diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 97866413320d0..88abe294e9d1f 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,6 +1,6 @@
 {
     "name": "linkerd2",
-    "image": "ghcr.io/linkerd/dev:v47",
+    "image": "ghcr.io/linkerd/dev:v48",
     // "dockerFile": "./Dockerfile",
     // "context": "..",
     "features": {
diff --git a/.github/actions/helm-publish/action.yml b/.github/actions/helm-publish/action.yml
index f21d987624a1c..4b55a64de9329 100644
--- a/.github/actions/helm-publish/action.yml
+++ b/.github/actions/helm-publish/action.yml
@@ -5,7 +5,7 @@ runs:
   steps:
   - name: Set up Cloud SDK
     uses: 'google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db'
-  - uses: linkerd/dev/actions/setup-tools@v47
+  - uses: linkerd/dev/actions/setup-tools@v48
   - shell: bash
     run: |
       mkdir -p target/helm
diff --git a/.github/workflows/actions.yml b/.github/workflows/actions.yml
index 313be97a16d5a..f62eee00fed37 100644
--- a/.github/workflows/actions.yml
+++ b/.github/workflows/actions.yml
@@ -14,13 +14,13 @@ jobs:
     runs-on: ${{ vars.LINKERD2_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 10
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v47
+      - uses: linkerd/dev/actions/setup-tools@v48
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - run: just-dev lint-actions
 
   devcontainer-versions:
     runs-on: ${{ vars.LINKERD2_RUNNER || 'ubuntu-24.04' }}
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v47
+      - uses: linkerd/dev/actions/setup-tools@v48
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - run: just-dev check-action-images
diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml
index d40039ffd353d..e8f252b6e7f42 100644
--- a/.github/workflows/codecov.yml
+++ b/.github/workflows/codecov.yml
@@ -14,7 +14,7 @@ jobs:
     timeout-minutes: 30
     runs-on: ${{ vars.LINKERD2_RUNNER || 'ubuntu-24.04' }}
     container:
-      image: golang:1.24
+      image: golang:1.25
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - run: go install gotest.tools/gotestsum@v0.4.2
@@ -51,7 +51,7 @@ jobs:
     runs-on: ${{ vars.LINKERD2_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 15
     container:
-      image: docker://rust:1.88.0
+      image: docker://rust:1.90.0
       options: --security-opt seccomp=unconfined
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index a74c3d25a1a94..933189ace7fa2 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -40,7 +40,7 @@ jobs:
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00
         with:
-          go-version: "1.24"
+          go-version-file: go.mod
 
       - name: Initialize
         # Unpinned action version so that we automatically get analyzer updates.
diff --git a/.github/workflows/devcontainer.yml b/.github/workflows/devcontainer.yml
index f9aecafc83baa..52d888f1b0e05 100644
--- a/.github/workflows/devcontainer.yml
+++ b/.github/workflows/devcontainer.yml
@@ -15,7 +15,7 @@ permissions:
 jobs:
   rust-version:
     runs-on: ${{ vars.LINKERD2_RUNNER || 'ubuntu-24.04' }}
-    container: ghcr.io/linkerd/dev:v47-rust
+    container: ghcr.io/linkerd/dev:v48-rust
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - shell: bash
@@ -39,6 +39,6 @@ jobs:
   devcontainer-image:
     runs-on: ${{ vars.LINKERD2_RUNNER || 'ubuntu-24.04' }}
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v47
+      - uses: linkerd/dev/actions/setup-tools@v48
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - run: just-dev pull-dev-image
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index c97c430d60981..5a51b8e0da743 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -29,7 +29,7 @@ jobs:
     if: needs.meta.outputs.changed == 'true'
     timeout-minutes: 10
     runs-on: ${{ vars.LINKERD2_RUNNER || 'ubuntu-24.04' }}
-    container: ghcr.io/linkerd/dev:v47-go
+    container: ghcr.io/linkerd/dev:v48-go
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
@@ -40,7 +40,7 @@ jobs:
     if: needs.meta.outputs.changed == 'true'
     timeout-minutes: 10
     runs-on: ${{ vars.LINKERD2_RUNNER || 'ubuntu-24.04' }}
-    container: ghcr.io/linkerd/dev:v47-go
+    container: ghcr.io/linkerd/dev:v48-go
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
@@ -51,7 +51,7 @@ jobs:
     if: needs.meta.outputs.changed == 'true'
     timeout-minutes: 30
     runs-on: ${{ vars.LINKERD2_RUNNER || 'ubuntu-24.04' }}
-    container: ghcr.io/linkerd/dev:v47-go
+    container: ghcr.io/linkerd/dev:v48-go
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 7132d0c571708..38c62ce5f07f3 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -122,7 +122,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00
         with:
-          go-version: "1.24"
+          go-version-file: go.mod
       - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
         with:
           pattern: image-archives-*
@@ -275,7 +275,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00
         with:
-          go-version: "1.24"
+          go-version-file: go.mod
       - uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
         if: matrix.integration_test == 'helm-upgrade'
       - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
@@ -305,7 +305,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00
         with:
-          go-version: "1.24"
+          go-version-file: go.mod
       - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
         with:
           pattern: image-archives-*
@@ -344,7 +344,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00
         with:
-          go-version: "1.24"
+          go-version-file: go.mod
       - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
         with:
           pattern: image-archives-*
diff --git a/.github/workflows/proto.yml b/.github/workflows/proto.yml
index 76ea86d865b97..8d5d5d4daf8df 100644
--- a/.github/workflows/proto.yml
+++ b/.github/workflows/proto.yml
@@ -15,7 +15,7 @@ jobs:
   proto-diff:
     timeout-minutes: 10
     runs-on: ${{ vars.LINKERD2_RUNNER || 'ubuntu-24.04' }}
-    container: ghcr.io/linkerd/dev:v47-go
+    container: ghcr.io/linkerd/dev:v48-go
     steps:
       - run: apt update && apt install -y unzip
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 53364c09b7951..19bd13218381f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -101,7 +101,7 @@ jobs:
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00
         with:
-          go-version: "1.24"
+          go-version-file: go.mod
       - uses: ./.github/actions/cli-setup
         with:
           artifact-id: ${{ needs.cli.outputs.artifact-id }}
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index f5dd5cd58572c..479d6b6aae851 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -27,7 +27,7 @@ jobs:
   audit:
     timeout-minutes: 10
     runs-on: ${{ vars.LINKERD2_RUNNER || 'ubuntu-24.04' }}
-    container: ghcr.io/linkerd/dev:v47-rust
+    container: ghcr.io/linkerd/dev:v48-rust
     strategy:
       matrix:
         checks:
@@ -43,7 +43,7 @@ jobs:
   fmt:
     timeout-minutes: 5
     runs-on: ${{ vars.LINKERD2_RUNNER || 'ubuntu-24.04' }}
-    container: ghcr.io/linkerd/dev:v47-rust
+    container: ghcr.io/linkerd/dev:v48-rust
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
@@ -52,7 +52,7 @@ jobs:
   clippy:
     timeout-minutes: 20
     runs-on: ${{ vars.LINKERD2_RUNNER || 'ubuntu-24.04' }}
-    container: ghcr.io/linkerd/dev:v47-rust
+    container: ghcr.io/linkerd/dev:v48-rust
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
@@ -63,7 +63,7 @@ jobs:
   check:
     timeout-minutes: 20
     runs-on: ${{ vars.LINKERD2_RUNNER || 'ubuntu-24.04' }}
-    container: ghcr.io/linkerd/dev:v47-rust
+    container: ghcr.io/linkerd/dev:v48-rust
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
@@ -74,7 +74,7 @@ jobs:
     name: test
     runs-on: ${{ vars.LINKERD2_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 15
-    container: ghcr.io/linkerd/dev:v47-rust
+    container: ghcr.io/linkerd/dev:v48-rust
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
diff --git a/.github/workflows/shell.yml b/.github/workflows/shell.yml
index 61f6818b0ea6f..60cb4b9923fce 100644
--- a/.github/workflows/shell.yml
+++ b/.github/workflows/shell.yml
@@ -16,6 +16,6 @@ jobs:
     timeout-minutes: 10
     runs-on: ${{ vars.LINKERD2_RUNNER || 'ubuntu-24.04' }}
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v47
+      - uses: linkerd/dev/actions/setup-tools@v48
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - run: just sh-lint
diff --git a/Dockerfile-proxy b/Dockerfile-proxy
index c5b911b774e67..e0afeb30c4317 100644
--- a/Dockerfile-proxy
+++ b/Dockerfile-proxy
@@ -2,7 +2,7 @@ ARG RUNTIME_IMAGE=gcr.io/distroless/cc-debian12
 ARG BUILDPLATFORM=linux/amd64
 
