diff --git a/.github/workflows/version_cross_checks.yml b/.github/workflows/version_cross_checks.yml
new file mode 100644
index 0000000..d021d52
--- /dev/null
+++ b/.github/workflows/version_cross_checks.yml
@@ -0,0 +1,20 @@
+name: version_cross_checks
+permissions:
+  contents: read
+on:
+  pull_request:
+  push:
+    branches:
+      - "main"
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v7
+    - uses: actions/setup-go@v7
+      with:
+        go-version: "oldstable"
+
+    # fails if go.mod, Dockerfile, app.yaml, and cloudbuild.yaml are not in sync
+    - run: ./scripts/go_version_consistency.bash
diff --git a/Dockerfile b/Dockerfile
index 31e0877..0024ba6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Build stage.
-FROM golang:1.25-alpine as builder
+FROM golang:1.26-alpine as builder
 RUN apk add --no-cache git
 WORKDIR /go/src/m-lab/autojoin
 COPY . .
diff --git a/app.yaml b/app.yaml
index 10216b6..6953f00 100644
--- a/app.yaml
+++ b/app.yaml
@@ -4,7 +4,7 @@ service: autojoin
 
 runtime_config:
   operating_system: "ubuntu22"
-  runtime_version: "1.25"
+  runtime_version: "1.26"
 
 endpoints_api_service:
   name: autojoin-dot-{{PROJECT_ID}}.appspot.com
diff --git a/cloudbuild.yaml b/cloudbuild.yaml
index 66a746d..d8e526c 100644
--- a/cloudbuild.yaml
+++ b/cloudbuild.yaml
@@ -7,7 +7,7 @@ options:
 
 steps:
 # Run unit tests for environment.
-- name: golang:1.25-alpine
+- name: golang:1.26-alpine
   entrypoint: sh
   args:
   - -c
diff --git a/scripts/go_version_consistency.bash b/scripts/go_version_consistency.bash
new file mode 100755
index 0000000..24a5c36
--- /dev/null
+++ b/scripts/go_version_consistency.bash
@@ -0,0 +1,25 @@
+#!/bin/bash
+set -euo pipefail
+
+go_major_minor="$(go mod edit -json | jq -r .Go | awk -F. '{print $1"."$2}')"
+
+expect_alpine="golang:${go_major_minor}-alpine"
+expect_gae="runtime_version: \"${go_major_minor}\""
+
+exit_code=0
+if ! grep -qF "$expect_alpine" Dockerfile; then
+	echo "ERROR: Dockerfile is not using '$expect_alpine'; please fix it."
+	exit_code=1
+fi
+
+if ! grep -qF "$expect_gae" app.yaml; then
+	echo "ERROR: app.yaml is not using '$expect_gae'; please fix it."
+	exit_code=1
+fi
+
+if ! grep -qF "$expect_alpine" cloudbuild.yaml; then
+	echo "ERROR: cloudbuild.yaml is not using '$expect_alpine'; please fix it."
+	exit_code=1
+fi
+
+exit "${exit_code}"