diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e9d363c4..0ac04b26 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,7 +14,7 @@ jobs:
 
       - uses: actions/setup-go@v7
         with:
-          go-version: '1.26'
+          go-version: '1.27'
           check-latest: true
 
       - name: Build
@@ -40,7 +40,7 @@ jobs:
 
       - uses: actions/setup-go@v7
         with:
-          go-version: '1.26'
+          go-version: '1.27'
           check-latest: true
 
       - name: Build
@@ -83,7 +83,7 @@ jobs:
 
       - uses: actions/setup-go@v7
         with:
-          go-version: '1.26'
+          go-version: '1.27'
           check-latest: true
 
       # GitHub holds ARNs, not credentials, and ARNs outlive a rotation
diff --git a/.github/workflows/smoke-extra.yml b/.github/workflows/smoke-extra.yml
index 8a388f9f..de59a74f 100644
--- a/.github/workflows/smoke-extra.yml
+++ b/.github/workflows/smoke-extra.yml
@@ -34,7 +34,7 @@ jobs:
 
     - uses: actions/setup-go@v7
       with:
-        go-version: '1.26'
+        go-version: '1.27'
         check-latest: true
 
     - name: add hashicorp source
@@ -66,7 +66,7 @@ jobs:
 
     - uses: actions/setup-go@v7
       with:
-        go-version: '1.26'
+        go-version: '1.27'
         check-latest: true
 
     - name: add hashicorp source
@@ -92,7 +92,7 @@ jobs:
 
     - uses: actions/setup-go@v7
       with:
-        go-version: '1.26'
+        go-version: '1.27'
         check-latest: true
 
     # WSL2 + Ubuntu so the smoke can run a real linux peer with its own
diff --git a/.github/workflows/smoke.yml b/.github/workflows/smoke.yml
index 4937d53c..68f69b87 100644
--- a/.github/workflows/smoke.yml
+++ b/.github/workflows/smoke.yml
@@ -22,7 +22,7 @@ jobs:
 
     - uses: actions/setup-go@v7
       with:
-        go-version: '1.26'
+        go-version: '1.27'
         check-latest: true
 
     - name: Smoke Docker
@@ -51,7 +51,7 @@ jobs:
 
     - uses: actions/setup-go@v7
       with:
-        go-version: '1.26'
+        go-version: '1.27'
         check-latest: true
 
     - name: build
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 6bde71e8..679d5750 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -22,7 +22,7 @@ jobs:
 
     - uses: actions/setup-go@v7
       with:
-        go-version: '1.26'
+        go-version: '1.27'
         check-latest: true
 
     - name: Install goimports
@@ -87,7 +87,7 @@ jobs:
 
     - uses: actions/setup-go@v7
       with:
-        go-version: '1.26'
+        go-version: '1.27'
         check-latest: true
 
     - name: Build
@@ -132,7 +132,7 @@ jobs:
 
     - uses: actions/setup-go@v7
       with:
-        go-version: '1.26'
+        go-version: '1.27'
         check-latest: true
 
     - name: Build ${{ matrix.name }}
diff --git a/connection_state_test.go b/connection_state_test.go
index a946343d..34cf201a 100644
--- a/connection_state_test.go
+++ b/connection_state_test.go
@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/flynn/noise"
+	"github.com/DefinedNet/noise"
 	"github.com/rcrowley/go-metrics"
 	"github.com/slackhq/nebula/cert"
 	ct "github.com/slackhq/nebula/cert_test"
diff --git a/go.mod b/go.mod
index a110b8a2..e775d971 100644
--- a/go.mod
+++ b/go.mod
@@ -1,14 +1,14 @@
 module github.com/slackhq/nebula
 
