diff --git a/dockerfiles/code-coverage-uploader/Dockerfile b/dockerfiles/code-coverage-uploader/Dockerfile
index ccea2aa18..91210e544 100644
--- a/dockerfiles/code-coverage-uploader/Dockerfile
+++ b/dockerfiles/code-coverage-uploader/Dockerfile
@@ -9,6 +9,6 @@ RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*
 RUN curl -sfLo /tmp/codecov https://uploader.codecov.io/latest/linux/codecov
 RUN chmod +x /tmp/codecov
 
-FROM golang:1.26.1
+FROM golang:1.26.2
 RUN apt-get update -y && apt-get dist-upgrade -y
 COPY --from=builder /tmp/codecov /usr/local/bin/codecov
diff --git a/dockerfiles/crane/Dockerfile b/dockerfiles/crane/Dockerfile
index 0f26c4d44..233e71c7f 100644
--- a/dockerfiles/crane/Dockerfile
+++ b/dockerfiles/crane/Dockerfile
@@ -2,9 +2,9 @@
 # SPDX-License-Identifier: Apache-2.0
 
 FROM gcr.io/go-containerregistry/crane as crane
-FROM mikefarah/yq:4.52.4 AS yq
+FROM mikefarah/yq:4.53.2 AS yq
 
-FROM golang:1.26.1
+FROM golang:1.26.2
 COPY --from=yq /usr/bin/yq /usr/local/bin
 COPY --from=crane /ko-app/crane /usr/local/bin
 ENTRYPOINT ["bash"]
diff --git a/dockerfiles/deployment-yaml-formatter/Dockerfile b/dockerfiles/deployment-yaml-formatter/Dockerfile
index 14ecb339f..0e3640357 100644
--- a/dockerfiles/deployment-yaml-formatter/Dockerfile
+++ b/dockerfiles/deployment-yaml-formatter/Dockerfile
@@ -1,7 +1,7 @@
-# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+# Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-FROM mikefarah/yq:4.52.4 AS yq
+FROM mikefarah/yq:4.53.2 AS yq
 
 FROM debian:13.4-slim
 
diff --git a/dockerfiles/eks-deployer/Dockerfile b/dockerfiles/eks-deployer/Dockerfile
index 16fc22f25..58af3f7e7 100644
--- a/dockerfiles/eks-deployer/Dockerfile
+++ b/dockerfiles/eks-deployer/Dockerfile
@@ -1,11 +1,11 @@
-# Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
+# Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
 # For deploying an EKS cluster and setting it up to run our tests.
 
-FROM weaveworks/eksctl:v0.224.0 AS eksctl
-FROM mikefarah/yq:4.52.4 AS yq
-FROM amazon/aws-cli:2.34.16
+FROM weaveworks/eksctl:v0.225.0 AS eksctl
+FROM mikefarah/yq:4.53.2 AS yq
+FROM amazon/aws-cli:2.34.32
 RUN yum update -y && yum install -y jq perl-Digest-SHA openssl && yum clean all
 COPY --from=eksctl eksctl /usr/local/bin/eksctl
 COPY --from=yq /usr/bin/yq /usr/local/bin/yq
diff --git a/dockerfiles/gh-cli/Dockerfile b/dockerfiles/gh-cli/Dockerfile
index bd8f57665..f9a513c4d 100644
--- a/dockerfiles/gh-cli/Dockerfile
+++ b/dockerfiles/gh-cli/Dockerfile
@@ -11,5 +11,5 @@ RUN curl \
     https://github.com/cli/cli/releases/download/v2.40.0/gh_2.40.0_linux_amd64.tar.gz \
     && tar -C /tmp --strip-components=1 -xzvf /tmp/gh.tar.gz
 
-FROM golang:1.26.1
+FROM golang:1.26.2
 COPY --from=builder /tmp/bin/gh /usr/local/bin/gh
diff --git a/dockerfiles/integration-test-runner-beta/Dockerfile b/dockerfiles/integration-test-runner-beta/Dockerfile
index 90678f409..33fd6d195 100644
--- a/dockerfiles/integration-test-runner-beta/Dockerfile
+++ b/dockerfiles/integration-test-runner-beta/Dockerfile
@@ -3,14 +3,14 @@
 
