diff --git a/.claude/skills/upgrading-golang/SKILL.md b/.claude/skills/upgrading-golang/SKILL.md
index 455700233..962bd387b 100644
--- a/.claude/skills/upgrading-golang/SKILL.md
+++ b/.claude/skills/upgrading-golang/SKILL.md
@@ -99,6 +99,14 @@ FROM arigaio/atlas@sha256:NEW_DIGEST as base
 
 **7c. Update `./common.mk` for `make init`:**
 
+**IMPORTANT**: Before updating the version in common.mk, ALWAYS test that the Atlas version is available via the curl command:
+
+```bash
+curl -sSf https://atlasgo.sh | ATLAS_VERSION=vX.XX.X sh -s -- --version
+```
+
+If the command fails or the version is not available, do NOT update common.mk. Only the Docker image should be updated in this case.
+
 Update the Atlas CLI installation version in the `init` target:
 
 Pattern to replace:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 67d25175f..a68cf2db1 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -48,7 +48,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
         with:
-          go-version: "1.25.3"
+          go-version: "1.25.5"
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 7046b9c7a..56476bdde 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -26,7 +26,7 @@ jobs:
     steps:
       - uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
         with:
-          go-version: "1.25.3"
+          go-version: "1.25.5"
 
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
@@ -67,7 +67,7 @@ jobs:
 
       - uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
         with:
-          go-version: "1.25.3"
+          go-version: "1.25.5"
 
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 5491054c1..6f913f702 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -79,7 +79,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
         with:
-          go-version: "1.25.3"
+          go-version: "1.25.5"
 
       # install qemu binaries for multiarch builds (needed by goreleaser/buildx)
       - name: Setup qemu
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index d8158d3fb..cf2ce154d 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -27,7 +27,7 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
         with:
-          go-version: "1.25.3"
+          go-version: "1.25.5"
           cache: true
           cache-dependency-path: go.sum
 
diff --git a/CLAUDE.md b/CLAUDE.md
index 5ee004a50..1464243ea 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -135,7 +135,7 @@ make migration_lint         # Lint migration files
 
 ## Key Technologies
 
-- **Language**: Go 1.25.3
+- **Language**: Go 1.25.5
 - **API**: gRPC with HTTP/JSON gateway, Protocol Buffers with buf
 - **Database**: PostgreSQL with Ent ORM, Atlas for migrations
 - **Authentication**: OIDC, JWT tokens
diff --git a/app/artifact-cas/Dockerfile b/app/artifact-cas/Dockerfile
index 7928f00c8..e08b3315a 100644
--- a/app/artifact-cas/Dockerfile
+++ b/app/artifact-cas/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.3@sha256:6bac879c5b77e0fc9c556a5ed8920e89dab1709bd510a854903509c828f67f96 AS builder
+FROM golang:1.25.5@sha256:20b91eda7a9627c127c0225b0d4e8ec927b476fa4130c6760928b849d769c149 AS builder
 
 # Not linked libraries since it will be injected into a scratch container
 ENV CGO_ENABLED=0
diff --git a/app/artifact-cas/Dockerfile.goreleaser b/app/artifact-cas/Dockerfile.goreleaser
index 1d088d1b0..50f12570a 100644
--- a/app/artifact-cas/Dockerfile.goreleaser
+++ b/app/artifact-cas/Dockerfile.goreleaser
@@ -1,4 +1,4 @@
-FROM golang:1.25.3@sha256:6bac879c5b77e0fc9c556a5ed8920e89dab1709bd510a854903509c828f67f96 AS builder
+FROM golang:1.25.5@sha256:20b91eda7a9627c127c0225b0d4e8ec927b476fa4130c6760928b849d769c149 AS builder
 
 FROM scratch
 
diff --git a/app/cli/Dockerfile.goreleaser b/app/cli/Dockerfile.goreleaser
index 390959be7..ca89e27d3 100644
--- a/app/cli/Dockerfile.goreleaser
+++ b/app/cli/Dockerfile.goreleaser
@@ -1,4 +1,4 @@
-FROM golang:1.25.3@sha256:6bac879c5b77e0fc9c556a5ed8920e89dab1709bd510a854903509c828f67f96 AS builder
+FROM golang:1.25.5@sha256:20b91eda7a9627c127c0225b0d4e8ec927b476fa4130c6760928b849d769c149 AS builder
 RUN mkdir -p /.config/chainloop
 
 FROM scratch
diff --git a/app/controlplane/Dockerfile b/app/controlplane/Dockerfile
index db7dd9ec5..210c802dc 100644
--- a/app/controlplane/Dockerfile
+++ b/app/controlplane/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.3@sha256:6bac879c5b77e0fc9c556a5ed8920e89dab1709bd510a854903509c828f67f96 AS builder
+FROM golang:1.25.5@sha256:20b91eda7a9627c127c0225b0d4e8ec927b476fa4130c6760928b849d769c149 AS builder
 
 # Not linked libraries since it will be injected into a scratch container
 ENV CGO_ENABLED=0
diff --git a/app/controlplane/Dockerfile.goreleaser b/app/controlplane/Dockerfile.goreleaser
index a0fd3dbf5..182561c8a 100644
--- a/app/controlplane/Dockerfile.goreleaser
+++ b/app/controlplane/Dockerfile.goreleaser
@@ -1,4 +1,4 @@
-FROM golang:1.25.3@sha256:6bac879c5b77e0fc9c556a5ed8920e89dab1709bd510a854903509c828f67f96 AS builder
+FROM golang:1.25.5@sha256:20b91eda7a9627c127c0225b0d4e8ec927b476fa4130c6760928b849d769c149 AS builder
 
 FROM scratch
 
diff --git a/app/controlplane/Dockerfile.migrations b/app/controlplane/Dockerfile.migrations
index ce71389ea..eb818a65c 100644
--- a/app/controlplane/Dockerfile.migrations
+++ b/app/controlplane/Dockerfile.migrations
@@ -2,9 +2,9 @@
 # See https://atlasgo.io/guides/deploying/image
 # NOTE: Updated to canary since there is a vulnerability in the latest stable release
 # from: arigaio/atlas:latest
-# docker run arigaio/atlas@sha256:3d12860d684122d74341cb99b0a31f0bf4a78fa223ebc9b32a1260ad6d0dbe95 version
-# atlas version v0.38.1-6b73979-canary
-FROM arigaio/atlas@sha256:3d12860d684122d74341cb99b0a31f0bf4a78fa223ebc9b32a1260ad6d0dbe95 as base
+# docker run arigaio/atlas@sha256:ea3f647b96cf61010deff910c97f8c092deda1db2be3b2b8f20780668bfcf32c version
+# atlas version v0.38.1-ce311d2-canary
+FROM arigaio/atlas@sha256:ea3f647b96cf61010deff910c97f8c092deda1db2be3b2b8f20780668bfcf32c as base
 
 FROM scratch
 # Update permissions to make it readable by the user
diff --git a/docs/examples/ci-workflows/github.yaml b/docs/examples/ci-workflows/github.yaml
index 89a03dc5d..0f8c32622 100644
--- a/docs/examples/ci-workflows/github.yaml
+++ b/docs/examples/ci-workflows/github.yaml
@@ -41,7 +41,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version: "1.25.3"
+          go-version: "1.25.5"
 
       # Generate SBOM using syft in cycloneDX format
       - uses: anchore/sbom-action@v0
diff --git a/go.mod b/go.mod
index 0a1e20fbc..1ef055b28 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/chainloop-dev/chainloop
 
-go 1.25.3
+go 1.25.5
 
 require (
 	cloud.google.com/go/secretmanager v1.14.5