diff --git a/.tekton/fulcio-pull-request.yaml b/.tekton/fulcio-pull-request.yaml
index 6b7112a43..dbeb461a6 100644
--- a/.tekton/fulcio-pull-request.yaml
+++ b/.tekton/fulcio-pull-request.yaml
@@ -37,15 +37,16 @@ spec:
   - name: hermetic
     value: "true"
   - name: prefetch-input
-    value: [{"path": ".", "type": "gomod"}, {"path": "./hack/tools", "type": "gomod"}]
+    value: '{"type": "gomod", "path": "."}'
   - name: go_unit_test
-    value: true
+    value: "true"
   taskRunSpecs:
-    - pipelineTaskName: run-unit-test
-      serviceAccountName: build-pipeline-fulcio-server-v1-3
-      podTemplate:
-        imagePullSecrets:
-        - name: brew-registry-pull-secret
+  - pipelineTaskName: run-unit-test
+    stepSpecs:
+    - computeResources:
+        limits:
+          memory: 4Gi
+      name: run-tests
   pipelineRef:
     resolver: git
     params:
diff --git a/.tekton/fulcio-push.yaml b/.tekton/fulcio-push.yaml
index 72d3eee6d..be919e9a1 100644
--- a/.tekton/fulcio-push.yaml
+++ b/.tekton/fulcio-push.yaml
@@ -35,15 +35,16 @@ spec:
   - name: hermetic
     value: "true"
   - name: prefetch-input
-    value: [{"path": ".", "type": "gomod"}, {"path": "./hack/tools", "type": "gomod"}]
+    value: '{"type": "gomod", "path": "."}'
   - name: go_unit_test
-    value: true
+    value: "true"
   taskRunSpecs:
-    - pipelineTaskName: run-unit-test
-      serviceAccountName: build-pipeline-fulcio-server-v1-3
-      podTemplate:
-        imagePullSecrets:
-        - name: brew-registry-pull-secret
+  - pipelineTaskName: run-unit-test
+    stepSpecs:
+    - computeResources:
+        limits:
+          memory: 4Gi
+      name: run-tests
   pipelineRef:
     resolver: git
     params:
diff --git a/Dockerfile b/Dockerfile
index 3c2bfdd3a..52e37c3a5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,7 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.26.5@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder
+FROM golang:1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365 AS builder
 ENV APP_ROOT=/opt/app-root
 ENV GOPATH=$APP_ROOT
 
@@ -28,7 +28,7 @@ RUN go build -o server main.go
 RUN CGO_ENABLED=1 go build -gcflags "all=-N -l" -o server_debug main.go
 
 # Multi-Stage production build
-FROM golang:1.26.5@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS deploy
+FROM golang:1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365 AS deploy
 
 # Retrieve the binary from the previous stage
 COPY --from=builder /opt/app-root/src/server /usr/local/bin/fulcio-server
diff --git a/Dockerfile.fulcio-server.rh b/Dockerfile.fulcio-server.rh
index 1d07b5132..6f9128386 100644
--- a/Dockerfile.fulcio-server.rh
+++ b/Dockerfile.fulcio-server.rh
@@ -13,7 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM registry.redhat.io/ubi9/go-toolset:9.8-1783931515@sha256:d8698410eb806fedd5c0ddbd08e981436051e0ed2113b8e402736e7ee578f6f4 AS builder
+FROM registry.redhat.io/ubi9/go-toolset:9.8-1786023237@sha256:ab68fec982623c914717680352d9fff08b584b1e51c446ccebc10ff43fc44d8a AS builder
 
 ENV GOEXPERIMENT=strictfipsruntime
 ENV CGO_ENABLED=1
@@ -29,7 +29,7 @@ RUN go mod download && \
     go build -mod=readonly -o server main.go
 
 # Multi-Stage production build
-FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:8201445bebcb5bd4fe23fcc2a76cd5fec029ab401d270926a1563c03b36f0137 as deploy
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:f865a2497cd915d24bda56e303729009bbd18675592de325a8f05276896f19a1 as deploy
 
 LABEL description="Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity, such as email address."
 LABEL io.k8s.description="Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity, such as email address."
diff --git a/Dockerfile.tesseract b/Dockerfile.tesseract
index 3a8d326ec..299357da1 100644
--- a/Dockerfile.tesseract
+++ b/Dockerfile.tesseract
@@ -16,7 +16,7 @@
 
 FROM ghcr.io/transparency-dev/tesseract/posix:v0.1.1@sha256:8269c32a1b1deb159ba75016421314cb5e68304c2813d444aca3efdf0e9d5027 AS server
 
-FROM golang:1.26.5@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS deploy
+FROM golang:1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365 AS deploy
 
 COPY --from=server /ko-app/posix /usr/local/bin/tesseract