diff --git a/cloudbuild.yaml b/cloudbuild.yaml
index 351ebc3cede82..aeb51218893fd 100644
--- a/cloudbuild.yaml
+++ b/cloudbuild.yaml
@@ -5,7 +5,7 @@ options:
   machineType: 'N1_HIGHCPU_32'
 steps:
 # Push the images
-- name: 'docker.io/library/golang:1.23.5-bookworm'
+- name: 'docker.io/library/golang:1.23.9-bookworm'
   id: images
   entrypoint: make
   env:
@@ -21,7 +21,7 @@ steps:
   - dns-controller-push
   - kube-apiserver-healthcheck-push
 # Push the artifacts
-- name: 'docker.io/library/golang:1.23.5-bookworm'
+- name: 'docker.io/library/golang:1.23.9-bookworm'
   id: artifacts
   entrypoint: make
   env:
@@ -36,7 +36,7 @@ steps:
   args:
   - gcs-upload-and-tag
 # Build cloudbuild artifacts (for attestation)
-- name: 'docker.io/library/golang:1.23.5-bookworm'
+- name: 'docker.io/library/golang:1.23.9-bookworm'
   id: cloudbuild-artifacts
   entrypoint: make
   env:
diff --git a/go.mod b/go.mod
index 72e25c2fbe8a4..32b9a68a6bc18 100644
--- a/go.mod
+++ b/go.mod
@@ -1,7 +1,7 @@
 module k8s.io/kops
 
 // This should be kept in sync with cloudbuild.yaml and the other go.mod files
-go 1.23.5
+go 1.23.9
 
 require (
 	cloud.google.com/go/compute/metadata v0.5.2
diff --git a/hack/go.mod b/hack/go.mod
index 04a66f2f846a6..2aa00a06f0441 100644
--- a/hack/go.mod
+++ b/hack/go.mod
@@ -1,6 +1,6 @@
 module k8s.io/kops/hack
 
-go 1.23.5
+go 1.23.9
 
 require (
 	github.com/client9/misspell v0.3.4
diff --git a/tests/e2e/go.mod b/tests/e2e/go.mod
index 3fb1e33e08207..af4898fc550c6 100644
--- a/tests/e2e/go.mod
+++ b/tests/e2e/go.mod
@@ -1,6 +1,6 @@
 module k8s.io/kops/tests/e2e
 
-go 1.23.5
+go 1.23.9
 
 replace k8s.io/kops => ../../.
 
diff --git a/tools/otel/traceserver/go.mod b/tools/otel/traceserver/go.mod
index 1c1bcbdf0e004..8ef3958d9fde9 100644
--- a/tools/otel/traceserver/go.mod
+++ b/tools/otel/traceserver/go.mod
@@ -1,6 +1,6 @@
 module k8s.io/kops/tools/otel/traceserver
 
-go 1.23.5
+go 1.23.9
 
 require (
 	go.opentelemetry.io/proto/otlp v1.3.1