diff --git a/Dockerfile b/Dockerfile
index b3544f4d1..8607f572c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,7 +4,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 # Prepare to cross-compile by always running the build stage in the build platform, not the target platform.
-FROM --platform=$BUILDPLATFORM golang:1.21.1 as build-env
+FROM --platform=$BUILDPLATFORM golang:1.21.2 as build-env
 
 WORKDIR /work
 
diff --git a/hack/Dockerfile_fips b/hack/Dockerfile_fips
index 6afe7b7a2..4184db0c0 100644
--- a/hack/Dockerfile_fips
+++ b/hack/Dockerfile_fips
@@ -18,7 +18,7 @@
 
 # This is not currently using --platform to prepare to cross-compile because we use gcc below to build
 # platform-specific GCO code. This makes multi-arch builds slow due to target platform emulation.
-FROM golang:1.21.1 as build-env
+FROM golang:1.21.2 as build-env
 
 WORKDIR /work
 
diff --git a/hack/update-go-mod/go.mod b/hack/update-go-mod/go.mod
index e3b4e5521..64c5f7860 100644
--- a/hack/update-go-mod/go.mod
+++ b/hack/update-go-mod/go.mod
@@ -2,4 +2,4 @@ module go.pinniped.dev/update-go-mod
 
 go 1.20
 
-require golang.org/x/mod v0.12.0
+require golang.org/x/mod v0.13.0
diff --git a/hack/update-go-mod/go.sum b/hack/update-go-mod/go.sum
index 7f791da9c..00726828e 100644
--- a/hack/update-go-mod/go.sum
+++ b/hack/update-go-mod/go.sum
@@ -1,2 +1,2 @@
-golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
-golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.13.0 h1:I/DsJXRlw/8l/0c24sM9yb0T4z9liZTduXvdAWYiysY=
+golang.org/x/mod v0.13.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=