diff --git a/Makefile b/Makefile
index d1f468ce6b..072d297c98 100644
--- a/Makefile
+++ b/Makefile
@@ -20,8 +20,8 @@ include $(ROOT_DIR_RELATIVE)/common.mk
 # https://suva.sh/posts/well-documented-makefiles
 
 # Go
-GO_VERSION ?=1.21.7
-GO_CONTAINER_IMAGE ?= public.ecr.aws/docker/library/golang:$(GO_VERSION)
+GO_VERSION ?=1.21.5
+GO_CONTAINER_IMAGE ?= golang:$(GO_VERSION)
 
 # Directories.
 ARTIFACTS ?= $(REPO_ROOT)/_artifacts
@@ -610,12 +610,11 @@ release-binary: $(RELEASE_DIR) versions.mk build-toolchain ## Release binary
 		-e CGO_ENABLED=0 \
 		-e GOOS=$(GOOS) \
 		-e GOARCH=$(GOARCH) \
-		--mount=source=gocache,target=/go/pkg/mod \
-		--mount=source=gocache,target=/root/.cache/go-build \
+		-e GOCACHE=/tmp/ \
+		--user $$(id -u):$$(id -g) \
 		-v "$$(pwd):/workspace$(DOCKER_VOL_OPTS)" \
 		-w /workspace \
-		$(TOOLCHAIN_IMAGE) \
-		git config --global --add safe.directory /workspace; \
+		$(GO_CONTAINER_IMAGE) \
 		go build -ldflags '$(LDFLAGS) -extldflags "-static"' \
 		-o $(RELEASE_DIR)/$(notdir $(RELEASE_BINARY))-$(GOOS)-$(GOARCH)$(EXT) $(RELEASE_BINARY)
 
diff --git a/cloudbuild-nightly.yaml b/cloudbuild-nightly.yaml
index 3979d51979..d46ac1edfc 100644
--- a/cloudbuild-nightly.yaml
+++ b/cloudbuild-nightly.yaml
@@ -3,7 +3,7 @@ timeout: 3000s
 options:
   substitution_option: ALLOW_LOOSE
 steps:
-  - name: 'gcr.io/k8s-staging-test-infra/gcb-docker-gcloud:v20220609-2e4c91eb7e'
+  - name: 'gcr.io/k8s-staging-test-infra/gcb-docker-gcloud:v20240210-29014a6e3a'
     entrypoint: make
     env:
       - DOCKER_CLI_EXPERIMENTAL=enabled
diff --git a/cloudbuild.yaml b/cloudbuild.yaml
index f8a71c1b0c..182ca60d03 100644
--- a/cloudbuild.yaml
+++ b/cloudbuild.yaml
@@ -3,7 +3,7 @@ timeout: 3000s
 options:
   substitution_option: ALLOW_LOOSE
 steps:
-  - name: 'gcr.io/k8s-staging-test-infra/gcb-docker-gcloud:v20220609-2e4c91eb7e'
+  - name: 'gcr.io/k8s-staging-test-infra/gcb-docker-gcloud:v20240210-29014a6e3a'
     entrypoint: make
     env:
     - DOCKER_CLI_EXPERIMENTAL=enabled
diff --git a/docs/triage-party/Dockerfile b/docs/triage-party/Dockerfile
index 320b3d651a..e777bd19db 100644
--- a/docs/triage-party/Dockerfile
+++ b/docs/triage-party/Dockerfile
@@ -15,7 +15,7 @@
 # limitations under the License.
 
 
-FROM golang:1.21.7  as builder
+FROM golang:1.21.5  as builder
 
 RUN go get github.com/google/triage-party/cmd/server
 RUN go install github.com/google/triage-party/cmd/server@latest
diff --git a/go.mod b/go.mod
index 540a7aa812..049866d47a 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,8 @@ module sigs.k8s.io/cluster-api-provider-aws/v2
 
 go 1.21
 
+toolchain go1.21.5
+
 replace sigs.k8s.io/cluster-api => sigs.k8s.io/cluster-api v1.5.3
 
 require (
diff --git a/hack/ensure-go.sh b/hack/ensure-go.sh
index d9ee6800ae..da92d977da 100755
--- a/hack/ensure-go.sh
+++ b/hack/ensure-go.sh
@@ -29,9 +29,9 @@ EOF
   fi
 
   local go_version
-  IFS=" " read -ra go_version <<< "$(go version)"
+  IFS=" " read -ra go_version <<<"$(go version)"
   local minimum_go_version
-  minimum_go_version=go1.21.7
+  minimum_go_version=go1.21.5
   if [[ "${minimum_go_version}" != $(echo -e "${minimum_go_version}\n${go_version[2]}" | sort -s -t. -k 1,1 -k 2,2n -k 3,3n | head -n1) && "${go_version[2]}" != "devel" ]]; then
     cat <<EOF
 Detected go version: ${go_version[*]}.
diff --git a/hack/tools/go.mod b/hack/tools/go.mod
index c527c0a64b..2b87395e5e 100644
--- a/hack/tools/go.mod
+++ b/hack/tools/go.mod
@@ -2,6 +2,8 @@ module sigs.k8s.io/cluster-api-provider-aws/hack/tools
 
 go 1.21
 
+toolchain go1.21.5
+
 require (
 	github.com/a8m/envsubst v1.4.2
 	github.com/ahmetb/gen-crd-api-reference-docs v0.3.0
diff --git a/netlify.toml b/netlify.toml
index a9c626f368..8d00611e0a 100644
--- a/netlify.toml
+++ b/netlify.toml
@@ -4,7 +4,7 @@
     publish = "docs/book/book"
 
 [build.environment]
-    GO_VERSION = "1.21.7"
+    GO_VERSION = "1.21.5"
 
 # Standard Netlify redirects
 [[redirects]]