diff --git a/cloudbuild.yaml b/cloudbuild.yaml
index 351ebc3ced..aeb5121889 100644
--- a/cloudbuild.yaml
+++ b/cloudbuild.yaml
@@ -5,7 +5,7 @@ options:
   machineType: 'N1_HIGHCPU_32'
 steps:
 # Push the images
-- name: 'docker.io/library/golang:1.23.5-bookworm'
+- name: 'docker.io/library/golang:1.23.9-bookworm'
   id: images
   entrypoint: make
   env:
@@ -21,7 +21,7 @@ steps:
   - dns-controller-push
   - kube-apiserver-healthcheck-push
 # Push the artifacts
-- name: 'docker.io/library/golang:1.23.5-bookworm'
+- name: 'docker.io/library/golang:1.23.9-bookworm'
   id: artifacts
   entrypoint: make
   env:
@@ -36,7 +36,7 @@ steps:
   args:
   - gcs-upload-and-tag
 # Build cloudbuild artifacts (for attestation)
-- name: 'docker.io/library/golang:1.23.5-bookworm'
+- name: 'docker.io/library/golang:1.23.9-bookworm'
   id: cloudbuild-artifacts
   entrypoint: make
   env:
diff --git a/go.mod b/go.mod
index 7561ed5181..4e91aaf209 100644
--- a/go.mod
+++ b/go.mod
@@ -1,7 +1,7 @@
 module k8s.io/kops
 
 // This should be kept in sync with cloudbuild.yaml and the other go.mod files
-go 1.23.5
+go 1.23.9
 
 require (
 	cloud.google.com/go/compute/metadata v0.5.2
diff --git a/hack/go.mod b/hack/go.mod
index 7b554db116..6034ab8769 100644
--- a/hack/go.mod
+++ b/hack/go.mod
@@ -1,6 +1,6 @@
 module k8s.io/kops/hack
 
-go 1.23.5
+go 1.23.9
 
 require (
 	github.com/client9/misspell v0.3.4
diff --git a/tests/e2e/go.mod b/tests/e2e/go.mod
index 06f00df36e..e0f69b51dc 100644
--- a/tests/e2e/go.mod
+++ b/tests/e2e/go.mod
@@ -1,6 +1,6 @@
 module k8s.io/kops/tests/e2e
 
-go 1.23.5
+go 1.23.9
 
 replace k8s.io/kops => ../../.
 
diff --git a/tools/otel/traceserver/go.mod b/tools/otel/traceserver/go.mod
index 1c1bcbdf0e..8ef3958d9f 100644
--- a/tools/otel/traceserver/go.mod
+++ b/tools/otel/traceserver/go.mod
@@ -1,6 +1,6 @@
 module k8s.io/kops/tools/otel/traceserver
 
-go 1.23.5
+go 1.23.9
 
 require (
 	go.opentelemetry.io/proto/otlp v1.3.1