diff --git a/go b/go
index 737d626d12..aa194b3f68 160000
--- a/go
+++ b/go
@@ -1 +1 @@
-Subproject commit 737d626d121e505eee448c7a1b58fa0176636b02
+Subproject commit aa194b3f687732aa08e62a7939cea68f0f7424af
diff --git a/patches/0010-Align-TLS-settings-with-Microsoft-policies.patch b/patches/0010-Align-TLS-settings-with-Microsoft-policies.patch
index fc989722d7..6a590ab205 100644
--- a/patches/0010-Align-TLS-settings-with-Microsoft-policies.patch
+++ b/patches/0010-Align-TLS-settings-with-Microsoft-policies.patch
@@ -21,10 +21,10 @@ Subject: [PATCH] Align TLS settings with Microsoft policies
  create mode 100644 src/crypto/tls/microsoft_test.go
 
 diff --git a/doc/godebug.md b/doc/godebug.md
-index 2181053c32daf7..e5c0a2ded8e5b9 100644
+index 79f3c10ffbbfe1..1641530aba7afd 100644
 --- a/doc/godebug.md
 +++ b/doc/godebug.md
-@@ -249,6 +249,15 @@ APIs ignore the random `io.Reader` parameter. For Go 1.26, it defaults
+@@ -263,6 +263,15 @@ APIs ignore the random `io.Reader` parameter. For Go 1.26, it defaults
  to `cryptocustomrand=0`, ignoring the random parameters. Using `cryptocustomrand=1`
  reverts to the pre-Go 1.26 behavior.
  
@@ -954,11 +954,11 @@ index cccfb8866f88ab..b2896e95e74686 100644
  	cipherSuitesPreferenceOrderNoAES = cipherSuitesPreferenceOrder
  	defaultCipherSuitesTLS13NoAES = defaultCipherSuitesTLS13
 diff --git a/src/internal/godebugs/table.go b/src/internal/godebugs/table.go
-index c0251a512a7434..62cb557e9bd8d1 100644
+index 89ec78555a5312..05d9cf6eea4b28 100644
 --- a/src/internal/godebugs/table.go
 +++ b/src/internal/godebugs/table.go
-@@ -49,6 +49,8 @@ var All = []Info{
- 	{Name: "httpservecontentkeepheaders", Package: "net/http", Changed: 23, Old: "1"},
+@@ -50,6 +50,8 @@ var All = []Info{
+ 	{Name: "httpservecontentmaxranges", Package: "net/http", Changed: 26, Old: "1"},
  	{Name: "installgoroot", Package: "go/build"},
  	{Name: "jstmpllitinterp", Package: "html/template", Opaque: true}, // bug #66217: remove Opaque
 +	{Name: "ms_tlsprofile", Package: "crypto/tls", Opaque: true},
@@ -967,7 +967,7 @@ index c0251a512a7434..62cb557e9bd8d1 100644
  	{Name: "multipartmaxheaders", Package: "mime/multipart"},
  	{Name: "multipartmaxparts", Package: "mime/multipart"},
 diff --git a/src/net/http/internal/http2/transport_test.go b/src/net/http/internal/http2/transport_test.go
-index e6dafb0d6df4b4..0d43616636b69e 100644
+index 8121f3dc595dc6..9cbcc2352bc8a0 100644
 --- a/src/net/http/internal/http2/transport_test.go
 +++ b/src/net/http/internal/http2/transport_test.go
 @@ -15,6 +15,7 @@ import (
@@ -978,7 +978,7 @@ index e6dafb0d6df4b4..0d43616636b69e 100644
  	"io"
  	"log"
  	"maps"
-@@ -3027,6 +3028,7 @@ func TestTransportPingWriteBlocks(t *testing.T) {
+@@ -3044,6 +3045,7 @@ func TestTransportPingWriteBlocks(t *testing.T) {
  	// The blocked mutex acquisition prevents the synctest bubble from quiescing.
  	//
  	// This also means we can't use newTestClientConn, which assumes synctest.
diff --git a/patches/0012-net-http-raise-DefaultMaxHeaderValueCount-to-32768.patch b/patches/0012-net-http-raise-DefaultMaxHeaderValueCount-to-32768.patch
index 4e5453f48c..7b13f334d8 100644
--- a/patches/0012-net-http-raise-DefaultMaxHeaderValueCount-to-32768.patch
+++ b/patches/0012-net-http-raise-DefaultMaxHeaderValueCount-to-32768.patch
@@ -67,15 +67,15 @@ index 00000000000000..1bb294d4ea5af9
 +authentication, exceeded the old limit for identities with many groups.
 +Servers that set [Server.MaxHeaderValueCount] are unaffected.
 diff --git a/src/net/http/serve_test.go b/src/net/http/serve_test.go
-index 215cf700af6bba..614109ef8cbae2 100644
+index f04c951d42f28c..3821205a545b3b 100644
 --- a/src/net/http/serve_test.go
 +++ b/src/net/http/serve_test.go
-@@ -3414,6 +3414,50 @@ func TestStripPrefixNotModifyRequest(t *testing.T) {
+@@ -3357,6 +3357,50 @@ func TestStripPrefixNotModifyRequest(t *testing.T) {
  	}
  }
  
 +func TestDefaultMaxHeaderValueCount(t *testing.T) {
-+	run(t, testDefaultMaxHeaderValueCount, http3SkippedMode)
++	runNoSynctest(t, testDefaultMaxHeaderValueCount, http3SkippedMode)
 +}
 +
 +func testDefaultMaxHeaderValueCount(t *testing.T, mode testMode) {
@@ -118,11 +118,11 @@ index 215cf700af6bba..614109ef8cbae2 100644
 +	}
 +}
 +
- func TestRequestLimit(t *testing.T) { run(t, testRequestLimit, http3SkippedMode) }
+ func TestRequestLimit(t *testing.T) { runSynctest(t, testRequestLimit, http3SkippedMode) }
  func testRequestLimit(t *testing.T, mode testMode) {
  	bytesPerHeader := len("header12345: val12345\r\n")
 diff --git a/src/net/http/server.go b/src/net/http/server.go
-index 409a267abaf0eb..3787d1c50b05c5 100644
+index 139016d33d0921..a1181cde37079e 100644
 --- a/src/net/http/server.go
 +++ b/src/net/http/server.go
 @@ -1027,7 +1027,14 @@ const DefaultMaxHeaderBytes = 1 << 20 // 1 MB