 # For running the integration tests as a client to a k8s cluster
 
-FROM mikefarah/yq:4.52.4 AS yq
+FROM mikefarah/yq:4.53.2 AS yq
 
 # We need gcloud for running integration tests against GKE
 # because the kubeconfig uses gcloud as an `auth-provider`.
 # Use FROM gcloud-sdk instead of FROM golang because its
 # a lot easier to install Go than to install gcloud in the
 # subsequent commands below.
-FROM google/cloud-sdk:562.0.0-slim
+FROM google/cloud-sdk:565.0.0-slim
 
 # Install apache2-utils (for htpasswd to bcrypt passwords for the
 # local-user-authenticator) and jq.
@@ -36,7 +36,7 @@ RUN google-chrome --version
 
 # Install Go. The download URL that can be used below for any version of Go can be found on https://go.dev/dl/
 ENV PATH /usr/local/go/bin:$PATH
-RUN curl -fsSL https://go.dev/dl/go1.26.1.linux-amd64.tar.gz -o /tmp/go.tar.gz && \
+RUN curl -fsSL https://go.dev/dl/go1.26.2.linux-amd64.tar.gz -o /tmp/go.tar.gz && \
     tar -C /usr/local -xzf /tmp/go.tar.gz && \
     rm /tmp/go.tar.gz && \
     go version
diff --git a/dockerfiles/integration-test-runner/Dockerfile b/dockerfiles/integration-test-runner/Dockerfile
index fbe801e91..f62bd91db 100644
--- a/dockerfiles/integration-test-runner/Dockerfile
+++ b/dockerfiles/integration-test-runner/Dockerfile
@@ -3,14 +3,14 @@
 
 # For running the integration tests as a client to a k8s cluster
 
-FROM mikefarah/yq:4.52.4 AS yq
+FROM mikefarah/yq:4.53.2 AS yq
 
 # We need gcloud for running integration tests against GKE
 # because the kubeconfig uses gcloud as an `auth-provider`.
 # Use FROM gcloud-sdk instead of FROM golang because its
 # a lot easier to install Go than to install gcloud in the
 # subsequent commands below.
-FROM google/cloud-sdk:562.0.0-slim
+FROM google/cloud-sdk:565.0.0-slim
 
 # Install apache2-utils (for htpasswd to bcrypt passwords for the
 # local-user-authenticator) and jq.
@@ -36,7 +36,7 @@ RUN google-chrome --version
 
 # Install Go. The download URL that can be used below for any version of Go can be found on https://go.dev/dl/
 ENV PATH /usr/local/go/bin:$PATH
-RUN curl -fsSL https://go.dev/dl/go1.26.1.linux-amd64.tar.gz -o /tmp/go.tar.gz && \
+RUN curl -fsSL https://go.dev/dl/go1.26.2.linux-amd64.tar.gz -o /tmp/go.tar.gz && \
     tar -C /usr/local -xzf /tmp/go.tar.gz && \
     rm /tmp/go.tar.gz && \
     go version
diff --git a/dockerfiles/k8s-app-deployer/Dockerfile b/dockerfiles/k8s-app-deployer/Dockerfile
index f1f697410..b8e192593 100644
--- a/dockerfiles/k8s-app-deployer/Dockerfile
+++ b/dockerfiles/k8s-app-deployer/Dockerfile
@@ -1,9 +1,9 @@
-# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+# Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
 # For deploying apps onto Kubernetes clusters (including GKE)
 
-FROM google/cloud-sdk:562.0.0-slim
+FROM google/cloud-sdk:565.0.0-slim
 
 # Install apache2-utils (for htpasswd to bcrypt passwords for the
 # local-user-authenticator) and jq.
diff --git a/dockerfiles/test-cfssl/Dockerfile b/dockerfiles/test-cfssl/Dockerfile
index eb7d8eadb..fce3851f2 100644
--- a/dockerfiles/test-cfssl/Dockerfile
+++ b/dockerfiles/test-cfssl/Dockerfile
@@ -11,7 +11,7 @@ FROM cfssl/cfssl:v1.6.5 as cfssl
 
 # We just need any basic unix with bash, but we can pick the same
 # base image that they use, just in case they did any dynamic linking.
-FROM golang:1.26.1
+FROM golang:1.26.2
 
