diff --git a/.github/workflows/boulder-ci.yml b/.github/workflows/boulder-ci.yml
index 2d031843b0d..83b33369088 100644
--- a/.github/workflows/boulder-ci.yml
+++ b/.github/workflows/boulder-ci.yml
@@ -36,7 +36,7 @@ jobs:
       matrix:
         # Add additional docker image tags here and all tests will be run with the additional image.
         BOULDER_TOOLS_TAG:
-          - go1.26.6_2026-08-21
+          - go1.26.6_2026-08-25
         # Tests command definitions. Use the entire "docker compose" command you want to run.
         tests:
           # Run ./test.sh --help for a description of each of the flags.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 14c1e24ebee..351802c4225 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,6 +36,7 @@ jobs:
       matrix:
         GO_VERSION:
           - "1.26.6"
+          - "1.27.0"
     runs-on: ubuntu-24.04
     permissions:
       contents: write
diff --git a/.github/workflows/try-release.yml b/.github/workflows/try-release.yml
index cad7610373a..bd4a890f6b0 100644
--- a/.github/workflows/try-release.yml
+++ b/.github/workflows/try-release.yml
@@ -21,6 +21,7 @@ jobs:
       matrix:
         GO_VERSION:
           - "1.26.6"
+          - "1.27.0"
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
diff --git a/docker-compose.yml b/docker-compose.yml
index e9076b8a3f6..8eac674c66f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -8,7 +8,7 @@ services:
       context: test/boulder-tools/
       # Should match one of the GO_CI_VERSIONS in test/boulder-tools/tag_and_upload.sh.
       args:
-        GO_VERSION: 1.26.6
+        GO_VERSION: 1.27.0
     environment:
       # To solve HTTP-01 and TLS-ALPN-01 challenges, change the IP in FAKE_DNS
       # to the IP address where your ACME client's solver is listening. This is
diff --git a/test/boulder-tools/tag_and_upload.sh b/test/boulder-tools/tag_and_upload.sh
index ddac635e592..d714f284bee 100755
--- a/test/boulder-tools/tag_and_upload.sh
+++ b/test/boulder-tools/tag_and_upload.sh
@@ -12,7 +12,7 @@ DOCKER_REPO="letsencrypt/boulder-tools"
 # .github/workflows/release.yml,
 # .github/workflows/try-release.yml if appropriate,
 # and .github/workflows/boulder-ci.yml with the new container tag.
-GO_CI_VERSIONS=( "1.26.6" )
+GO_CI_VERSIONS=( "1.26.6" "1.27.0" )
 
 echo "Please login to allow push to DockerHub"
 docker login
diff --git a/test/config/mtca.json b/test/config/mtca.json
new file mode 100644
index 00000000000..29b3ab723e8
--- /dev/null
+++ b/test/config/mtca.json
@@ -0,0 +1,82 @@
+{
+	"mtca": {
+		"logID": {
+			"caID": "44947.4.1",
+			"logNumber": 44
+		},
+		"sequencingPeriod": "100ms",
+		"db": {
+			"dbConnectFile": "test/secrets/mtca1_dburl"
+		},
+		"s3": {
+			"s3endpoint": "http://boulder-minio:9000",
+			"s3bucket": "boulder-mtc-tiles",
+			"awsConfigFile": "test/config-next/mtca-s3-config.ini",
+			"awsCredsFile": "test/secrets/mtca-s3-creds.ini"
+		},
+		"tls": {
+			"caCertFile": "test/certs/ipki/minica.pem",
+			"certFile": "test/certs/ipki/mtca.boulder/cert.pem",
+			"keyFile": "test/certs/ipki/mtca.boulder/key.pem"
+		},
+		"grpcMTCA": {
+			"maxConnectionAge": "30s",
+			"services": {
+				"mtca.MTCA": {
+					"clientNames": [
+						"ra.boulder"
+					]
+				},
+				"grpc.health.v1.Health": {
+					"clientNames": [
+						"health-checker.boulder"
+					]
+				}
+			}
+		},
+		"issuance": {
+			"certProfiles": {
+				"mtcshortlived": {
+					"mtc": true,
+					"omitCommonName": true,
+					"omitKeyEncipherment": true,
+					"omitSKID": true,
+					"maxValidityPeriod": "160h",
+					"maxValidityBackdate": "1h5m",
+					"maxCertificateSize": 10000,
+					"lintConfig": "test/config-next/zlint.toml",
+					"ignoredLints": [
+						"e_pkimetal_lint_cabf_serverauth_cert",
+						"e_signature_algorithm_not_supported",
+						"e_ext_authority_key_identifier_no_key_identifier",
+						"w_ext_subject_key_identifier_missing_sub_cert",
+						"w_ct_sct_policy_count_unsatisfied",
+						"e_subscriber_server_certificate_matches_cps_profile"
+					]
+				}
+			},
+			"issuers": [
+				{
+					"profiles": [
+						"mtcshortlived"
+					],
+					"crlShards": 10,
+					"issuerURL": "http://ignored.letsencrypt.org",
+					"crlURLBase": "http://ignored.letsencrypt.org/",
+					"location": {
+						"file": "test/certs/mtpki/mtca1.key.pem",
+						"certFile": "test/certs/mtpki/mtca1.cert.pem"
+					}
+				}
+			]
+		}
+	},
+	"syslog": {
+		"stdoutlevel": 6,
+		"sysloglevel": -1
+	},
+	"openTelemetry": {
+		"endpoint": "bjaeger:4317",
+		"sampleratio": 1
+	}
+}