diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index d2f47715c890..a69527a6e2a0 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -66,6 +66,8 @@
 
 - `sing-box` has been updated to 1.14.0, which has removed some deprecated options.  See [upstream documentation](https://sing-box.sagernet.org/migration/) for details and migration options.
 
+- `xray` The `allowInsecure` option is no longer supported.
+
 - `gotosocial` has been updated to 0.22.0. This release contains a very long database migration, which should not be cancelled or interrupted under any circumstances.
  -  Postgres users: Following the migration, if you encounter slowdown on Postgres specifically (ie., timing out while loading timelines) you may need to run some manual database maintenance steps. Please check https://docs.gotosocial.org/en/stable/admin/database_maintenance/#postgres.
 
diff --git a/pkgs/by-name/xr/xray/package.nix b/pkgs/by-name/xr/xray/package.nix
index 90a95f780c3f..f399f2f30caa 100644
--- a/pkgs/by-name/xr/xray/package.nix
+++ b/pkgs/by-name/xr/xray/package.nix
@@ -2,7 +2,7 @@
   lib,
   fetchFromGitHub,
   symlinkJoin,
-  buildGo126Module,
+  buildGo127Module,
   makeWrapper,
   nix-update-script,
   v2ray-rules-dat,
@@ -11,18 +11,18 @@
   ],
 }:
 
-buildGo126Module (finalAttrs: {
+buildGo127Module (finalAttrs: {
   pname = "xray";
-  version = "26.3.27";
+  version = "26.9.9";
 
   src = fetchFromGitHub {
     owner = "XTLS";
     repo = "Xray-core";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-tSSoaIKHgLf9ry6p0Y+BM1Nx8X+40BDDfJJYkABUoEc=";
+    hash = "sha256-GqPEAgWM9Wx19uxMj0LGeOyHreLbU0IMSmalwLe/SIc=";
   };
 
-  vendorHash = "sha256-kwvck6Eo/e6qgb1ENznhwZ/GPX75ssLUvR2u8Qm3UIM=";
+  vendorHash = "sha256-6Qa05hFdvfLlH8WQd426IU7MScmeevIgrgP5037pNek=";
 
   nativeBuildInputs = [ makeWrapper ];