 # Thier Docerfile https://github.com/cloudflare/cfssl/blob/master/Dockerfile
 # calls their Makefile https://github.com/cloudflare/cfssl/blob/master/Makefile
diff --git a/pipelines/dockerfile-builders/pipeline.yml b/pipelines/dockerfile-builders/pipeline.yml
index 7345c4a79..ae44bcd66 100644
--- a/pipelines/dockerfile-builders/pipeline.yml
+++ b/pipelines/dockerfile-builders/pipeline.yml
@@ -38,7 +38,7 @@ meta:
   # These version numbers should be updated periodically.
   codegen-versions: &codegen-versions
     # Choose which version of Golang to use in the codegen container images.
-    BUILD_ARG_GO_VERSION: '1.26.1'
+    BUILD_ARG_GO_VERSION: '1.26.2'
     # Choose which version of sigs.k8s.io/controller-tools/cmd/controller-gen to install
     # in the codegen container images.
     BUILD_ARG_CONTROLLER_GEN_VERSION: 0.20.1
diff --git a/pipelines/pull-requests/pipeline.yml b/pipelines/pull-requests/pipeline.yml
index 9a272a4ce..24dcd37d5 100644
--- a/pipelines/pull-requests/pipeline.yml
+++ b/pipelines/pull-requests/pipeline.yml
@@ -572,7 +572,7 @@ jobs:
             type: registry-image
             source:
               repository: golang
-              tag: '1.26.1'
+              tag: '1.26.2'
           inputs:
             - name: pinniped-pr
           outputs:
diff --git a/pipelines/shared-helpers/test-binaries-image/Dockerfile b/pipelines/shared-helpers/test-binaries-image/Dockerfile
index b9d98540f..439471e0f 100644
--- a/pipelines/shared-helpers/test-binaries-image/Dockerfile
+++ b/pipelines/shared-helpers/test-binaries-image/Dockerfile
@@ -3,7 +3,7 @@
 # Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-FROM golang:1.26.1-bookworm as build-env
+FROM golang:1.26.2-bookworm as build-env
 WORKDIR /work
 COPY . .
 ARG GOPROXY
diff --git a/pipelines/shared-helpers/test-binaries-image/Dockerfile_fips b/pipelines/shared-helpers/test-binaries-image/Dockerfile_fips
index c50b06eb3..a674ac13b 100644
--- a/pipelines/shared-helpers/test-binaries-image/Dockerfile_fips
+++ b/pipelines/shared-helpers/test-binaries-image/Dockerfile_fips
@@ -6,7 +6,7 @@
 # we need a separate dockerfile for the fips test image so that the integration tests
 # use the right ciphers etc.
 
