diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ab21313..391f712 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,7 +13,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  GOLANGCI_LINT_VERSION: v2.13.2
+  GOLANGCI_LINT_VERSION: v2.14.0
   GOVULNCHECK_VERSION: v1.8.0
 
 jobs:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d5ffc9c..8247242 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,14 +8,24 @@ project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [1.0.1] - 2026-10-08
+
 ### Added
 
 - Attach the signed provenance of the image to each GitHub release, as `keymaker-X.Y.Z.intoto.jsonl`.
 
+### Changed
+
+- Refresh the route catalogues embedded for every region.
+
 ### Fixed
 
 - Wait the longest allowed when the API asks for a `Retry-After` of billions of seconds, rather than not at all: the delay overflowed.
 
+### Security
+
+- Build with Go 1.27.2, which fixes vulnerabilities in `crypto/tls`, `net/http`, `net/textproto` and `os`.
+
 ## [1.0.0] - 2026-10-04
 
 The first stable release. From here on, every 1.x release keeps what the Compatibility section of the README lists as it is, and the image gains the major tag `1`, which follows them.
@@ -182,7 +192,8 @@ First public release.
 - Harden response headers.
 - Redact the application secret and the consumer key from every log record.
 
-[Unreleased]: https://github.com/kentrow/keymaker/compare/v1.0.0...HEAD
+[Unreleased]: https://github.com/kentrow/keymaker/compare/v1.0.1...HEAD
+[1.0.1]: https://github.com/kentrow/keymaker/compare/v1.0.0...v1.0.1
 [1.0.0]: https://github.com/kentrow/keymaker/compare/v0.5.1...v1.0.0
 [0.5.1]: https://github.com/kentrow/keymaker/compare/v0.5.0...v0.5.1
 [0.5.0]: https://github.com/kentrow/keymaker/compare/v0.4.0...v0.5.0
diff --git a/Dockerfile b/Dockerfile
index 7c6980c..a1b04fb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,7 +2,7 @@
 
 # Base images are pinned by tag and digest: the tag says what the image is, the digest makes a
 # rebuild of an old commit produce the same image and keeps a scanner result attributable.
-FROM --platform=$BUILDPLATFORM golang:1.27.1-bookworm@sha256:69a7b9788769bec032d238959b61854e9ae87f57be9029ec04e9885fabf99195 AS build
+FROM --platform=$BUILDPLATFORM golang:1.27.2-bookworm@sha256:5cf287a799e6b94384bad13d16b14904c531f51ba65792237e122ce42b392f61 AS build
 
 WORKDIR /src
 
diff --git a/go.mod b/go.mod
index dad9a99..beef327 100644
--- a/go.mod
+++ b/go.mod
@@ -2,7 +2,7 @@ module github.com/kentrow/keymaker
 
 go 1.27.0
 
-toolchain go1.27.1
+toolchain go1.27.2
 
 require github.com/ovh/go-ovh v1.9.0
 
diff --git a/internal/catalog/snapshots/ovh-ca.json.gz b/internal/catalog/snapshots/ovh-ca.json.gz
index 15cb5fd..bd9e783 100644
Binary files a/internal/catalog/snapshots/ovh-ca.json.gz and b/internal/catalog/snapshots/ovh-ca.json.gz differ
diff --git a/internal/catalog/snapshots/ovh-eu.json.gz b/internal/catalog/snapshots/ovh-eu.json.gz
index 97aa22c..b269fd4 100644
Binary files a/internal/catalog/snapshots/ovh-eu.json.gz and b/internal/catalog/snapshots/ovh-eu.json.gz differ
diff --git a/internal/catalog/snapshots/ovh-us.json.gz b/internal/catalog/snapshots/ovh-us.json.gz
index 720e0d5..a031325 100644
Binary files a/internal/catalog/snapshots/ovh-us.json.gz and b/internal/catalog/snapshots/ovh-us.json.gz differ