-go 1.26.0
+go 1.27.0
 
 require (
 	dario.cat/mergo v1.0.2
 	filippo.io/bigmod v0.1.0
 	github.com/DefinedNet/netlink v1.3.2-dn.1
+	github.com/DefinedNet/noise v0.0.0-00010101000000-000000000000
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
 	github.com/armon/go-radix v1.0.0
-	github.com/flynn/noise v1.1.0
 	github.com/gaissmai/bart v0.29.0
 	github.com/gogo/protobuf v1.3.2
 	github.com/google/gopacket v1.1.19
@@ -47,3 +47,5 @@ require (
 	github.com/vishvananda/netns v0.0.5 // indirect
 	golang.org/x/time v0.5.0 // indirect
 )
+
+replace github.com/DefinedNet/noise => /home/jack/work/git/DefinedNet-noise
diff --git a/go.sum b/go.sum
index 78189af1..14c53a52 100644
--- a/go.sum
+++ b/go.sum
@@ -23,8 +23,6 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/flynn/noise v1.1.0 h1:KjPQoQCEFdZDiP03phOvGi11+SVVhBG2wOWAorLsstg=
-github.com/flynn/noise v1.1.0/go.mod h1:xbMo+0i6+IGbYdJhF31t2eR1BIU0CYc12+BNAKwUTag=
 github.com/gaissmai/bart v0.29.0 h1:wO6HGE8g9YE0Wm0bCpYxwRzfQ4+fbJKOhL64e5ACGCI=
 github.com/gaissmai/bart v0.29.0/go.mod h1:GREWQfTLRWz/c5FTOsIw+KkscuFkIV5t8Rp7Nd1Td5c=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
@@ -154,7 +152,6 @@ golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnf
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
 golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
@@ -170,7 +167,6 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
 golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -192,12 +188,10 @@ golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
 golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
 golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
diff --git a/handshake/credential.go b/handshake/credential.go
index d3342c99..2b47ce95 100644
--- a/handshake/credential.go
+++ b/handshake/credential.go
@@ -3,7 +3,7 @@ package handshake
 import (
 	"crypto/rand"
 
-	"github.com/flynn/noise"
+	"github.com/DefinedNet/noise"
 	"github.com/slackhq/nebula/cert"
 )
 
diff --git a/handshake/helpers_test.go b/handshake/helpers_test.go
index c72346cb..7799ab4c 100644
--- a/handshake/helpers_test.go
+++ b/handshake/helpers_test.go
@@ -5,7 +5,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/flynn/noise"
+	"github.com/DefinedNet/noise"
 	"github.com/slackhq/nebula/cert"
 	ct "github.com/slackhq/nebula/cert_test"
 	"github.com/slackhq/nebula/header"
diff --git a/handshake/kem_test.go b/handshake/kem_test.go
index f7a52af3..c4f40b05 100644
--- a/handshake/kem_test.go
+++ b/handshake/kem_test.go
@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/flynn/noise"
+	"github.com/DefinedNet/noise"
 	"github.com/slackhq/nebula/cert"
 	ct "github.com/slackhq/nebula/cert_test"
 	"github.com/slackhq/nebula/header"
diff --git a/handshake/machine.go b/handshake/machine.go
index 5214609e..0162ee70 100644
--- a/handshake/machine.go
+++ b/handshake/machine.go
@@ -8,7 +8,7 @@ import (
 	"slices"
 	"time"
 
-	"github.com/flynn/noise"
+	"github.com/DefinedNet/noise"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/header"
 )
diff --git a/handshake/machine_test.go b/handshake/machine_test.go
index 01c968ed..2105dbd4 100644
--- a/handshake/machine_test.go
+++ b/handshake/machine_test.go
@@ -5,7 +5,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/flynn/noise"
+	"github.com/DefinedNet/noise"
 	"github.com/slackhq/nebula/cert"
 	ct "github.com/slackhq/nebula/cert_test"
 	"github.com/slackhq/nebula/header"
diff --git a/handshake/patterns.go b/handshake/patterns.go
index 828a9338..34a900e0 100644
--- a/handshake/patterns.go
+++ b/handshake/patterns.go
@@ -3,7 +3,7 @@ package handshake
 import (
 	"fmt"
 
-	"github.com/flynn/noise"
+	"github.com/DefinedNet/noise"
 	"github.com/slackhq/nebula/header"
 )
 
diff --git a/handshake/patterns_test.go b/handshake/patterns_test.go
index d6207e00..92606c38 100644
--- a/handshake/patterns_test.go
+++ b/handshake/patterns_test.go
@@ -3,7 +3,7 @@ package handshake
 import (
 	"testing"
 
-	"github.com/flynn/noise"
+	"github.com/DefinedNet/noise"
 	"github.com/slackhq/nebula/header"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/noiseutil/aesgcm.go b/noiseutil/aesgcm.go
index cf035913..62832bb7 100644
--- a/noiseutil/aesgcm.go
+++ b/noiseutil/aesgcm.go
@@ -5,7 +5,7 @@ import (
 	"encoding/binary"
 	"errors"
 