-FROM golang:1.26.1-bookworm as build-env
+FROM golang:1.26.2-bookworm as build-env
 WORKDIR /work
 COPY . .
 ARG GOPROXY
diff --git a/pipelines/shared-tasks/build-cli-binaries/task.yml b/pipelines/shared-tasks/build-cli-binaries/task.yml
index 45cb387a4..f25c48662 100644
--- a/pipelines/shared-tasks/build-cli-binaries/task.yml
+++ b/pipelines/shared-tasks/build-cli-binaries/task.yml
@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.26.1'
+    tag: '1.26.2'
 inputs:
   - name: pinniped
   - name: pinniped-ci
diff --git a/pipelines/shared-tasks/confirm-built-with-fips/task.yml b/pipelines/shared-tasks/confirm-built-with-fips/task.yml
index 0d1f4e244..696209f3d 100644
--- a/pipelines/shared-tasks/confirm-built-with-fips/task.yml
+++ b/pipelines/shared-tasks/confirm-built-with-fips/task.yml
@@ -10,6 +10,6 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.26.1'
+    tag: '1.26.2'
 run:
   path: pinniped-ci/pipelines/shared-tasks/confirm-built-with-fips/task.sh
diff --git a/pipelines/shared-tasks/confirm-version/task.yml b/pipelines/shared-tasks/confirm-version/task.yml
index a7c819281..2ea1b59cb 100644
--- a/pipelines/shared-tasks/confirm-version/task.yml
+++ b/pipelines/shared-tasks/confirm-version/task.yml
@@ -10,7 +10,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.26.1'
+    tag: '1.26.2'
 run:
   # Confirm that the correct git sha was baked into the executables and that they log the version as their
   # first line of output. Do this by directly running the server binary from the rootfs of the built image.
diff --git a/pipelines/shared-tasks/format-release/task.yml b/pipelines/shared-tasks/format-release/task.yml
index f08461d65..978750009 100644
--- a/pipelines/shared-tasks/format-release/task.yml
+++ b/pipelines/shared-tasks/format-release/task.yml
@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.26.1'
+    tag: '1.26.2'
 inputs:
   - name: pinniped
   - name: release-semver
diff --git a/pipelines/shared-tasks/run-go-vuln-scan/task.yml b/pipelines/shared-tasks/run-go-vuln-scan/task.yml
index 33b502e43..9111d5035 100644
--- a/pipelines/shared-tasks/run-go-vuln-scan/task.yml
+++ b/pipelines/shared-tasks/run-go-vuln-scan/task.yml
@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.26.1'
+    tag: '1.26.2'
 inputs:
   - name: pinniped
   - name: pinniped-ci
diff --git a/pipelines/shared-tasks/run-unit-tests/task.yml b/pipelines/shared-tasks/run-unit-tests/task.yml
index cb635d857..1d9b44f77 100644
--- a/pipelines/shared-tasks/run-unit-tests/task.yml
+++ b/pipelines/shared-tasks/run-unit-tests/task.yml
@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.26.1'
+    tag: '1.26.2'
 inputs:
   - name: pinniped
   - name: pinniped-ci
diff --git a/pipelines/shared-tasks/run-verify-go-generate/task.yml b/pipelines/shared-tasks/run-verify-go-generate/task.yml
index d4e249f80..940adc94e 100644
--- a/pipelines/shared-tasks/run-verify-go-generate/task.yml
+++ b/pipelines/shared-tasks/run-verify-go-generate/task.yml
@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.26.1'
+    tag: '1.26.2'
 inputs:
   - name: pinniped
   - name: pinniped-ci
diff --git a/pipelines/shared-tasks/run-verify-go-mod-tidy/task.yml b/pipelines/shared-tasks/run-verify-go-mod-tidy/task.yml
index 4348eff60..f1b4accf9 100644
--- a/pipelines/shared-tasks/run-verify-go-mod-tidy/task.yml
+++ b/pipelines/shared-tasks/run-verify-go-mod-tidy/task.yml
@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.26.1'
+    tag: '1.26.2'
 inputs:
   - name: pinniped
   - name: pinniped-ci
diff --git a/pipelines/shared-tasks/run-verify-lint/task.yml b/pipelines/shared-tasks/run-verify-lint/task.yml
index a822ca829..7386c6d52 100644
--- a/pipelines/shared-tasks/run-verify-lint/task.yml
+++ b/pipelines/shared-tasks/run-verify-lint/task.yml
@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.26.1'
+    tag: '1.26.2'
 inputs:
   - name: pinniped
   - name: pinniped-ci
diff --git a/pipelines/shared-tasks/update-version-and-cli-docs/task.sh b/pipelines/shared-tasks/update-version-and-cli-docs/task.sh
index 7a89c384b..f705b908f 100755
--- a/pipelines/shared-tasks/update-version-and-cli-docs/task.sh
+++ b/pipelines/shared-tasks/update-version-and-cli-docs/task.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-# Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
+# Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
 set -euo pipefail
@@ -26,7 +26,7 @@ if ! echo "$kube_version" | grep -Eq '^[0-9]+\.[0-9]+$'; then
 fi
 
 echo "Installing yq..."
-curl --retry-connrefused --retry 5 -fLo /usr/local/bin/yq https://github.com/mikefarah/yq/releases/download/v4.45.1/yq_linux_amd64
+curl --retry-connrefused --retry 5 -fLo /usr/local/bin/yq https://github.com/mikefarah/yq/releases/download/v4.53.2/yq_linux_amd64
 chmod +x /usr/local/bin/yq
 
 # cd to the output repo.
diff --git a/pipelines/shared-tasks/update-version-and-cli-docs/task.yml b/pipelines/shared-tasks/update-version-and-cli-docs/task.yml
index 3dfd640dc..7faad4c0b 100644
--- a/pipelines/shared-tasks/update-version-and-cli-docs/task.yml
+++ b/pipelines/shared-tasks/update-version-and-cli-docs/task.yml
@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.26.1'
+    tag: '1.26.2'
 inputs:
   - name: pinniped-ci
   - name: github-final-release