diff --git a/.github/workflows/build-ccm-gcp.yml b/.github/workflows/build-ccm-gcp.yml
index a6a434cb7..ee9a56e0e 100644
--- a/.github/workflows/build-ccm-gcp.yml
+++ b/.github/workflows/build-ccm-gcp.yml
@@ -31,7 +31,7 @@ jobs:
       - name: Setup Go environment
         uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
         with:
-          go-version: "1.23.2"
+          go-version: "1.23.5"
           cache: false
 
       - name: Install Crane
diff --git a/.github/workflows/build-os-image-scheduled.yml b/.github/workflows/build-os-image-scheduled.yml
index 000a57a16..6149dddca 100644
--- a/.github/workflows/build-os-image-scheduled.yml
+++ b/.github/workflows/build-os-image-scheduled.yml
@@ -67,7 +67,7 @@ jobs:
       - name: Setup Go environment
         uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
         with:
-          go-version: "1.23.2"
+          go-version: "1.23.5"
           cache: false
 
       - name: Determine version
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 1f140931c..387f614dd 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -40,7 +40,7 @@ jobs:
         if: matrix.language == 'go'
         uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
         with:
-          go-version: "1.23.2"
+          go-version: "1.23.5"
           cache: false
 
       - name: Initialize CodeQL
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fffe4febe..53204f8cc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -257,7 +257,7 @@ jobs:
       - name: Setup Go environment
         uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
         with:
-          go-version: "1.23.2"
+          go-version: "1.23.5"
           cache: true
 
       - name: Build generateMeasurements tool
diff --git a/.github/workflows/test-operator-codegen.yml b/.github/workflows/test-operator-codegen.yml
index a9776220a..59bd27cf3 100644
--- a/.github/workflows/test-operator-codegen.yml
+++ b/.github/workflows/test-operator-codegen.yml
@@ -28,7 +28,7 @@ jobs:
       - name: Setup Go environment
         uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
         with:
-          go-version: "1.23.2"
+          go-version: "1.23.5"
           cache: true
 
       - name: Run code generation
diff --git a/3rdparty/gcp-guest-agent/Dockerfile b/3rdparty/gcp-guest-agent/Dockerfile
index 0e2921df6..b79b163df 100644
--- a/3rdparty/gcp-guest-agent/Dockerfile
+++ b/3rdparty/gcp-guest-agent/Dockerfile
@@ -6,7 +6,7 @@ RUN apt-get update && apt-get install -y \
     git
 
 # Install Go
-ARG GO_VER=1.22.3
+ARG GO_VER=1.23.5
 RUN wget -q https://go.dev/dl/go${GO_VER}.linux-amd64.tar.gz && \
     tar -C /usr/local -xzf go${GO_VER}.linux-amd64.tar.gz && \
     rm go${GO_VER}.linux-amd64.tar.gz
diff --git a/MODULE.bazel b/MODULE.bazel
index 51330d2f2..368f1c9c3 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -22,7 +22,7 @@ go_sdk = use_extension("@io_bazel_rules_go//go:extensions.bzl", "go_sdk")
 go_sdk.download(
     name = "go_sdk",
     patches = ["//3rdparty/bazel/org_golang:go_tls_max_handshake_size.patch"],
-    version = "1.23.2",
+    version = "1.23.5",
 )
 
 python = use_extension("@rules_python//python/extensions:python.bzl", "python")
diff --git a/dev-docs/workflows/bump-go-version.md b/dev-docs/workflows/bump-go-version.md
index 09b3fad81..f2736179b 100644
--- a/dev-docs/workflows/bump-go-version.md
+++ b/dev-docs/workflows/bump-go-version.md
@@ -17,7 +17,7 @@ go_sdk.download(
 
 ```
 
-Replace `go-version: "1.xx.x"` with the new version in all GitHub actions and workflows.
+Replace `go-version: "1.xx.x"` with the new version in all GitHub actions/workflows, our go.mod files and Containerfiles.
 You can use the following command to find replace all instances of `go-version: "1.xx.x"` in the `.github` directory:
 
 ```bash
@@ -25,7 +25,9 @@ OLD_VERSION="1.xx.x"
 NEW_VERSION="1.xx.y"
 find .github -type f -exec sed -i "s/go-version: \"${OLD_VERSION}\"/go-version: \"${NEW_VERSION}\"/g" {} \;
 sed -i "s/go ${OLD_VERSION}/go ${NEW_VERSION}/g" go.mod
+sed -i "s/go ${OLD_VERSION}/go ${NEW_VERSION}/g" hack/tools/go.mod
 sed -i "s/${OLD_VERSION}/${NEW_VERSION}/g" go.work
+sed -i "s/GO_VER=${OLD_VERSION}/GO_VER=${NEW_VERSION}/g" 3rdparty/gcp-guest-agent/Dockerfile
 ```
 
 Or manually:
diff --git a/go.mod b/go.mod
index d497f83d3..216acbdaa 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/edgelesssys/constellation/v2
 
-go 1.23.2
+go 1.23.5
 
 // TODO(daniel-weisse): revert after merging https://github.com/martinjungblut/go-cryptsetup/pull/16.
 replace github.com/martinjungblut/go-cryptsetup => github.com/daniel-weisse/go-cryptsetup v0.0.0-20230705150314-d8c07bd1723c
diff --git a/go.work b/go.work
index 0cf42a018..e4cc14603 100644
--- a/go.work
+++ b/go.work
@@ -1,6 +1,6 @@
-go 1.23.2
+go 1.23.5
 
-toolchain go1.23.2
+toolchain go1.23.5
 
 use (
 	.
diff --git a/hack/tools/go.mod b/hack/tools/go.mod
index 5674da6b2..ddd5ed3b3 100644
--- a/hack/tools/go.mod
+++ b/hack/tools/go.mod
@@ -1,6 +1,6 @@
 module github.com/edgelesssys/constellation/v2/hack/tools
 
-go 1.23.2
+go 1.23.5
 
 require (
 	github.com/google/go-licenses v1.6.0