diff --git a/.github/workflows/package-rpm.yml b/.github/workflows/package-rpm.yml
index 27e5257..54a2213 100644
--- a/.github/workflows/package-rpm.yml
+++ b/.github/workflows/package-rpm.yml
@@ -60,7 +60,7 @@ jobs:
           rpmbuild -ba "${HOME}/rpmbuild/SPECS/dnsplane.spec" \
             --define "dnsplane_base ${DNSPLANE_VERSION_BASE}" \
             --define "dnsplane_short ${DNSPLANE_GIT_SHORT}" \
-            --define "dnsplane_go_min ${DNSPLANE_GO_MOD}"
+            --define "dnsplane_go_min ${DNSPLANE_GO_RPM_MIN}"
           mkdir -p "${GITHUB_WORKSPACE}/rpm-artifacts"
           shopt -s nullglob
           for f in "${HOME}/rpmbuild/RPMS"/*/*.rpm "${HOME}/rpmbuild/SRPMS"/*.src.rpm; do
diff --git a/packaging/README.md b/packaging/README.md
index 31995ec..2133032 100644
--- a/packaging/README.md
+++ b/packaging/README.md
@@ -9,7 +9,8 @@
 | `DNSPLANE_VERSION_BASE` | `1.4.175` | Semver core from the latest matching `v*.*.*` tag on `HEAD` when `.git` exists (suffixes after `X.Y.Z` ignored, e.g. `v1.4.175-rc1` → `1.4.175`); else `GITHUB_REF_NAME` when it looks like `vX.Y.Z` (CI tag builds without `.git`); else [VERSION](../VERSION); else `0.0.0` |
 | `DNSPLANE_GIT_SHORT` | `d977f1b` | `GITHUB_SHA` (first 7) in Actions when `.git` is absent; else `git rev-parse --short=7 HEAD`; else `unknown` |
 | `DNSPLANE_VERSION_FULL` | `1.4.175-d977f1b` | Embedded in the binary (`main.appVersion`) and shown in `%description` / docs |
-| `DNSPLANE_GO_MOD` | `1.26.2` | From `go.mod` (`toolchain` line if set, else `go`); passed to `rpmbuild` as `dnsplane_go_min` |
+| `DNSPLANE_GO_MOD` | `1.26.2` | Exact Go version from `go.mod` (`toolchain` line if set, else `go`) |
+| `DNSPLANE_GO_RPM_MIN` | `1.26` | RPM dependency floor derived from `DNSPLANE_GO_MOD` (`major.minor`) for `rpmbuild --define dnsplane_go_min` |
 
 Usage:
 
@@ -17,7 +18,7 @@ Usage:
 eval "$(./packaging/version.sh export)"
 echo "$DNSPLANE_VERSION_FULL"
 ./packaging/version.sh full   # print FULL only
-./packaging/version.sh go     # print go.mod Go version (for rpmbuild --define dnsplane_go_min)
+./packaging/version.sh go     # print exact go.mod Go version
 ```
 
 **RPM:** `Version` is `BASE`; `Release` is `1.SHORTSHA%{?dist}` so the NEVRA is policy-friendly while humans still see `FULL` in the description.
@@ -46,12 +47,12 @@ cp packaging/dnsplane.spec ~/rpmbuild/SPECS/
 rpmbuild -ba ~/rpmbuild/SPECS/dnsplane.spec \
   --define "dnsplane_base ${DNSPLANE_VERSION_BASE}" \
   --define "dnsplane_short ${DNSPLANE_GIT_SHORT}" \
-  --define "dnsplane_go_min ${DNSPLANE_GO_MOD}"
+  --define "dnsplane_go_min ${DNSPLANE_GO_RPM_MIN}"
 ```
 
 Artifacts under `~/rpmbuild/RPMS/` and `~/rpmbuild/SRPMS/`.
 
-**RHEL / Rocky / Alma:** `BuildRequires` uses `dnsplane_go_min` from `go.mod` (see `version.sh go`). If the distro’s `golang` RPM is older than that (common on EL9), install a newer `golang` package (module stream, COPR, or vendor Go) so `rpm` dependency checks pass; the compiler on `PATH` must still satisfy `go.mod` / `toolchain`.
+**RHEL / Rocky / Alma:** `BuildRequires` uses `dnsplane_go_min` (`major.minor` floor from `version.sh export`). If the distro’s `golang` RPM is older than that (common on EL9), install a newer `golang` package (module stream, COPR, or vendor Go). The compiler on `PATH` must still satisfy the exact `go.mod` / `toolchain` version.
 
 ## Debian / Ubuntu
 
diff --git a/packaging/dnsplane.spec b/packaging/dnsplane.spec
index 1e011e5..febd0d5 100644
--- a/packaging/dnsplane.spec
+++ b/packaging/dnsplane.spec
@@ -14,8 +14,9 @@ License:        GPL-2.0-only
 URL:            https://github.com/network-plane/dnsplane
 Source0:        %{name}-%{version}.tar.gz
 
-# Minimum Go: must match go.mod (toolchain or "go" line). CI passes --define dnsplane_go_min from packaging/version.sh go.
-%{!?dnsplane_go_min:%global dnsplane_go_min 1.26.2}
+# Minimum Go package version for RPM dependency checks.
+# CI passes --define dnsplane_go_min from packaging/version.sh (major.minor floor).
+%{!?dnsplane_go_min:%global dnsplane_go_min 1.26}
 BuildRequires:  golang >= %{dnsplane_go_min}
 BuildRequires:  git
 BuildRequires:  systemd-rpm-macros
diff --git a/packaging/version.sh b/packaging/version.sh
index 655daf9..82ae083 100755
--- a/packaging/version.sh
+++ b/packaging/version.sh
@@ -26,6 +26,20 @@ go_mod_go_version() {
 	' "$ROOT/go.mod"
 }
 
+# RPM package repos typically provide Go at major.minor granularity.
+# Convert go.mod version (e.g. 1.26.2) to 1.26 for BuildRequires.
+go_rpm_min_version() {
+	local v="$1"
+	awk -v ver="$v" 'BEGIN {
+		n = split(ver, a, ".")
+		if (n < 2) {
+			print "invalid go version: " ver > "/dev/stderr"
+			exit 1
+		}
+		print a[1] "." a[2]
+	}'
+}
+
 short_sha() {
 	# GitHub Actions container checkouts often have no .git; use workflow commit SHA.
 	if [[ -n "${GITHUB_SHA:-}" ]] && [[ "${#GITHUB_SHA}" -ge 7 ]]; then
@@ -78,6 +92,7 @@ SHORTSHA="$(short_sha)"
 BASE="$(base_version)"
 FULL="${BASE}-${SHORTSHA}"
 GO_MOD="$(go_mod_go_version)"
+GO_RPM_MIN="$(go_rpm_min_version "$GO_MOD")"
 
 cmd="${1:-export}"
 case "$cmd" in
@@ -86,6 +101,7 @@ export)
 	printf "export DNSPLANE_GIT_SHORT=%q\n" "$SHORTSHA"
 	printf "export DNSPLANE_VERSION_FULL=%q\n" "$FULL"
 	printf "export DNSPLANE_GO_MOD=%q\n" "$GO_MOD"
+	printf "export DNSPLANE_GO_RPM_MIN=%q\n" "$GO_RPM_MIN"
 	;;
 base) echo "$BASE" ;;
 short | sha) echo "$SHORTSHA" ;;