diff --git a/.golangci.yml b/.golangci.yml
index 6a2cbbef8926..0ba84ce6d1f6 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,6 +1,6 @@
 run:
   timeout: 10m
-  go: "1.21"
+  go: "1.22"
   build-tags:
     - tools
     - e2e
diff --git a/Makefile b/Makefile
index 9b28ac32e76f..87b5453baa16 100644
--- a/Makefile
+++ b/Makefile
@@ -23,7 +23,7 @@ SHELL:=/usr/bin/env bash
 #
 # Go.
 #
-GO_VERSION ?= 1.21.11
+GO_VERSION ?= 1.22.4
 GO_DIRECTIVE_VERSION ?= 1.20
 GO_CONTAINER_IMAGE ?= docker.io/library/golang:$(GO_VERSION)
 
diff --git a/Tiltfile b/Tiltfile
index 04ff80bae3ad..3eb5d11e8eac 100644
--- a/Tiltfile
+++ b/Tiltfile
@@ -184,9 +184,9 @@ def load_provider_tiltfiles():
 
 tilt_helper_dockerfile_header = """
 # Tilt image
-FROM golang:1.21.11 as tilt-helper
+FROM golang:1.22.4 as tilt-helper
 # Install delve. Note this should be kept in step with the Go release minor version.
-RUN go install github.com/go-delve/delve/cmd/dlv@v1.21
+RUN go install github.com/go-delve/delve/cmd/dlv@v1.22
 # Support live reloading with Tilt
 RUN wget --output-document /restart.sh --quiet https://raw.githubusercontent.com/tilt-dev/rerun-process-wrapper/master/restart.sh  && \
     wget --output-document /start.sh --quiet https://raw.githubusercontent.com/tilt-dev/rerun-process-wrapper/master/start.sh && \
@@ -195,7 +195,7 @@ RUN wget --output-document /restart.sh --quiet https://raw.githubusercontent.com
 """
 
 tilt_dockerfile_header = """
-FROM golang:1.21.11 as tilt
+FROM golang:1.22.4 as tilt
 WORKDIR /
 COPY --from=tilt-helper /process.txt .
 COPY --from=tilt-helper /start.sh .
diff --git a/cloudbuild-nightly.yaml b/cloudbuild-nightly.yaml
index 663788ba95b9..a99bedf039fd 100644
--- a/cloudbuild-nightly.yaml
+++ b/cloudbuild-nightly.yaml
@@ -5,7 +5,7 @@ options:
   substitution_option: ALLOW_LOOSE
   machineType: 'E2_HIGHCPU_8'
 steps:
-  - name: 'gcr.io/k8s-staging-test-infra/gcb-docker-gcloud:v20230522-312425ae46'
+  - name: 'gcr.io/k8s-staging-test-infra/gcb-docker-gcloud@sha256:de53ba7cd20326776a00adb065430a8bb51beaf24876ffcbd4e8f71b74dbc22d' # v20240210-29014a6e3a
     entrypoint: make
     env:
     - DOCKER_CLI_EXPERIMENTAL=enabled
diff --git a/cloudbuild.yaml b/cloudbuild.yaml
index 1ef17030d2e2..6616174055de 100644
--- a/cloudbuild.yaml
+++ b/cloudbuild.yaml
@@ -5,7 +5,7 @@ options:
   substitution_option: ALLOW_LOOSE
   machineType: 'E2_HIGHCPU_8'
 steps:
-  - name: 'gcr.io/k8s-staging-test-infra/gcb-docker-gcloud:v20230522-312425ae46'
+  - name: 'gcr.io/k8s-staging-test-infra/gcb-docker-gcloud@sha256:de53ba7cd20326776a00adb065430a8bb51beaf24876ffcbd4e8f71b74dbc22d' # v20240210-29014a6e3a
     entrypoint: make
     env:
     - DOCKER_CLI_EXPERIMENTAL=enabled
@@ -17,4 +17,4 @@ substitutions:
   # _GIT_TAG will be filled with a git-based tag for the image, of the form vYYYYMMDD-hash, and
   # can be used as a substitution
   _GIT_TAG: '12345'
-  _PULL_BASE_REF: 'dev'
\ No newline at end of file
+  _PULL_BASE_REF: 'dev'
diff --git a/hack/ensure-go.sh b/hack/ensure-go.sh
index 96f0567f86c5..b5cbed218d81 100755
--- a/hack/ensure-go.sh
+++ b/hack/ensure-go.sh
@@ -38,7 +38,7 @@ EOF
   local go_version
   IFS=" " read -ra go_version <<< "$(go version)"
   local minimum_go_version
-  minimum_go_version=go1.21
+  minimum_go_version=go1.22
   if [[ "${minimum_go_version}" != $(echo -e "${minimum_go_version}\n${go_version[2]}" | sort -s -t. -k 1,1 -k 2,2n -k 3,3n | head -n1) && "${go_version[2]}" != "devel" ]]; then
     cat <<EOF
 Detected go version: ${go_version[*]}.