diff --git a/.github/workflows/build-publish-mcr.yml b/.github/workflows/build-publish-mcr.yml
index ee54c6f0..0fbb033b 100644
--- a/.github/workflows/build-publish-mcr.yml
+++ b/.github/workflows/build-publish-mcr.yml
@@ -17,7 +17,7 @@ env:
   # `public` indicates images to MCR wil be publicly available, and will be removed in the final MCR images
   REGISTRY_REPO: public/aks/fleet
 
-  GO_VERSION: '1.24.13'
+  GO_VERSION: '1.25.8'
 
 jobs:
   prepare-variables:
diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml
index 5c4e8488..913e177b 100644
--- a/.github/workflows/e2e-tests.yml
+++ b/.github/workflows/e2e-tests.yml
@@ -13,7 +13,7 @@ permissions:
   contents: read
 
 env:
-  GO_VERSION: '1.24.13'
+  GO_VERSION: '1.25.8'
 
 jobs:
   detect-noop:
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 6682db08..cd8a3f23 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -14,7 +14,7 @@ on:
 
 env:
   # Common versions
-  GO_VERSION: '1.24.13'
+  GO_VERSION: '1.25.8'
 
 jobs:
 
diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml
index 105176df..3b3262dc 100644
--- a/.github/workflows/publish-image.yml
+++ b/.github/workflows/publish-image.yml
@@ -19,7 +19,7 @@ env:
   REGISTRY: ghcr.io
   IMAGE_VERSION: latest
 
-  GO_VERSION: '1.24.13'
+  GO_VERSION: '1.25.8'
 
 jobs:
   export-registry:
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index 4f4846c9..5eadc14f 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -18,7 +18,7 @@ env:
   MEMBER_NET_CONTROLLER_MANAGER_IMAGE_NAME: member-net-controller-manager
   MCS_CONTROLLER_MANAGER_IMAGE_NAME: mcs-controller-manager
 
-  GO_VERSION: '1.24.13'
+  GO_VERSION: '1.25.8'
 
 jobs:
   export-registry:
diff --git a/.github/workflows/unit-integration-tests.yml b/.github/workflows/unit-integration-tests.yml
index d220e50f..4ccedf44 100644
--- a/.github/workflows/unit-integration-tests.yml
+++ b/.github/workflows/unit-integration-tests.yml
@@ -16,7 +16,7 @@ permissions:
   contents: read
 
 env:
-  GO_VERSION: '1.24.13'
+  GO_VERSION: '1.25.8'
 
 jobs:
   detect-noop:
diff --git a/Makefile b/Makefile
index b64e70c9..d8bc01b6 100644
--- a/Makefile
+++ b/Makefile
@@ -47,7 +47,7 @@ TOOLS_BIN_DIR := $(abspath $(TOOLS_DIR)/bin)
 # Binaries
 # Note: Need to use abspath so we can invoke these from subdirectories
 
-CONTROLLER_GEN_VER := v0.16.0
+CONTROLLER_GEN_VER := v0.20.0
 CONTROLLER_GEN_BIN := controller-gen
 CONTROLLER_GEN := $(abspath $(TOOLS_BIN_DIR)/$(CONTROLLER_GEN_BIN)-$(CONTROLLER_GEN_VER))
 
diff --git a/api/v1alpha1/serviceimport_types.go b/api/v1alpha1/serviceimport_types.go
index 041066e6..03588f8d 100644
--- a/api/v1alpha1/serviceimport_types.go
+++ b/api/v1alpha1/serviceimport_types.go
@@ -50,6 +50,7 @@ type ServicePort struct {
 	// The IP protocol for this port. Supports "TCP", "UDP", and "SCTP".
 	// Default is TCP.
 	// +kubebuilder:validation:Enum:=TCP;UDP;SCTP
+	// +kubebuilder:default=TCP
 	Protocol corev1.Protocol `json:"protocol,omitempty"`
 
