diff --git a/Dockerfile b/Dockerfile
index ddaba48ac6..1a798c51c0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -51,9 +51,9 @@ RUN  --mount=type=cache,target=/root/.cache/go-build \
     --mount=type=cache,target=/root/.local/share/golang \
     if [ ${CRYPTO_LIB} ]; \
     then \
-      GOARCH=${ARCH} go-build-fips.sh -a -o manager main.go ;\
+      GOARCH=${ARCH} go-build-fips.sh -a -o manager sigs.k8s.io/cluster-api-provider-aws ;\
     else \
-      GOARCH=${ARCH} go-build-static.sh -a -o manager main.go ;\
+      GOARCH=${ARCH} go-build-static.sh -a -o manager sigs.k8s.io/cluster-api-provider-aws ;\
     fi
 RUN if [ "${CRYPTO_LIB}" ]; then assert-static.sh manager; fi
 RUN if [ "${CRYPTO_LIB}" ]; then assert-fips.sh manager; fi
diff --git a/Makefile b/Makefile
index ea47b9b9a5..8d86b325ee 100644
--- a/Makefile
+++ b/Makefile
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-BUILDER_GOLANG_VERSION ?= 1.21
+BUILDER_GOLANG_VERSION ?= 1.21.6
 ROOT_DIR_RELATIVE := .
 
 include $(ROOT_DIR_RELATIVE)/common.mk
diff --git a/util/flags/tls_boring.go b/util/flags/tls_boring.go
index 3de4464020..5d69fff920 100644
--- a/util/flags/tls_boring.go
+++ b/util/flags/tls_boring.go
@@ -9,5 +9,5 @@ func InsecureSkipVerify(insecureSkipVerify bool) bool {
 }
 
 func GetTlsMaxVersion() uint16 {
-	return tls.VersionTLS12
+	return tls.VersionTLS13
 }