diff --git a/Makefile b/Makefile
index 206fb42..f53a3fe 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,6 @@
 VERSION ?= v0.3.0
-GO_CONTAINER_IMAGE ?= docker.io/golang:1.25.3
+GO_VERSION := $(shell go list -m -f '{{.GoVersion}}')
+GO_CONTAINER_IMAGE ?= docker.io/golang:$(GO_VERSION)
 
 # Set this to non-empty when building and pushing a release.
 RELEASE ?=
diff --git a/go.mod b/go.mod
index 2ab66f7..fda9d2f 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/oxidecomputer/oxide-cloud-controller-manager
 
-go 1.25.0
+go 1.25.3
 
 require (
 	github.com/google/uuid v1.6.0
diff --git a/tools/go.mod b/tools/go.mod
index 70ab7b0..6759905 100644
--- a/tools/go.mod
+++ b/tools/go.mod
@@ -1,6 +1,6 @@
 module tools
 
-go 1.25.0
+go 1.25.3
 
 tool helm.sh/helm/v4/cmd/helm