diff --git a/CHANGELOG.md b/CHANGELOG.md
index 91b442db..f20b67cd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,11 @@ All notable changes to the ld-find-code-refs program will be documented in this
 
 ## [Unreleased]
 
+## [2.18.4] - 2026-10-21
+
+### Fixed:
+- builds with Go 1.26.10 so `crypto/x509` rejects certificate chains through the distrusted eMudhra intermediates (INC-289, golang/go#82345). The `toolchain` directive in `go.mod` moves from 1.26.8 to 1.26.10 and the release image from `cimg/go:1.22` to `cimg/go:1.26.10`. There are no application code changes
+
 ## [2.18.3] - 2026-09-25
 
 ### Fixed:
diff --git a/build/metadata/github-actions/Dockerfile b/build/metadata/github-actions/Dockerfile
index fb48aa34..22d2c383 100644
--- a/build/metadata/github-actions/Dockerfile
+++ b/build/metadata/github-actions/Dockerfile
@@ -1,4 +1,4 @@
-FROM launchdarkly/ld-find-code-refs-github-action:2.18.3
+FROM launchdarkly/ld-find-code-refs-github-action:2.18.4
 
 LABEL com.github.actions.name="LaunchDarkly Code References"
 LABEL com.github.actions.description="Find references to feature flags in your code."
diff --git a/build/metadata/github-actions/README.md b/build/metadata/github-actions/README.md
index a836dfae..10ecbde5 100644
--- a/build/metadata/github-actions/README.md
+++ b/build/metadata/github-actions/README.md
@@ -28,7 +28,7 @@ jobs:
       with:
         fetch-depth: 11 # This value must be set if the lookback configuration option is not disabled for find-code-references. Read more: https://github.com/launchdarkly/ld-find-code-refs#searching-for-unused-flags-extinctions
     - name: LaunchDarkly Code References
-      uses: launchdarkly/find-code-references@v2.18.3
+      uses: launchdarkly/find-code-references@v2
       with:
         accessToken: ${{ secrets.LD_ACCESS_TOKEN }}
         projKey: LD_PROJECT_KEY
@@ -63,12 +63,11 @@ jobs:
         username: ${{ secrets.REGISTRY_USER }}
         password: ${{ secrets.REGISTRY_TOKEN }}
     - name: LaunchDarkly Code References
-      # Pin to a release that includes the docker/ entry point (see changelog).
-      uses: launchdarkly/find-code-references/docker@v2.18.3
+      uses: launchdarkly/find-code-references/docker@v2
       with:
         accessToken: ${{ secrets.LD_ACCESS_TOKEN }}
         projKey: LD_PROJECT_KEY
-        dockerImage: your.registry.example/launchdarkly/ld-find-code-refs-github-action:2.18.3
+        dockerImage: your.registry.example/launchdarkly/ld-find-code-refs-github-action:2.18.4
 ```
 
 Mirror the public image `launchdarkly/ld-find-code-refs-github-action` into your registry (pin `dockerImage` to the scanner image tag you mirrored; it can lag the Action tag). This entry point requires a Docker CLI on the runner (included on GitHub-hosted `ubuntu-*` runners). Existing workflows that use the root Action do not need to change.
@@ -104,7 +103,7 @@ jobs:
       with:
         fetch-depth: 11 # This value must be set if the lookback configuration option is not disabled for find-code-references. Read more: https://github.com/launchdarkly/ld-find-code-refs#searching-for-unused-flags-extinctions
     - name: LaunchDarkly Code References
-      uses: launchdarkly/find-code-references@v2.18.3
+      uses: launchdarkly/find-code-references@v2
       with:
         accessToken: ${{ secrets.LD_ACCESS_TOKEN }}
         projKey: LD_PROJECT_KEY
diff --git a/build/metadata/github-actions/docker/action.yml b/build/metadata/github-actions/docker/action.yml
index d2b506e1..15a5d3ed 100644
--- a/build/metadata/github-actions/docker/action.yml
+++ b/build/metadata/github-actions/docker/action.yml
@@ -52,12 +52,12 @@ inputs:
     description: >-
       Container image to run. Defaults to the public Docker Hub image used by
       the root Action. Set this to your mirrored/proxy image (for example
-      your.registry.example/launchdarkly/ld-find-code-refs-github-action:2.18.3).
+      your.registry.example/launchdarkly/ld-find-code-refs-github-action:2.18.4).
       Authenticate to private registries with docker/login-action (or equivalent)
       in a prior step. Requires a runner with a Docker CLI (GitHub-hosted
       ubuntu-* runners include one).
     required: false
-    default: "launchdarkly/ld-find-code-refs-github-action:2.18.3"
+    default: "launchdarkly/ld-find-code-refs-github-action:2.18.4"
 runs:
   using: composite
   steps:
diff --git a/internal/version/version.go b/internal/version/version.go
index 473a6f18..3cc3ce78 100644
--- a/internal/version/version.go
+++ b/internal/version/version.go
@@ -1,3 +1,3 @@
 package version
 
-const Version = "2.18.3"
+const Version = "2.18.4"