 	// The application protocol for this port.
diff --git a/config/crd/bases/networking.fleet.azure.com_endpointsliceexports.yaml b/config/crd/bases/networking.fleet.azure.com_endpointsliceexports.yaml
index 3da4c8ea..02fb8b69 100644
--- a/config/crd/bases/networking.fleet.azure.com_endpointsliceexports.yaml
+++ b/config/crd/bases/networking.fleet.azure.com_endpointsliceexports.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: endpointsliceexports.networking.fleet.azure.com
 spec:
   group: networking.fleet.azure.com
@@ -181,7 +181,6 @@ spec:
                       format: int32
                       type: integer
                     protocol:
-                      default: TCP
                       description: |-
                         protocol represents the IP protocol for this port.
                         Must be UDP, TCP, or SCTP.
diff --git a/config/crd/bases/networking.fleet.azure.com_endpointsliceimports.yaml b/config/crd/bases/networking.fleet.azure.com_endpointsliceimports.yaml
index 5beb8f84..03a90a5d 100644
--- a/config/crd/bases/networking.fleet.azure.com_endpointsliceimports.yaml
+++ b/config/crd/bases/networking.fleet.azure.com_endpointsliceimports.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: endpointsliceimports.networking.fleet.azure.com
 spec:
   group: networking.fleet.azure.com
@@ -181,7 +181,6 @@ spec:
                       format: int32
                       type: integer
                     protocol:
-                      default: TCP
                       description: |-
                         protocol represents the IP protocol for this port.
                         Must be UDP, TCP, or SCTP.
diff --git a/config/crd/bases/networking.fleet.azure.com_internalserviceexports.yaml b/config/crd/bases/networking.fleet.azure.com_internalserviceexports.yaml
index 23c0ad54..33558d5a 100644
--- a/config/crd/bases/networking.fleet.azure.com_internalserviceexports.yaml
+++ b/config/crd/bases/networking.fleet.azure.com_internalserviceexports.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: internalserviceexports.networking.fleet.azure.com
 spec:
   group: networking.fleet.azure.com
diff --git a/config/crd/bases/networking.fleet.azure.com_internalserviceimports.yaml b/config/crd/bases/networking.fleet.azure.com_internalserviceimports.yaml
index f510d07d..f159ca88 100644
--- a/config/crd/bases/networking.fleet.azure.com_internalserviceimports.yaml
+++ b/config/crd/bases/networking.fleet.azure.com_internalserviceimports.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: internalserviceimports.networking.fleet.azure.com
 spec:
   group: networking.fleet.azure.com
diff --git a/config/crd/bases/networking.fleet.azure.com_multiclusterservices.yaml b/config/crd/bases/networking.fleet.azure.com_multiclusterservices.yaml
index 8e95b845..a688f2d7 100644
--- a/config/crd/bases/networking.fleet.azure.com_multiclusterservices.yaml
+++ b/config/crd/bases/networking.fleet.azure.com_multiclusterservices.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: multiclusterservices.networking.fleet.azure.com
 spec:
   group: networking.fleet.azure.com
@@ -190,7 +190,6 @@ spec:
                                 format: int32
                                 type: integer
                               protocol:
-                                default: TCP
                                 description: |-
                                   Protocol is the protocol of the service port of which status is recorded here
                                   The supported values are: "TCP", "UDP", "SCTP"
diff --git a/config/crd/bases/networking.fleet.azure.com_serviceexports.yaml b/config/crd/bases/networking.fleet.azure.com_serviceexports.yaml
index ed97a3a5..b47f1bc2 100644
--- a/config/crd/bases/networking.fleet.azure.com_serviceexports.yaml
+++ b/config/crd/bases/networking.fleet.azure.com_serviceexports.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: serviceexports.networking.fleet.azure.com
 spec:
   group: networking.fleet.azure.com
diff --git a/config/crd/bases/networking.fleet.azure.com_serviceimports.yaml b/config/crd/bases/networking.fleet.azure.com_serviceimports.yaml
index 0c939371..6d6e5e9d 100644
--- a/config/crd/bases/networking.fleet.azure.com_serviceimports.yaml
+++ b/config/crd/bases/networking.fleet.azure.com_serviceimports.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: serviceimports.networking.fleet.azure.com
 spec:
   group: networking.fleet.azure.com
diff --git a/config/crd/bases/networking.fleet.azure.com_trafficmanagerbackends.yaml b/config/crd/bases/networking.fleet.azure.com_trafficmanagerbackends.yaml
index 91da3cd5..67bfe7bc 100644
--- a/config/crd/bases/networking.fleet.azure.com_trafficmanagerbackends.yaml
+++ b/config/crd/bases/networking.fleet.azure.com_trafficmanagerbackends.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: trafficmanagerbackends.networking.fleet.azure.com
 spec:
   group: networking.fleet.azure.com
diff --git a/config/crd/bases/networking.fleet.azure.com_trafficmanagerprofiles.yaml b/config/crd/bases/networking.fleet.azure.com_trafficmanagerprofiles.yaml
index 65a65400..7c4278a9 100644
--- a/config/crd/bases/networking.fleet.azure.com_trafficmanagerprofiles.yaml
+++ b/config/crd/bases/networking.fleet.azure.com_trafficmanagerprofiles.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: trafficmanagerprofiles.networking.fleet.azure.com
 spec:
   group: networking.fleet.azure.com
diff --git a/docker/hub-net-controller-manager.Dockerfile b/docker/hub-net-controller-manager.Dockerfile
index 40c19943..bf9f49c5 100644
--- a/docker/hub-net-controller-manager.Dockerfile
+++ b/docker/hub-net-controller-manager.Dockerfile
@@ -1,5 +1,5 @@
 # Build the hub-net-controller-manager binary
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.24.13 AS builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8 AS builder
 
 ARG GOOS=linux
 ARG GOARCH=amd64
diff --git a/docker/mcs-controller-manager.Dockerfile b/docker/mcs-controller-manager.Dockerfile
index 5196b5f1..d4bf373d 100644
--- a/docker/mcs-controller-manager.Dockerfile
+++ b/docker/mcs-controller-manager.Dockerfile
@@ -1,5 +1,5 @@
 # Build the mcs-controller-manager binary
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.24.13 AS builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8 AS builder
 
 ARG GOOS=linux
 ARG GOARCH=amd64
diff --git a/docker/member-net-controller-manager.Dockerfile b/docker/member-net-controller-manager.Dockerfile
index 1a12026c..c16b80bb 100644
--- a/docker/member-net-controller-manager.Dockerfile
+++ b/docker/member-net-controller-manager.Dockerfile
@@ -1,5 +1,5 @@
 # Build the member-net-controller-manager binary
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.24.13 AS builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8 AS builder
 
 ARG GOOS=linux
 ARG GOARCH=amd64
diff --git a/docker/net-crd-installer.Dockerfile b/docker/net-crd-installer.Dockerfile
index da28c132..407eb2b5 100644
--- a/docker/net-crd-installer.Dockerfile
+++ b/docker/net-crd-installer.Dockerfile
@@ -1,5 +1,5 @@
 # Build the net-crd-installer binary
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.24.13 AS builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8 AS builder
 
 ARG GOOS=linux
 ARG GOARCH=amd64
diff --git a/go.mod b/go.mod
index e74ac301..45af5e23 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module go.goms.io/fleet-networking
 
-go 1.24.13
+go 1.25.8
 
 require go.goms.io/fleet v0.14.0