diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d1b2ef075..9efc1533b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -49,9 +49,9 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Go
-        uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: "1.25.6"
+          go-version-file: 'go.mod'
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index c2a0f41dc..e8d7c3628 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -24,25 +24,26 @@ jobs:
           - artifact-cas
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
-        with:
-          go-version: "1.25.6"
-
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
+      - name: Set up Go
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        with:
+          go-version-file: 'go.mod'
+
       - name: Lint main module
-        uses: golangci/golangci-lint-action@1481404843c368bc19ca9406f87d6e0fc97bdcfd # 7.0.0
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # 9.2.0
         if: ${{ matrix.app == 'main-module' }}
         with:
-          version: v2.4.0
+          version: v2.9.0
           only-new-issues: 'true'
 
       - name: Lint ${{ matrix.app }}
-        uses: golangci/golangci-lint-action@1481404843c368bc19ca9406f87d6e0fc97bdcfd # 7.0.0
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # 9.2.0
         if: ${{ matrix.app != 'main-module' }}
         with:
           working-directory: app/${{ matrix.app }}
-          version: v2.4.0
+          version: v2.9.0
           only-new-issues: 'true'
 
   lint-protos:
@@ -65,19 +66,20 @@ jobs:
           cd ~/.local
           curl -L https://dl.dagger.io/dagger/install.sh | DAGGER_VERSION=0.19.3  sh
 
-      - uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
-        with:
-          go-version: "1.25.6"
-
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
+      - name: Set up Go
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        with:
+          go-version-file: 'go.mod'
+
       - name: Initialize module
         run: |
           make -C extras/dagger module-init
 
       - name: Lint
-        uses: golangci/golangci-lint-action@1481404843c368bc19ca9406f87d6e0fc97bdcfd # 7.0.0
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # 9.2.0
         with:
           working-directory: extras/dagger
-          version: v2.4.0
+          version: v2.9.0
           only-new-issues: 'true'
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 8d7e8b377..18f46fbc9 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -79,9 +79,9 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Go
-        uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: "1.25.6"
+          go-version-file: 'go.mod'
 
       # install qemu binaries for multiarch builds (needed by goreleaser/buildx)
       - name: Setup qemu
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index fa704b78a..8c79db808 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -25,10 +25,10 @@ jobs:
           - artifact-cas
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
+      - name: Set up Go
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: "1.25.6"
-          cache: true
+          go-version-file: 'go.mod'
           cache-dependency-path: go.sum
 
       - name: Go Module tidy check
diff --git a/CLAUDE.md b/CLAUDE.md
index b0a6a13aa..bb2c6c4b8 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -135,7 +135,7 @@ make migration_lint         # Lint migration files
 
 ## Key Technologies
 
-- **Language**: Go 1.25.6
+- **Language**: Go 1.26.0
 - **API**: gRPC with HTTP/JSON gateway, Protocol Buffers with buf
 - **Database**: PostgreSQL with Ent ORM, Atlas for migrations
 - **Authentication**: OIDC, JWT tokens
diff --git a/app/artifact-cas/Dockerfile.goreleaser b/app/artifact-cas/Dockerfile.goreleaser
index 4255b6d5a..0eda87c33 100644
--- a/app/artifact-cas/Dockerfile.goreleaser
+++ b/app/artifact-cas/Dockerfile.goreleaser
@@ -1,4 +1,4 @@
-FROM golang:1.25.6@sha256:ce63a16e0f7063787ebb4eb28e72d477b00b4726f79874b3205a965ffd797ab2 AS builder
+FROM golang:1.26.0@sha256:75ca321c953ce0572c709fa186cff872a510a22d6dad515291c6eb29edb9c849 AS builder
 
 FROM scratch
 
diff --git a/app/cli/Dockerfile.goreleaser b/app/cli/Dockerfile.goreleaser
index e6e1ffe65..e54a9fadb 100644
--- a/app/cli/Dockerfile.goreleaser
+++ b/app/cli/Dockerfile.goreleaser
@@ -1,4 +1,4 @@
-FROM golang:1.25.6@sha256:ce63a16e0f7063787ebb4eb28e72d477b00b4726f79874b3205a965ffd797ab2 AS builder
+FROM golang:1.26.0@sha256:75ca321c953ce0572c709fa186cff872a510a22d6dad515291c6eb29edb9c849 AS builder
 RUN mkdir -p /.config/chainloop
 
 FROM scratch
diff --git a/app/controlplane/Dockerfile.goreleaser b/app/controlplane/Dockerfile.goreleaser
index 785eb63f1..f9c89e778 100644
--- a/app/controlplane/Dockerfile.goreleaser
+++ b/app/controlplane/Dockerfile.goreleaser
@@ -1,4 +1,4 @@
-FROM golang:1.25.6@sha256:ce63a16e0f7063787ebb4eb28e72d477b00b4726f79874b3205a965ffd797ab2 AS builder
+FROM golang:1.26.0@sha256:75ca321c953ce0572c709fa186cff872a510a22d6dad515291c6eb29edb9c849 AS builder
 
 FROM scratch
 
diff --git a/docs/examples/ci-workflows/github.yaml b/docs/examples/ci-workflows/github.yaml
index 0f8c32622..bd5c8fe6f 100644
--- a/docs/examples/ci-workflows/github.yaml
+++ b/docs/examples/ci-workflows/github.yaml
@@ -39,9 +39,9 @@ jobs:
           chainloop attestation init --workflow $CHAINLOOP_WORKFLOW_NAME --project $CHAINLOOP_PROJECT_NAME
 
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: "1.25.5"
+          go-version-file: 'go.mod'
 
       # Generate SBOM using syft in cycloneDX format
       - uses: anchore/sbom-action@v0
diff --git a/go.mod b/go.mod
index 0aa2a6238..78b164a28 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/chainloop-dev/chainloop
 
-go 1.25.6
+go 1.26.0
 
 require (
 	cloud.google.com/go/secretmanager v1.16.0