diff --git a/.ci/oci.Dockerfile b/.ci/oci.Dockerfile
index ea0a4e305..a1a7e83ad 100644
--- a/.ci/oci.Dockerfile
+++ b/.ci/oci.Dockerfile
@@ -19,6 +19,10 @@ ENV GO_VERSION=1.25.7
 ENV GOROOT=/usr/local/go
 ENV PATH=$GOROOT/bin:$PATH
 
+ENV GO_VERSION=1.25.7
+ENV GOROOT=/usr/local/go
+ENV PATH=$GOROOT/bin:$PATH
+
 SHELL ["/bin/bash", "-c"]
 
 # Install Go 1.25.7 to satisfy go.mod toolchain requirement (go 1.25.0)
@@ -26,7 +30,9 @@ RUN export ARCH="$(uname -m)" && if [[ ${ARCH} == "x86_64" ]]; then export ARCH=
     curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-${ARCH}.tar.gz" -o go.tar.gz && \
     rm -rf /usr/local/go && \
     tar -C /usr/local -xzf go.tar.gz && \
-    rm go.tar.gz
+    rm go.tar.gz && \
+    ln -sf /usr/local/go/bin/go /usr/bin/go.real && \
+    ln -sf /usr/local/go/bin/gofmt /usr/bin/gofmt
 RUN go version
 
 # Temporary workaround since mirror.centos.org is down and can be replaced with vault.centos.org
diff --git a/.github/workflows/code-coverage.yml b/.github/workflows/code-coverage.yml
index b92dc609f..14c4888c0 100644
--- a/.github/workflows/code-coverage.yml
+++ b/.github/workflows/code-coverage.yml
@@ -14,7 +14,7 @@ jobs:
       name: Set up Go 1.x
       uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
-        go-version: 1.24.6
+        go-version: 1.25.7
     -
       name: Set up Python 3.11
       uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa # v4.8.0
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index df77e3725..b5c0b8386 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -15,7 +15,7 @@ jobs:
       name: Set up Go 1.x
       uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
-        go-version: 1.24.6
+        go-version: 1.25.7
     -
       name: Set up Python 3.11
       uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa # v4.8.0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e3d2e1bf1..523e1b70f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,7 +32,7 @@ jobs:
       - name: Set up Go 1.x
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: 1.23.6
+          go-version: 1.25.7
       - name: Set up QEMU
         uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 #v2.2.0
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 71c3359c3..103f3cb92 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -46,7 +46,7 @@ Detailed instructions regarding the DevWorkspace Operator development are provid
 
 To build, test and debug the DevWorkspace Operator the following development tools are required:
 
-- go 1.16 or later
+- go 1.25 or later
 - git
 - sed
 - jq
diff --git a/build/Dockerfile b/build/Dockerfile
index 1188698ef..c67fe6704 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -15,7 +15,8 @@
 
 # https://access.redhat.com/containers/?tab=tags#/registry.access.redhat.com/ubi9/go-toolset
 # Use BUILDPLATFORM to ensure the builder always runs natively on the host machine
-FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:1.24.6-1758501173 AS builder
+# Image pinned by SHA256 to address GitHub security bot warnings about unpinned dependencies
+FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:1.25.7-1771417345@sha256:799cc027d5ad58cdc156b65286eb6389993ec14c496cf748c09834b7251e78dc AS builder
 
 # Accept TARGETARCH and TARGETPLATFORM, which are automatically passed by the builder
 ARG TARGETARCH
diff --git a/go.mod b/go.mod
index 7cb507cb2..b2434fb50 100644
--- a/go.mod
+++ b/go.mod
@@ -1,8 +1,8 @@
 module github.com/devfile/devworkspace-operator
 
-go 1.24.0
+go 1.25.0
 
-toolchain go1.24.6
+toolchain go1.25.7
 
 require (
 	github.com/devfile/api/v2 v2.3.1-alpha.0.20250521155908-5c3d7b99d252
diff --git a/project-clone/Dockerfile b/project-clone/Dockerfile
index c8085887a..dcd6e9895 100644
--- a/project-clone/Dockerfile
+++ b/project-clone/Dockerfile
@@ -15,7 +15,8 @@
 
 # Build the manager binary
 # https://access.redhat.com/containers/?tab=tags#/registry.access.redhat.com/ubi9/go-toolset
-FROM registry.access.redhat.com/ubi9/go-toolset:1.24.6-1758501173 as builder
+# Image pinned by SHA256 to address GitHub security bot warnings about unpinned dependencies
+FROM registry.access.redhat.com/ubi9/go-toolset:1.25.7-1771417345@sha256:799cc027d5ad58cdc156b65286eb6389993ec14c496cf748c09834b7251e78dc as builder
 ARG TARGETARCH
 ARG TARGETOS
 ENV GOPATH=/go/