diff --git a/go.mod b/go.mod
index f4c696927..84f3cb3c7 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/opencontainers/runc
 go 1.26.0
 
 require (
-	cyphar.com/go-pathrs v0.2.5
+	cyphar.com/go-pathrs v0.2.6
 	github.com/checkpoint-restore/go-criu/v8 v8.4.0
 	github.com/containerd/console v1.0.5
 	github.com/coreos/go-systemd/v22 v22.7.0
diff --git a/go.sum b/go.sum
index 276afc2db..bf173d885 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,5 @@
-cyphar.com/go-pathrs v0.2.5 h1:SnX9FBvnoyn3lUs1dkMgZ52bAETpirNu3FTRh5HlRik=
-cyphar.com/go-pathrs v0.2.5/go.mod h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc=
+cyphar.com/go-pathrs v0.2.6 h1:+btfBJ7qWKZo+TDJlDZ2tPqToKdN8QD4BAOqomueXZg=
+cyphar.com/go-pathrs v0.2.6/go.mod h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc=
 github.com/aperturerobotics/protobuf-go-lite v0.15.0 h1:Ke9pkt5zO5iQf2q7iAYsXHlCDhGeQH0cvhCTIiiWUIg=
 github.com/aperturerobotics/protobuf-go-lite v0.15.0/go.mod h1:3Ay/E7iaw2KWLirK3+dDdNJZHK0hu8Y1/kKeYeUa+8s=
 github.com/checkpoint-restore/go-criu/v8 v8.4.0 h1:w6WDxjde4pvXYTIBuj6dsWsaPorKwSWuCk/qSKTO3Jw=
diff --git a/vendor/cyphar.com/go-pathrs/internal/libpathrs/libpathrs_linux.go b/vendor/cyphar.com/go-pathrs/internal/libpathrs/libpathrs_linux.go
index d610a3be4..80c6c0a61 100644
--- a/vendor/cyphar.com/go-pathrs/internal/libpathrs/libpathrs_linux.go
+++ b/vendor/cyphar.com/go-pathrs/internal/libpathrs/libpathrs_linux.go
@@ -217,12 +217,20 @@ func InRootHardlink(oldRootFd uintptr, oldPath string, newRootFd uintptr, newPat
 }
 
 // ProcBase is pathrs_proc_base_t (uint64_t).
-type ProcBase C.pathrs_proc_base_t
+//
+// FIXME: cbindgen v0.29.3 switched to outputting C23 fixed-type enum syntax
+// and making pathrs_proc_base_t a typedef of the enum. CGo treats all enum
+// members as an int64 despite the fixed-type declaration, causing spurious
+// errors about overflows. Thus we have to hardcode the type on the Go side.
+// See <https://github.com/mozilla/cbindgen/pull/1156>.
+type ProcBase uint64
 
-// FIXME: We need to open-code the constants because CGo unfortunately will
-// implicitly convert any non-literal constants (i.e. those resolved using gcc)
-// to signed integers. See <https://github.com/golang/go/issues/39136> for some
-// more information on the underlying issue (though.
+// FIXME: We need to open-code the constants because CGo's handling of
+// non-literal constants (i.e., those resolved using the C compiler) that don't
+// fit in an int64 is compiler-dependent -- GCC gives us implicitly-converted
+// (negative) signed integers while Clang gives us the actual unsigned values.
+// See <https://github.com/golang/go/issues/39136> for some more information on
+// the underlying issue.
 const (
 	// ProcRoot is PATHRS_PROC_ROOT.
 	ProcRoot ProcBase = 0xFFFF_FFFE_7072_6F63 // C.PATHRS_PROC_ROOT
@@ -246,16 +254,26 @@ func assertEqual[T comparable](a, b T, msg string) {
 	}
 }
 
+// u64Mask is used to convert the C constants below into plain uint64 values,
+// regardless of how CGo decided to interpret their signedness.
+//
+// In particular, CGo gives us the PATHRS_PROC_* values as negative (signed)
+// constants with GCC and as (unsigned) constants that overflow int64 with
+// Clang, so neither int64 nor uint64 can hold them with both compilers.
+//
+// Luckily, Go constant expressions are arbitrary-precision and bitwise
+// operations on negative constants operate on their infinite two's complement
+// representation, so masking off the lower 64 bits yields the same uint64
+// value no matter which compiler CGo used.
+const u64Mask = 0xFFFF_FFFF_FFFF_FFFF
+
 // Verify that the values above match the actual C values. Unfortunately, Go
-// only allows us to forcefully cast int64 to uint64 if you use a temporary
-// variable, which means we cannot do it in a const context and thus need to do
-// it at runtime (even though it is a check that fundamentally could be done at
-// compile-time)...
+// has no way of doing compile-time assertions, so we need to do it at runtime.
 func init() {
 	var (
-		actualProcRoot       int64 = C.PATHRS_PROC_ROOT
-		actualProcSelf       int64 = C.PATHRS_PROC_SELF
-		actualProcThreadSelf int64 = C.PATHRS_PROC_THREAD_SELF
+		actualProcRoot       uint64 = C.PATHRS_PROC_ROOT & u64Mask
+		actualProcSelf       uint64 = C.PATHRS_PROC_SELF & u64Mask
+		actualProcThreadSelf uint64 = C.PATHRS_PROC_THREAD_SELF & u64Mask
 	)
 
 	assertEqual(ProcRoot, ProcBase(actualProcRoot), "PATHRS_PROC_ROOT")
@@ -263,8 +281,8 @@ func init() {
 	assertEqual(ProcThreadSelf, ProcBase(actualProcThreadSelf), "PATHRS_PROC_THREAD_SELF")
 
 	var (
-		actualProcBaseTypeMask uint64 = C.__PATHRS_PROC_TYPE_MASK
-		actualProcBaseTypePid  uint64 = C.__PATHRS_PROC_TYPE_PID
+		actualProcBaseTypeMask uint64 = C.__PATHRS_PROC_TYPE_MASK & u64Mask
+		actualProcBaseTypePid  uint64 = C.__PATHRS_PROC_TYPE_PID & u64Mask
 	)
 
 	assertEqual(ProcBaseTypeMask, ProcBase(actualProcBaseTypeMask), "__PATHRS_PROC_TYPE_MASK")
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 4d7435612..83a2b7888 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1,4 +1,4 @@
-# cyphar.com/go-pathrs v0.2.5
+# cyphar.com/go-pathrs v0.2.6
 ## explicit; go 1.18
 cyphar.com/go-pathrs
 cyphar.com/go-pathrs/internal/fdutils