils/tls.go b/internal/utils/tls.go
index fc55dccd7de4..29af98d0e960 100644
--- a/internal/utils/tls.go
+++ b/internal/utils/tls.go
@@ -7,7 +7,7 @@ import (
 
 func GetTLSConfig() *tls.Config {
 	// Based on
-	// https://ssl-config.mozilla.org/#server=go&version=1.25&config=intermediate&guideline=5.7
+	// https://configurator.tlsref.org/#server=go&version=1.27&config=intermediate&hsts&guideline=6.0
 	tlsConfig := &tls.Config{
 		MinVersion: tls.VersionTLS12,
 		CurvePreferences: []tls.CurveID{
@@ -15,8 +15,7 @@ func GetTLSConfig() *tls.Config {
 			tls.CurveP256,
 			tls.CurveP384,
 		},
-		PreferServerCipherSuites: true,
-		CipherSuites:             []uint16{},
+		CipherSuites: []uint16{},
 	}
 
 	excludedCiphers := []uint16{