diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8c3bf2c..0f09b92 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -46,6 +46,13 @@ jobs:
           go-version-file: go.mod
           check-latest: true
 
+      # Expose the resolved Go version as an env var so it is never
+      # interpolated directly into a shell script (avoids script injection).
+      - name: Export Go version
+        env:
+          GO_VERSION: ${{ steps.setup-go.outputs.go-version }}
+        run: echo "GO_VERSION=$GO_VERSION" >> "$GITHUB_ENV"
+
       - name: Install Task
         uses: go-task/setup-task@v1
 
@@ -66,7 +73,7 @@ jobs:
           {
             cat << EOF
           ## 🔧 Test Environment
-          - **Go Version:** ${{ steps.setup-go.outputs.go-version }}
+          - **Go Version:** $GO_VERSION
           - **OS:** ubuntu-latest
           - **Timestamp:** $(date -u)
 
@@ -86,7 +93,7 @@ jobs:
           # Generate test summary
           {
             cat << EOF
-          ## 🧪 Test Results (Go ${{ steps.setup-go.outputs.go-version }})
+          ## 🧪 Test Results (Go $GO_VERSION)
 
           | Metric      | Value                                                         |
           | ----------- | ------------------------------------------------------------- |
@@ -148,7 +155,7 @@ jobs:
 
             {
               cat << EOF
-          ## 📊 Code Coverage (Go ${{ steps.setup-go.outputs.go-version }})
+          ## 📊 Code Coverage (Go $GO_VERSION)
 
           **Total Coverage: $COVERAGE**
 
@@ -209,7 +216,7 @@ jobs:
         if: failure()
         uses: actions/upload-artifact@v6
         with:
-          name: test-results-go-${{ steps.setup-go.outputs.go-version }}
+          name: test-results-go-${{ env.GO_VERSION }}
           path: |
             test-output.log
             coverage/
@@ -219,7 +226,7 @@ jobs:
         run: |
           {
             cat << EOF
-          ## 🔍 Static Analysis (Go ${{ steps.setup-go.outputs.go-version }})
+          ## 🔍 Static Analysis (Go $GO_VERSION)
 
           EOF
 
@@ -263,9 +270,10 @@ jobs:
       - name: Job Summary
         if: always()
         run: |
-          cat >> "$GITHUB_STEP_SUMMARY" << 'EOF'
-          ## 📋 Job Summary (Go ${{ steps.setup-go.outputs.go-version }})
-
+          {
+            echo "## 📋 Job Summary (Go $GO_VERSION)"
+            echo ""
+            cat << 'EOF'
           | Step            | Status                                                          |
           | --------------- | --------------------------------------------------------------- |
           | Dependencies    | Success                                                         |
@@ -275,12 +283,13 @@ jobs:
           | Static Analysis | ${{ job.status == 'success' && 'Clean' || 'Issues' }}           |
           | Code Formatting | ${{ job.status == 'success' && 'Clean' || 'Issues' }}           |
           EOF
+          } >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload coverage reports to Codecov
         uses: codecov/codecov-action@v5
         with:
           files: ./coverage/coverage.out
-          flags: Go ${{ steps.setup-go.outputs.go-version }}
+          flags: Go ${{ env.GO_VERSION }}
           slug: kjanat/articulate-parser
           token: ${{ secrets.CODECOV_TOKEN }}
 
@@ -288,7 +297,7 @@ jobs:
         if: ${{ !cancelled() }}
         uses: codecov/test-results-action@v1
         with:
-          flags: Go ${{ steps.setup-go.outputs.go-version }}
+          flags: Go ${{ env.GO_VERSION }}
           token: ${{ secrets.CODECOV_TOKEN }}
 
   docker-test:
@@ -344,6 +353,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      pull-requests: write
     if: github.event_name == 'pull_request'
     steps:
       - name: "Checkout Repository"
diff --git a/.golangci.yml b/.golangci.yml
index f433de9..75daaba 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -8,10 +8,6 @@ run:
   # Timeout for total work
   timeout: 5m
 
-  # Skip directories (not allowed in config v2, will use issues exclude instead)
-
-  # Go version is autodetected from go.mod
-
   # Include test files
   tests: true
 
diff --git a/Taskfile.yml b/Taskfile.yml
index 8688825..682f003 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -266,10 +266,7 @@ tasks:
     silent: true
     aliases: [modern]
     cmds:
-      # The modernize analyzer (shipped with gopls) may require a newer Go
-      # toolchain than this project targets, so it is run with GOTOOLCHAIN=auto
-      # to let Go fetch the toolchain it needs on demand.
-      - GOTOOLCHAIN=auto go run golang.org/x/tools/gopls/internal/analysis/modernize/cmd/modernize@latest -fix -test ./...
+      - go run golang.org/x/tools/gopls/internal/analysis/modernize/cmd/modernize@latest -fix -test ./...
       - echo "Code modernized"
 
   # Dependency management
diff --git a/go.mod b/go.mod
index 285ba87..1e9cd08 100644
--- a/go.mod
+++ b/go.mod
@@ -1,8 +1,6 @@
 module github.com/kjanat/articulate-parser
 
-go 1.25.0
-
-toolchain go1.25.5
+go 1.26.0
 
 require (
 	github.com/fumiama/go-docx v0.0.0-20250506085032-0c30fd09304b
diff --git a/internal/exporters/output.docx b/internal/exporters/output.docx
index 3bc4c87..db1d20c 100644
Binary files a/internal/exporters/output.docx and b/internal/exporters/output.docx differ
diff --git a/internal/services/parser.go b/internal/services/parser.go
index 12bca80..a6a058c 100644
--- a/internal/services/parser.go
+++ b/internal/services/parser.go
@@ -17,10 +17,8 @@ import (
 
 // Default endpoint configuration for the Articulate Rise API.
 const (
-	// Root URL for the Articulate Rise API.
-	defaultBaseURL = "https://rise.articulate.com"
-	// Expected host for Articulate Rise share URLs.
-	riseHost = "rise.articulate.com"
+	riseHost       = "rise.articulate.com"
+	defaultBaseURL = "https://" + riseHost
 )
 
 // shareIDRegex is compiled once at package init for extracting share IDs from URIs.