diff --git a/compose.yaml b/compose.yaml
index 1c199aa..b331c8b 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -15,7 +15,7 @@
 # supported Go with: GO_VERSION=1.22 docker compose run --rm test
 
 x-go: &go
-  image: golang:${GO_VERSION:-1.26.4}
+  image: golang:${GO_VERSION:-1.27.1}
   working_dir: /app
   volumes:
     - .:/app
diff --git a/renovate.json b/renovate.json
index 5db72dd..c613c8c 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,5 +1,18 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "customManagers": [
+    {
+      "customType": "regex",
+      "datasourceTemplate": "docker",
+      "description": "compose.yaml's Go, which the shell default hides from the docker-compose manager",
+      "managerFilePatterns": [
+        "/^compose\\.yaml$/"
+      ],
+      "matchStrings": [
+        "image: (?<depName>golang):\\$\\{GO_VERSION:-(?<currentValue>[^}]+)\\}"
+      ]
+    }
+  ],
   "extends": [
     "config:recommended"
   ]
diff --git a/todo.md b/todo.md
index 3a813b5..b323736 100644
--- a/todo.md
+++ b/todo.md
@@ -247,5 +247,10 @@ because pairing a street with its exact postnummer rewrites shipped rows.
   `x-go` anchor a `user:` — that one needs a mechanism, since Compose interpolates from
   the process environment and neither `UID` nor `GID` is exported there, so
   `user: "${UID}:${GID}"` resolves to `":"`.
+- Spell the latest supported Go once: `Dockerfile`'s `ARG GO_VERSION` and
+  `compose.yaml`'s `golang:${GO_VERSION:-…}` pin one version twice, and a bump that
+  moved only the first left `docker compose run --rm fmt` formatting to a `gofmt` the
+  gate rejects. A `renovate.json` custom manager reads the second today; drop it with
+  the duplication.
 - Publish a homepage with an in-browser generator: the library compiled to WebAssembly,
   so visitors generate as much data as they like in their own browser.