diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 4a3b255..8b9d9d0 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -16,7 +16,7 @@ jobs:
         id: gover
         run: echo goversion=$(grep "AS apk" Dockerfile.test | awk -F':|-' '!/^#/ {print $2}') >> "$GITHUB_OUTPUT"
       - name: Set up Go
-        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # tag=v5.2.0
+        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # tag=v5.3.0
         with:
           go-version: "${{ steps.gover.outputs.goversion }}"
       - run: go test -race ./...
@@ -30,7 +30,7 @@ jobs:
         id: gover
         run: echo goversion=$(grep "AS apk" Dockerfile.test | awk -F':|-' '!/^#/ {print $2}') >> "$GITHUB_OUTPUT"
       - name: Set up Go
-        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # tag=v5.2.0
+        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # tag=v5.3.0
         with:
           go-version: "${{ steps.gover.outputs.goversion }}"
       - name: golangci-lint
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 56f862d..39623a4 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -22,7 +22,7 @@ jobs:
         id: gover
         run: echo goversion=$(grep "AS apk" Dockerfile.test | awk -F':|-' '!/^#/ {print $2}') >> "$GITHUB_OUTPUT"
       - name: Set up Go
-        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # tag=v5.2.0
+        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # tag=v5.3.0
         with:
           go-version: "${{ steps.gover.outputs.goversion }}"
       - name: Set up Cosign
diff --git a/Dockerfile.test b/Dockerfile.test
index 3ac337a..e0f7847 100644
--- a/Dockerfile.test
+++ b/Dockerfile.test
@@ -1,4 +1,4 @@
-FROM golang:1.23.4 AS deb
+FROM golang:1.23.5 AS deb
 WORKDIR /app
 COPY go.mod .
 COPY go.sum .
@@ -9,7 +9,7 @@ RUN [ "go", "test", "-v", "./internal/cli/...", "-run", "TestGenerate_InstallDeb
 
 # This line also determines the golang version used for GitHub Actions CI
 # Use the qualified image name, so Dependabot treats this separate from "golang" above.
-FROM docker.io/library/golang:1.23.4-alpine AS apk
+FROM docker.io/library/golang:1.23.5-alpine AS apk
 ENV CGO_ENABLED=0
 WORKDIR /app
 COPY go.mod .