-	"github.com/flynn/noise"
+	"github.com/DefinedNet/noise"
 )
 
 // CipherStateAESGCM is the data-plane wrapper for the AES-GCM AEAD cipher.
diff --git a/noiseutil/boring.go b/noiseutil/boring.go
index 9677ea95..c55bfb14 100644
--- a/noiseutil/boring.go
+++ b/noiseutil/boring.go
@@ -5,7 +5,7 @@ package noiseutil
 import (
 	"crypto/boring"
 
-	"github.com/flynn/noise"
+	"github.com/DefinedNet/noise"
 )
 
 var CipherAESGCM noise.CipherFunc = CipherAESGCMFIPS140
diff --git a/noiseutil/chachapoly.go b/noiseutil/chachapoly.go
index 2cec73a6..76336428 100644
--- a/noiseutil/chachapoly.go
+++ b/noiseutil/chachapoly.go
@@ -5,7 +5,7 @@ import (
 	"encoding/binary"
 	"errors"
 
-	"github.com/flynn/noise"
+	"github.com/DefinedNet/noise"
 )
 
 // CipherStateChaChaPoly is the data-plane wrapper for the ChaCha20-Poly1305 AEAD cipher.
diff --git a/noiseutil/cipher_state.go b/noiseutil/cipher_state.go
index 5f10d004..3e7b26c6 100644
--- a/noiseutil/cipher_state.go
+++ b/noiseutil/cipher_state.go
@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"math"
 
-	"github.com/flynn/noise"
+	"github.com/DefinedNet/noise"
 )
 
 // RejectHeadroom is the wrap gap for senders racing the counter, sized large enough for any routine count.
diff --git a/noiseutil/cipher_state_test.go b/noiseutil/cipher_state_test.go
index 1dd361f5..d928517e 100644
--- a/noiseutil/cipher_state_test.go
+++ b/noiseutil/cipher_state_test.go
@@ -5,7 +5,7 @@ import (
 	"math"
 	"testing"
 
-	"github.com/flynn/noise"
+	"github.com/DefinedNet/noise"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
diff --git a/noiseutil/fips140.go b/noiseutil/fips140.go
index 6666f548..1e640c2c 100644
--- a/noiseutil/fips140.go
+++ b/noiseutil/fips140.go
@@ -15,7 +15,7 @@ import (
 	_ "crypto/tls"
 	_ "unsafe"
 
-	"github.com/flynn/noise"
+	"github.com/DefinedNet/noise"
 )
 
 // TODO: Use NewGCMWithCounterNonce or NewGCMForQUIC once available:
diff --git a/noiseutil/nist.go b/noiseutil/nist.go
index 976a2742..676baeae 100644
--- a/noiseutil/nist.go
+++ b/noiseutil/nist.go
@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"io"
 
-	"github.com/flynn/noise"
+	"github.com/DefinedNet/noise"
 )
 
 // DHP256 is the NIST P-256 ECDH function
diff --git a/noiseutil/notboring.go b/noiseutil/notboring.go
index e8419d74..9364f456 100644
--- a/noiseutil/notboring.go
+++ b/noiseutil/notboring.go
@@ -5,7 +5,7 @@ package noiseutil
 import (
 	"crypto/fips140"
 
-	"github.com/flynn/noise"
+	"github.com/DefinedNet/noise"
 )
 
 // EncryptLockNeeded indicates if calls to Encrypt need a lock
diff --git a/noiseutil/pkcs11.go b/noiseutil/pkcs11.go
index d1c7ba91..bfee0cfa 100644
--- a/noiseutil/pkcs11.go
+++ b/noiseutil/pkcs11.go
@@ -7,7 +7,7 @@ import (
 
 	"github.com/slackhq/nebula/pkclient"
 
-	"github.com/flynn/noise"
+	"github.com/DefinedNet/noise"
 )
 
 // DHP256PKCS11 is the NIST P-256 ECDH function
diff --git a/pki.go b/pki.go
index 17efe7c1..67826116 100644
--- a/pki.go
+++ b/pki.go
@@ -16,7 +16,7 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/flynn/noise"
+	"github.com/DefinedNet/noise"
 	"github.com/gaissmai/bart"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/config"