diff --git a/.circleci/config.yml b/.circleci/config.yml
index 04f48112e9..535f67229a 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -13,7 +13,7 @@ jobs:
   build:
     parallelism: 8
     docker:
-      - image: cimg/go:1.25
+      - image: cimg/go:1.26.1
     steps:
       - checkout
 
@@ -37,7 +37,7 @@ jobs:
 
   report:
     docker:
-      - image: cimg/go:1.25
+      - image: cimg/go:1.26.1
     steps:
       - checkout
       - attach_workspace:
diff --git a/Dockerfile b/Dockerfile
index 91d6d50863..6fb34bf3c9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # golang alpine
-FROM golang:1.25.7-alpine AS builder
+FROM golang:1.26.1-alpine AS builder
 
 ARG TARGETARCH
 ARG TARGETOS
diff --git a/docs/pages/release_notes.rst b/docs/pages/release_notes.rst
index a61b86864a..e59e175ce5 100644
--- a/docs/pages/release_notes.rst
+++ b/docs/pages/release_notes.rst
@@ -3,6 +3,14 @@
 Release notes
 #############
 
+*************************
+Hazelnut update (v5.4.25)
+*************************
+
+Release date: 2026-03-15
+
+- Upgrade to Go 1.26.1 to fix GO-2026-4601, GO-2026-4602 and GO-2026-4603
+
 *************************
 Hazelnut update (v5.4.24)
 *************************
diff --git a/go.mod b/go.mod
index 09a513d702..d22d9504c1 100644
--- a/go.mod
+++ b/go.mod
@@ -2,7 +2,7 @@ module github.com/nuts-foundation/nuts-node
 
 // This is the minimal version, the actual go version is determined by the images in the Dockerfile
 // This version is used in automated tests such as the 'Scheduled govulncheck' action
-go 1.25.7
+go 1.26.1
 
 require (
 	github.com/alicebob/miniredis/v2 v2.33.0
diff --git a/http/requestlogger_test.go b/http/requestlogger_test.go
index 0b0afbd265..579f776726 100644
--- a/http/requestlogger_test.go
+++ b/http/requestlogger_test.go
@@ -21,6 +21,10 @@ package http
 import (
 	"bytes"
 	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
 	"github.com/labstack/echo/v4"
 	"github.com/nuts-foundation/nuts-node/core"
 	"github.com/nuts-foundation/nuts-node/mock"
@@ -28,9 +32,6 @@ import (
 	"github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/assert"
 	"go.uber.org/mock/gomock"
-	"net/http"
-	"net/http/httptest"
-	"testing"
 )
 
 func Test_requestLoggerMiddleware(t *testing.T) {
@@ -128,9 +129,9 @@ func Test_bodyLoggerMiddleware(t *testing.T) {
 		response := echo.NewResponse(responseRecorder, e)
 		response.Header().Set("Content-Type", "application/json")
 		echoMock := mock.NewMockContext(ctrl)
-		echoMock.EXPECT().NoContent(http.StatusNoContent).Do(func(status int) {
+		echoMock.EXPECT().String(gomock.Any(), gomock.Any()).Do(func(status int, data string) {
 			response.Status = status
-			response.Write([]byte(`"response"`))
+			response.Write([]byte(data))
 		})
 		echoMock.EXPECT().Request().MinTimes(1).Return(request)
 		echoMock.EXPECT().Response().MinTimes(1).Return(response)
@@ -140,13 +141,13 @@ func Test_bodyLoggerMiddleware(t *testing.T) {
 			return false
 		}, logger.WithFields(logrus.Fields{}))
 		err := logFunc(func(context echo.Context) error {
-			return context.NoContent(http.StatusNoContent)
+			return context.String(http.StatusOK, "response")
 		})(echoMock)
 
 		assert.NoError(t, err)
 		assert.Len(t, hook.Entries, 2)
 		assert.Equal(t, `HTTP request body: "request"`, hook.AllEntries()[0].Message)
-		assert.Equal(t, `HTTP response body: "response"`, hook.AllEntries()[1].Message)
+		assert.Equal(t, `HTTP response body: response`, hook.AllEntries()[1].Message)
 	})
 	t.Run("request and response not loggable", func(t *testing.T) {
 		ctrl := gomock.NewController(t)