diff --git a/.execs/validate.flow b/.execs/validate.flow
index c9c88b49..b78d136d 100644
--- a/.execs/validate.flow
+++ b/.execs/validate.flow
@@ -95,7 +95,10 @@ executables:
         fi
 
         if [ "${CI:-}" = "true" ]; then
-          govulncheck -format sarif ./... > govuln.sarif
+          # govulncheck can list the same call stack twice for a finding, and upload-sarif rejects
+          # duplicate stacks.
+          govulncheck -format sarif ./... \
+            | jq '.runs[].results[] |= (if .stacks then .stacks |= unique else . end)' > govuln.sarif
           echo "Security scan completed. Results saved to govuln.sarif"
         else
           govulncheck ./...
diff --git a/go.mod b/go.mod
index b3cb8e82..b3f502db 100644
--- a/go.mod
+++ b/go.mod
@@ -2,7 +2,7 @@ module github.com/flowexec/flow/v2
 
 go 1.26.0
 
-toolchain go1.26.8
+toolchain go1.26.9
 
 require (
 	charm.land/bubbletea/v2 v2.0.10