diff --git a/go.mod b/go.mod
index 8225a82..f82c347 100644
--- a/go.mod
+++ b/go.mod
@@ -5,7 +5,7 @@ go 1.26.0
 require (
 	filippo.io/mldsa v0.0.0-20260215214346-43d0283efc3e
 	go.uber.org/goleak v1.3.0
-	go.uber.org/zap v1.27.1
+	go.uber.org/zap v1.28.0
 	golang.org/x/net v0.53.0
 	golang.org/x/sys v0.43.0
 )
diff --git a/go.sum b/go.sum
index 6b64b62..52e3ee2 100644
--- a/go.sum
+++ b/go.sum
@@ -10,8 +10,10 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.10.0 h1:S0h4aNzvfcFsC3dRF1jLoaov7oRaKqRGC/pUEJ2yvPQ=
 go.uber.org/multierr v1.10.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
-go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
-go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo=
+go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
 golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
 golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
diff --git a/vendor/go.uber.org/zap/CHANGELOG.md b/vendor/go.uber.org/zap/CHANGELOG.md
index 86e7e6f..5384873 100644
--- a/vendor/go.uber.org/zap/CHANGELOG.md
+++ b/vendor/go.uber.org/zap/CHANGELOG.md
@@ -3,6 +3,10 @@ All notable changes to this project will be documented in this file.
 
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 1.28.0 (27 Apr 2026)
+Enhancements:
+* [#1534][]: Add `zapcore.CheckPreWriteHook` and `CheckedEntry.Before` method for transforming entries before they are written to any Cores.
+
 ## 1.27.1 (19 Nov 2025) 
 Enhancements:
 * [#1501][]: prevent `Object` from panicking on nils 
diff --git a/vendor/go.uber.org/zap/zapcore/entry.go b/vendor/go.uber.org/zap/zapcore/entry.go
index 841752f..e1fc07a 100644
--- a/vendor/go.uber.org/zap/zapcore/entry.go
+++ b/vendor/go.uber.org/zap/zapcore/entry.go
@@ -201,6 +201,14 @@ func (a CheckWriteAction) OnWrite(ce *CheckedEntry, _ []Field) {
 
 var _ CheckWriteHook = CheckWriteAction(0)
 
+// CheckPreWriteHook is a function that transforms an Entry and its Fields
+// before they are written to cores. Register one on a CheckedEntry with the
+// Before method.
+//
+// Pre-write hooks run in the order they were added, before any Core's Write
+// method is called. They may modify the Entry and Fields freely.
+type CheckPreWriteHook func(Entry, []Field) (Entry, []Field)
+
 // CheckedEntry is an Entry together with a collection of Cores that have
 // already agreed to log it.
 //
@@ -213,6 +221,7 @@ type CheckedEntry struct {
 	dirty       bool // best-effort detection of pool misuse
 	after       CheckWriteHook
 	cores       []Core
+	before      []CheckPreWriteHook
 }
 
 func (ce *CheckedEntry) reset() {
@@ -225,6 +234,10 @@ func (ce *CheckedEntry) reset() {
 		ce.cores[i] = nil
 	}
 	ce.cores = ce.cores[:0]
+	for i := range ce.before {
+		ce.before[i] = nil
+	}
+	ce.before = ce.before[:0]
 }
 
 // Write writes the entry to the stored Cores, returns any errors, and returns
@@ -253,9 +266,14 @@ func (ce *CheckedEntry) Write(fields ...Field) {
 	}
 	ce.dirty = true
 
+	ent := ce.Entry
+	for i := range ce.before {
+		ent, fields = ce.before[i](ent, fields)
+	}
+
 	var err error
 	for i := range ce.cores {
-		err = multierr.Append(err, ce.cores[i].Write(ce.Entry, fields))
+		err = multierr.Append(err, ce.cores[i].Write(ent, fields))
 	}
 	if err != nil && ce.ErrorOutput != nil {
 		_, _ = fmt.Fprintf(
@@ -295,6 +313,18 @@ func (ce *CheckedEntry) Should(ent Entry, should CheckWriteAction) *CheckedEntry
 	return ce.After(ent, should)
 }
 
+// Before adds a pre-write hook that transforms the Entry and Fields before
+// they are written to any registered Cores. Multiple hooks run in the order
+// they were added. It's safe to call this on nil CheckedEntry references.
+func (ce *CheckedEntry) Before(ent Entry, hook CheckPreWriteHook) *CheckedEntry {
+	if ce == nil {
+		ce = getCheckedEntry()
+		ce.Entry = ent
+	}
+	ce.before = append(ce.before, hook)
+	return ce
+}
+
 // After sets this CheckEntry's CheckWriteHook, which will be called after this
 // log entry has been written. It's safe to call this on nil CheckedEntry
 // references.
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 2bdb9ef..90a93d7 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -13,7 +13,7 @@ go.uber.org/goleak/internal/stack
 # go.uber.org/multierr v1.10.0
 ## explicit; go 1.19
 go.uber.org/multierr
-# go.uber.org/zap v1.27.1
+# go.uber.org/zap v1.28.0
 ## explicit; go 1.19
 go.uber.org/zap
 go.uber.org/zap/buffer