diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 13b46310526..b0c2a818044 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -247,7 +247,7 @@
         // cases it might not be preinstalled, see:
         // https://github.com/renovatebot/renovate/discussions/23485
         // renovate: datasource=golang-version depName=go
-        "commands": ["install-tool golang 1.21.1", "go mod vendor"],
+        "commands": ["install-tool golang 1.21.11", "go mod vendor"],
         "fileFilters": ["**/**"],
         "executionMode": "branch"
       },
diff --git a/.github/workflows/generated-files.yaml b/.github/workflows/generated-files.yaml
index 99a1d280f68..02581ac2774 100644
--- a/.github/workflows/generated-files.yaml
+++ b/.github/workflows/generated-files.yaml
@@ -19,7 +19,7 @@ jobs:
         uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
         with:
           # renovate: datasource=golang-version depName=go
-          go-version: '1.21.1'
+          go-version: '1.21.11'
       - name: Validate that generated files are up to date.
         run: |
           make generate
diff --git a/.github/workflows/gotests.yml b/.github/workflows/gotests.yml
index b5ff5a8f9d7..23690ae96ac 100644
--- a/.github/workflows/gotests.yml
+++ b/.github/workflows/gotests.yml
@@ -26,7 +26,7 @@ jobs:
       uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
       with:
         # renovate: datasource=golang-version depName=go
-        go-version: '1.21.1'
+        go-version: '1.21.11'
 
     - name: Install dependencies
       run: |
diff --git a/.github/workflows/podinfo-test.yaml b/.github/workflows/podinfo-test.yaml
index 4576256c5b3..67551188f1a 100644
--- a/.github/workflows/podinfo-test.yaml
+++ b/.github/workflows/podinfo-test.yaml
@@ -39,7 +39,7 @@ jobs:
       uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
       with:
         # renovate: datasource=golang-version depName=go
-        go-version: '1.21.1'
+        go-version: '1.21.11'
 
     - name: Install Kind and create cluster
       uses: helm/kind-action@v1.5.0
diff --git a/.github/workflows/run-e2e-tests.yaml b/.github/workflows/run-e2e-tests.yaml
index 7163a3e1474..7e1e0956902 100644
--- a/.github/workflows/run-e2e-tests.yaml
+++ b/.github/workflows/run-e2e-tests.yaml
@@ -34,7 +34,7 @@ jobs:
       uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
       with:
         # renovate: datasource=golang-version depName=go
-        go-version: '1.21.1'
+        go-version: '1.21.11'
 
     - name: Set Up Job Variables
       id: vars
diff --git a/.github/workflows/static-checks.yaml b/.github/workflows/static-checks.yaml
index 0ff720afd75..1225d3da395 100644
--- a/.github/workflows/static-checks.yaml
+++ b/.github/workflows/static-checks.yaml
@@ -27,7 +27,7 @@ jobs:
         uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
         with:
           # renovate: datasource=golang-version depName=go
-          go-version: '1.21.1'
+          go-version: '1.21.11'
           # using golangci-lint cache instead
           cache: false
 
@@ -48,7 +48,7 @@ jobs:
         uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
         with:
           # renovate: datasource=golang-version depName=go
-          go-version: '1.21.1'
+          go-version: '1.21.11'
 
       - name: Check gofmt formatting
         run: |
@@ -78,7 +78,7 @@ jobs:
         uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
         with:
           # renovate: datasource=golang-version depName=go
-          go-version: '1.21.1'
+          go-version: '1.21.11'
 
       - name: Check module vendoring
         run: |
diff --git a/.github/workflows/vmtests.yml b/.github/workflows/vmtests.yml
index b25610ea4bf..54188173f76 100644
--- a/.github/workflows/vmtests.yml
+++ b/.github/workflows/vmtests.yml
@@ -22,7 +22,7 @@ jobs:
       uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
       with:
         # renovate: datasource=golang-version depName=go
-        go-version: '1.21.1'
+        go-version: '1.21.11'
 
     - name: Checkout code
       uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
diff --git a/Dockerfile b/Dockerfile
index dfa5fdc9f42..2d270c78d01 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -20,7 +20,7 @@ RUN make tetragon-bpf LOCAL_CLANG=1 TARGET_ARCH=$TARGETARCH
 # Second builder (cross-)compile:
 # - tetragon (pkg/bpf uses CGO, so a gcc cross compiler is needed)
 # - tetra
-FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.21.1@sha256:19600fdcae402165dcdab18cb9649540bde6be7274dedb5d205b2f84029fe909 as tetragon-builder
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.21.11@sha256:2eb85b8942c29145b4a5bed2d0f3dc1a3ba2f823aec74afe16751da108a585e1 as tetragon-builder
 WORKDIR /go/src/github.com/cilium/tetragon
 ARG TETRAGON_VERSION TARGETARCH BUILDARCH
 RUN apt-get update
@@ -33,7 +33,7 @@ RUN if [ $BUILDARCH != $TARGETARCH ]; \
     else make tetragon-image LOCAL_CLANG=1 VERSION=$TETRAGON_VERSION TARGET_ARCH=$TARGETARCH; fi
 
 # Third builder (cross-)compile a stripped gops
-FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.21.1-alpine@sha256:ec31b7fbaf32583af4f4f8c9e0cabc651247624bf962adbb7fa1b54c9c03d5e4 as gops
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.21.11-alpine@sha256:c0ea884eb6fbeff67789797cb565d87995a125d0adc0907e46c6566498fd3ce2 as gops
 ARG TARGETARCH
 RUN apk add --no-cache binutils git \
  && git clone https://github.com/google/gops /go/src/github.com/google/gops \
diff --git a/Dockerfile.dev b/Dockerfile.dev
index 40fe5dd1f2b..a02d3ced43d 100644
--- a/Dockerfile.dev
+++ b/Dockerfile.dev
@@ -9,7 +9,7 @@ FROM quay.io/cilium/cilium-bpftool@sha256:1832b32d118e7006ea2ce530b14ae5b28acd55
 COPY . ./
 
