diff --git a/go.mod b/go.mod
index 16a4dcd..9d0691c 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,8 @@
 module github.com/DefinedNet/dnapi
 
-go 1.26.0
+// 1.26.3+ required: earlier point releases fail every TLS handshake under
+// fips140=only, generating the default X25519MLKEM768 key share (golang/go#78372)
+go 1.26.3
 
 require (
 	github.com/slackhq/nebula v1.11.0