diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 529e6091..5871e735 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -13,7 +13,7 @@ on:
       - main
 
 env:
-  GO_VERSION: 1.25.x
+  GO_VERSION: 1.26.x
 
 jobs:
   lint:
diff --git a/deploy/migrations/initial/011_auth_session_updated_at.down.sql b/deploy/migrations/initial/011_auth_session_updated_at.down.sql
new file mode 100644
index 00000000..5cb8cd64
--- /dev/null
+++ b/deploy/migrations/initial/011_auth_session_updated_at.down.sql
@@ -0,0 +1,2 @@
+-- Remove updated_at column from auth_session table
+ALTER TABLE auth_session DROP COLUMN updated_at;
diff --git a/deploy/migrations/initial/011_auth_session_updated_at.up.sql b/deploy/migrations/initial/011_auth_session_updated_at.up.sql
new file mode 100644
index 00000000..5efd1f9b
--- /dev/null
+++ b/deploy/migrations/initial/011_auth_session_updated_at.up.sql
@@ -0,0 +1,3 @@
+-- Add updated_at column to auth_session table
+-- This column was missing despite having the updated_at_column() trigger
+ALTER TABLE auth_session ADD COLUMN updated_at TIMESTAMP NOT NULL DEFAULT NOW();
diff --git a/pkg/auth/oauth2/serverprovider/storage_test.go b/pkg/auth/oauth2/serverprovider/storage_test.go
index f520bb79..eb4dc29e 100644
--- a/pkg/auth/oauth2/serverprovider/storage_test.go
+++ b/pkg/auth/oauth2/serverprovider/storage_test.go
@@ -60,14 +60,16 @@ func (s *storageSuite) TestCreatePKCERequestSessionUpdatesExistingSession() {
 	s.Mock.ExpectQuery(`SELECT \* FROM "auth_session"`).
 		WithArgs(codeSig).
 		WillReturnRows(
-			sqlmock.NewRows([]string{"id", "request_id", "access_token", "form", "client_id", "username", "subject", "active", "access_token_expires_at", "refresh_token_expires_at", "created_at"}).
-				AddRow(rowID, requestID, codeSig, "existing=value", "mcp-client", "user", "subject", true, time.Now(), time.Now(), time.Now()),
+			sqlmock.NewRows([]string{"id", "request_id", "access_token", "form", "client_id", "username", "subject", "active", "access_token_expires_at", "refresh_token_expires_at", "created_at", "updated_at"}).
+				AddRow(rowID, requestID, codeSig, "existing=value", "mcp-client", "user", "subject", true, time.Now(), time.Now(), time.Now(), time.Now()),
 		)
+	// GORM automatically adds updated_at to the UPDATE statement
 	s.Mock.ExpectExec(`UPDATE "auth_session" SET`).
-		WithArgs(sqlmock.AnyArg(), rowID).
+		WithArgs(sqlmock.AnyArg(), sqlmock.AnyArg(), rowID).
 		WillReturnResult(sqlmock.NewResult(0, 1))
 
 	s.NoError(s.storage.CreatePKCERequestSession(ctx, codeSig, req))
+	s.NoError(s.Mock.ExpectationsWereMet())
 }
 
 func (s *storageSuite) TestCreateRefreshTokenSessionUpdatesByPrimaryKey() {
@@ -84,8 +86,9 @@ func (s *storageSuite) TestCreateRefreshTokenSessionUpdatesByPrimaryKey() {
 			sqlmock.NewRows([]string{"id", "request_id", "access_token"}).
 				AddRow(rowID, requestID, "access-sig"),
 		)
+	// GORM automatically adds updated_at to the UPDATE statement
 	s.Mock.ExpectExec(`UPDATE "auth_session" SET .*WHERE id=\$`).
-		WithArgs(requestID, "access-sig", "refresh-sig", sqlmock.AnyArg(), rowID, rowID).
+		WithArgs(requestID, "access-sig", "refresh-sig", sqlmock.AnyArg(), sqlmock.AnyArg(), rowID, rowID).
 		WillReturnResult(sqlmock.NewResult(0, 1))
 
 	err := s.storage.CreateRefreshTokenSession(NewContext(s.Ctx), "refresh-sig", "access-sig", req)
@@ -95,7 +98,7 @@ func (s *storageSuite) TestCreateRefreshTokenSessionUpdatesByPrimaryKey() {
 func (s *storageSuite) expectAuthSessionInsert(accessToken, requestID string) {
 	var got []driver.Value
 	cap := captureArg{dst: &got}
-	args := make([]driver.Value, 16)
+	args := make([]driver.Value, 17) // 17 columns including updated_at
 	for i := range args {
 		args[i] = cap
 	}
diff --git a/repository/authclient/models/auth_session.go b/repository/authclient/models/auth_session.go
index 6300ed34..46d28908 100644
--- a/repository/authclient/models/auth_session.go
+++ b/repository/authclient/models/auth_session.go
@@ -33,6 +33,7 @@ type AuthSession struct {
 	GrantedAudience   gosql.NullableStringArray `db:"granted_audience" gorm:"type:text[]"`
 
 	CreatedAt time.Time      `db:"created_at"`
+	UpdatedAt time.Time      `db:"updated_at"`
 	DeletedAt gorm.DeletedAt `db:"deleted_at"`
 }