diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 0b3524b9..f3b97e7d 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -39,7 +39,7 @@ jobs:
         run: go vet ./...
 
       - name: Govulncheck
-        run: go run golang.org/x/vuln/cmd/govulncheck@v1.1.4 ./...
+        run: go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 ./...
 
       - name: Unit tests
         run: go test ./... -count=1 -race -coverprofile=coverage.out
diff --git a/CHANGELOG.md b/CHANGELOG.md
index fb68a17c..ccff092a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -66,6 +66,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `Content-Type: application/json`, G118 on the drilldown field batcher
   goroutine that intentionally outlives a single request). The rationale is
   recorded next to the exclusion list in `security-pr.yaml`.
+- **CI: govulncheck v1.1.4 → v1.8.0.** v1.1.4 bundles `golang.org/x/tools`
+  v0.29.0, whose SSA builder panics (`unexpected expr: *ast.KeyValueExpr`) when
+  it has to build a call graph for code type-checked as Go 1.27. The panic only
+  fires once the vulnerability database matches something in the Linux module
+  graph, which is why the first Go 1.27 run passed and every later run on
+  `main` and on open PRs failed at the `Govulncheck` step. Reproduced locally
+  with `GOOS=linux`; v1.8.0 completes and reports no vulnerabilities.
 - **CI: pinned GitHub Actions SHAs bumped** (actions-minor group, 9 updates
   across the workflow files).
 - **CI changelog gate:** paths under `website/` are now treated as