 
-FROM docker.io/library/golang:1.21.1@sha256:19600fdcae402165dcdab18cb9649540bde6be7274dedb5d205b2f84029fe909
+FROM docker.io/library/golang:1.21.11@sha256:2eb85b8942c29145b4a5bed2d0f3dc1a3ba2f823aec74afe16751da108a585e1
 RUN apt-get update -y &&    \
     apt-get upgrade -y &&   \
     apt-get install -y      \
diff --git a/Dockerfile.operator b/Dockerfile.operator
index 7ff94e21915..1cf6848bc36 100644
--- a/Dockerfile.operator
+++ b/Dockerfile.operator
@@ -4,7 +4,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 ARG BASE_IMAGE=scratch
-ARG GOLANG_IMAGE=docker.io/library/golang:1.21.1@sha256:19600fdcae402165dcdab18cb9649540bde6be7274dedb5d205b2f84029fe909
+ARG GOLANG_IMAGE=docker.io/library/golang:1.21.11@sha256:2eb85b8942c29145b4a5bed2d0f3dc1a3ba2f823aec74afe16751da108a585e1
 ARG ALPINE_IMAGE=docker.io/library/alpine:3.18.3@sha256:7144f7bab3d4c2648d7e59409f15ec52a18006a128c733fcff20d3a4a54ba44a
 
 # BUILDPLATFORM is an automatic platform ARG enabled by Docker BuildKit.
diff --git a/Dockerfile.test b/Dockerfile.test
index 813356a88e8..93fb41c9934 100644
--- a/Dockerfile.test
+++ b/Dockerfile.test
@@ -11,7 +11,7 @@ RUN apt-get install -y linux-libc-dev
 COPY . ./
 RUN make tetragon-bpf && pwd
 
-FROM docker.io/library/golang:1.21.1@sha256:19600fdcae402165dcdab18cb9649540bde6be7274dedb5d205b2f84029fe909
+FROM docker.io/library/golang:1.21.11@sha256:2eb85b8942c29145b4a5bed2d0f3dc1a3ba2f823aec74afe16751da108a585e1
 RUN apt-get update
 RUN apt-get install -y linux-libc-dev rpm2cpio cpio git flex bison autoconf libelf-dev bc netcat-traditional
 WORKDIR /go/src/github.com/cilium/tetragon
diff --git a/Makefile.cli b/Makefile.cli
index 36a2565edfc..b4c9c14c326 100644
--- a/Makefile.cli
+++ b/Makefile.cli
@@ -3,7 +3,7 @@
 
 CLI_GO_BUILD = CGO_ENABLED=0 $(GO) build
 # renovate: datasource=docker
-GO_IMAGE = docker.io/library/golang:1.21.1-alpine
+GO_IMAGE = docker.io/library/golang:1.21.11-alpine
 TARGET=tetra
 
 RELEASE_UID ?= $(shell id -u)
diff --git a/api/go.mod b/api/go.mod
index a156debb77f..4882d4aa1e1 100644
--- a/api/go.mod
+++ b/api/go.mod
@@ -1,6 +1,6 @@
 module github.com/cilium/tetragon/api
 
-go 1.21
+go 1.21.11
 
 require (
 	github.com/cilium/tetragon v0.0.0-00010101000000-000000000000
diff --git a/api/vendor/modules.txt b/api/vendor/modules.txt
index 877041ca141..d9519dc70d6 100644
--- a/api/vendor/modules.txt
+++ b/api/vendor/modules.txt
@@ -1,5 +1,5 @@
 # github.com/cilium/tetragon v0.0.0-00010101000000-000000000000 => ../../tetragon
-## explicit; go 1.21
+## explicit; go 1.21.11
 github.com/cilium/tetragon/pkg/matchers/bytesmatcher
 github.com/cilium/tetragon/pkg/matchers/listmatcher
 github.com/cilium/tetragon/pkg/matchers/stringmatcher
diff --git a/go.mod b/go.mod
index 48b2f9bfa64..a8ff07c4c91 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/cilium/tetragon
 
-go 1.21
+go 1.21.11
 
 require (
 	github.com/bombsimon/logrusr/v4 v4.0.0
diff --git a/pkg/k8s/go.mod b/pkg/k8s/go.mod
index 1f31009c0f2..7aa0f2615a7 100644
--- a/pkg/k8s/go.mod
+++ b/pkg/k8s/go.mod
@@ -1,6 +1,6 @@
 module github.com/cilium/tetragon/pkg/k8s
 
-go 1.21
+go 1.21.11
 
 require (
 	github.com/blang/semver/v4 v4.0.0
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 4ca6c7f85d2..2508085c711 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -225,7 +225,7 @@ github.com/cilium/tetragon/api/v1/tetragon/codegen/eventchecker
 github.com/cilium/tetragon/api/v1/tetragon/codegen/eventchecker/yaml
 github.com/cilium/tetragon/api/v1/tetragon/codegen/helpers
 # github.com/cilium/tetragon/pkg/k8s v0.0.0-00010101000000-000000000000 => ./pkg/k8s
-## explicit; go 1.21
+## explicit; go 1.21.11
 github.com/cilium/tetragon/pkg/k8s/apis/cilium.io
 github.com/cilium/tetragon/pkg/k8s/apis/cilium.io/client
 github.com/cilium/tetragon/pkg/k8s/apis/cilium.io/v1alpha1