diff --git a/cmd/feedwitness/Dockerfile b/cmd/feedwitness/Dockerfile
index 56bd1b5c..1bd529db 100644
--- a/cmd/feedwitness/Dockerfile
+++ b/cmd/feedwitness/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4ced AS builder
+FROM golang:1.25.13-alpine3.23@sha256:4ce6af6747b07e99ca3a57eadb77565787390a41b0039dcc8e09ec4c57cfa125 AS builder
 
 ARG GOFLAGS=""
 ENV GOFLAGS=$GOFLAGS
diff --git a/cmd/omniwitness_gcp/Dockerfile b/cmd/omniwitness_gcp/Dockerfile
index 2f187ded..442cb583 100644
--- a/cmd/omniwitness_gcp/Dockerfile
+++ b/cmd/omniwitness_gcp/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4ced AS builder
+FROM golang:1.25.13-alpine3.23@sha256:4ce6af6747b07e99ca3a57eadb77565787390a41b0039dcc8e09ec4c57cfa125 AS builder
 
 ARG GOFLAGS=""
 ENV GOFLAGS=$GOFLAGS
diff --git a/go.mod b/go.mod
index bd8a4e10..b48e506a 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,8 @@ module github.com/transparency-dev/witness
 
 go 1.25.0
 
+toolchain go1.25.13
+
 require (
 	cloud.google.com/go/secretmanager v1.21.0
 	cloud.google.com/go/spanner v1.94.0