diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 91d4726..89b91bf 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -20,3 +20,15 @@ repos:
     rev: v2.11.4
     hooks:
       - id: golangci-lint
+
+  - repo: local
+    hooks:
+      # Security: surface known stdlib/dependency CVEs before they land
+      # in a commit instead of failing later in CI's govulncheck job.
+      # Requires: go install golang.org/x/vuln/cmd/govulncheck@latest
+      - id: govulncheck
+        name: govulncheck
+        entry: govulncheck ./...
+        language: system
+        types: [go]
+        pass_filenames: false
diff --git a/go.mod b/go.mod
index 1c91be3..1fae99b 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,8 @@ module github.com/babs/mcp-auth-proxy
 
 go 1.26.3
 
+toolchain go1.26.4
+
 require (
 	github.com/alicebob/miniredis/v2 v2.37.0
 	github.com/coreos/go-oidc/v3 v3.18.0