diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 84e5023..62bad6c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,7 +15,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v7
         with:
-          go-version: '1.25'
+          go-version: '1.27.2'
       - name: Build
         run: go build ./...
       - name: Vet
@@ -40,7 +40,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v7
         with:
-          go-version: '1.25'
+          go-version: '1.27.2'
       - uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.11.2
+          version: v2.14.0
diff --git a/CHANGELOG.md b/CHANGELOG.md
index fabf4c0..e8cf448 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,12 @@ mistaken for a safe patch upgrade.
 
 ## [Unreleased]
 
+### Breaking
+
+- The module now requires **Go 1.27.2** (was 1.25). Consumers on an older Go
+  toolchain must upgrade, and `go mod tidy` will raise their own `go` directive
+  to at least 1.27.2.
+
 ### Added
 
 - `distribution`: Metadata 2.5 (PEP 794) and 2.6 (PEP 808) are now recognized.
diff --git a/CLAUDE.md b/CLAUDE.md
index 4861501..e585754 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -32,7 +32,7 @@ go test ./...
 go vet ./...
 ```
 
-Module floor is **Go 1.25** (conservative for a public library; PPM consumes it fine at 1.26).
+Module floor is **Go 1.27.2**; downstream consumers (including PPM) must be on Go ≥ 1.27.2.
 
 ## Property tests (`internal/proptest/`)
 
@@ -78,7 +78,7 @@ reproducible from the printed output.
 ### Verify lint matches CI before claiming "lint clean"
 
 CI runs `golangci-lint` via `golangci/golangci-lint-action@v9` (pinned to golangci-lint
-**v2.11.2**). Reproduce it exactly from the repo root:
+**v2.14.0**). Reproduce it exactly from the repo root:
 
 ```bash
 golangci-lint config verify   # config must load (see the v2 note below)
diff --git a/distribution/internal/distributions/distribution.go b/distribution/internal/distributions/distribution.go
index 2046577..7621880 100644
--- a/distribution/internal/distributions/distribution.go
+++ b/distribution/internal/distributions/distribution.go
@@ -332,11 +332,11 @@ func StructToMap(input interface{}) map[string][]string {
 	result := make(map[string][]string)
 
 	v := reflect.ValueOf(input)
-	if v.Kind() == reflect.Ptr {
+	if v.Kind() == reflect.Pointer {
 		v = v.Elem()
 	}
 	t := reflect.TypeOf(input)
-	if t.Kind() == reflect.Ptr {
+	if t.Kind() == reflect.Pointer {
 		t = t.Elem()
 	}
 
diff --git a/go.mod b/go.mod
index 099178d..23fae85 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/posit-dev/go-python-packaging
 
-go 1.25.0
+go 1.27.2
 
 require (
 	github.com/bradleyjkemp/cupaloy v2.3.0+incompatible
@@ -8,8 +8,8 @@ require (
 	github.com/rstudio/go-version v0.0.2
 	github.com/samber/lo v1.53.0
 	github.com/stretchr/testify v1.12.1
-	golang.org/x/crypto v0.55.0
-	golang.org/x/text v0.41.0
+	golang.org/x/crypto v0.58.0
+	golang.org/x/text v0.43.0
 	pgregory.net/rapid v1.3.0
 )
 
@@ -17,5 +17,5 @@ require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
diff --git a/go.sum b/go.sum
index 65f1e0e..5e8fe8e 100644
--- a/go.sum
+++ b/go.sum
@@ -14,11 +14,11 @@ github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWD
 github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
 pgregory.net/rapid v1.3.0 h1:vBvO0VSqti75J1jjYqpgPNBLKMd1+gxa9fYo7vk/Exc=
 pgregory.net/rapid v1.3.0/go.mod h1:dPlE4OBBxgXPqkP79flB6sJL1dx5azpI7HQ9MY9Z7uk=