diff --git a/.github/workflows/pr-dependabot.yaml b/.github/workflows/pr-dependabot.yaml
index 168526a5e..8c4b8db8a 100644
--- a/.github/workflows/pr-dependabot.yaml
+++ b/.github/workflows/pr-dependabot.yaml
@@ -26,8 +26,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # tag=v6.0.0
       with:
-        # go-version: ${{ steps.vars.outputs.go_version }} // TODO: we have to use go version consistent with test infra jobs
-        go-version: '1.25'
+        go-version-file: go.mod
     - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # tag=v5.0.3
       name: Restore go cache
       with:
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 457e0d5f3..a158ab649 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -22,7 +22,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.25'
+          go-version-file: go.mod
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v7
         with:
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index 893f6e339..3838a3159 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -26,7 +26,7 @@ jobs:
         run: |
           make docker-build CONTROLLER_IMG_TAG=cluster-api-operator:ci
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # tag=0.34.2
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # tag=0.35.0
         with:
           image-ref: "cluster-api-operator:ci"
           format: "table"
diff --git a/hack/chart-update/go.mod b/hack/chart-update/go.mod
index 4a26cd821..a671a55d5 100644
--- a/hack/chart-update/go.mod
+++ b/hack/chart-update/go.mod
@@ -1,6 +1,6 @@
 module sigs.k8s.io/cluster-api-operator/hack/chart-update
 
-go 1.25.7
+go 1.25.8
 
 require (
 	github.com/google/go-github/v82 v82.0.0
diff --git a/hack/ensure-go.sh b/hack/ensure-go.sh
index 4f46d9405..254ee7871 100755
--- a/hack/ensure-go.sh
+++ b/hack/ensure-go.sh
@@ -31,7 +31,7 @@ EOF
   local go_version
   IFS=" " read -ra go_version <<< "$(go version)"
   local minimum_go_version
-  minimum_go_version=go1.25.7
+  minimum_go_version=go1.25.8
   if [[ "${minimum_go_version}" != $(echo -e "${minimum_go_version}\n${go_version[2]}" | sort -s -t. -k 1,1 -k 2,2n -k 3,3n | head -n1) && "${go_version[2]}" != "devel" ]]; then
     cat <<EOF
 Detected go version: ${go_version[*]}.
diff --git a/hack/tools/go.mod b/hack/tools/go.mod
index 574fcc1cd..39fdf8735 100644
--- a/hack/tools/go.mod
+++ b/hack/tools/go.mod
@@ -1,6 +1,6 @@
 module sigs.k8s.io/cluster-api-operator/hack/tools
 
-go 1.25.7
+go 1.25.8
 
 replace (
 	sigs.k8s.io/cluster-api => sigs.k8s.io/cluster-api v1.10.0-beta.0
diff --git a/netlify.toml b/netlify.toml
index fec70e443..c04f9ec33 100644
--- a/netlify.toml
+++ b/netlify.toml
@@ -4,7 +4,7 @@
     publish = "docs/book/book"
 
 [build.environment]
-    GO_VERSION = "1.25.7"
+    GO_VERSION = "1.25.8"
 
 # Standard Netlify redirects
 [[redirects]]