 # Precompile key slow-to-build dependencies
-FROM --platform=$BUILDPLATFORM golang:1.24-alpine AS go-deps
+FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS go-deps
 WORKDIR /linkerd-build
 COPY go.mod go.sum ./
 COPY bin/install-deps bin/
diff --git a/Dockerfile.controller b/Dockerfile.controller
index 87370a672ec09..19f0a7b2aaf5e 100644
--- a/Dockerfile.controller
+++ b/Dockerfile.controller
@@ -1,5 +1,5 @@
 # Precompile key slow-to-build dependencies
-FROM --platform=$BUILDPLATFORM golang:1.24-alpine AS go-deps
+FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS go-deps
 WORKDIR /linkerd-build
 COPY go.mod go.sum ./
 COPY bin/install-deps bin/
@@ -21,7 +21,7 @@ COPY multicluster multicluster
 ARG TARGETARCH
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH go build -o /out/controller -tags prod -mod=readonly -ldflags "-s -w" ./controller/cmd
 
-FROM --platform=$BUILDPLATFORM ghcr.io/linkerd/dev:v47-rust-musl AS policy
+FROM --platform=$BUILDPLATFORM ghcr.io/linkerd/dev:v48-rust-musl AS policy
 ARG BUILD_TYPE="release"
 WORKDIR /build
 RUN mkdir -p target/bin
@@ -46,7 +46,7 @@ RUN --mount=type=cache,target=target \
         arm64) echo aarch64-unknown-linux-musl ;; \
         *) echo "unsupported architecture: $TARGETARCH" >&2; exit 1 ;; \
     esac) && \
-    just-cargo CFLAGS_aarch64_unknown_linux_musl="" profile=$BUILD_TYPE target=$target build --package=linkerd-policy-controller && \
+    just-cargo profile=$BUILD_TYPE target=$target build --package=linkerd-policy-controller && \
     mkdir /out && mv "target/$target/$BUILD_TYPE/linkerd-policy-controller" /out/
 
 ## package runtime
diff --git a/cli/Dockerfile b/cli/Dockerfile
index 30d57cf0a6600..eddb2841e66d7 100644
--- a/cli/Dockerfile
+++ b/cli/Dockerfile
@@ -1,7 +1,7 @@
 ARG BUILDPLATFORM=linux/amd64
 
 # Precompile key slow-to-build dependencies
-FROM --platform=$BUILDPLATFORM golang:1.24-alpine AS go-deps
+FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS go-deps
 WORKDIR /linkerd-build
 COPY go.mod go.sum ./
 RUN go mod download
diff --git a/controller/gen/common/net/net.pb.go b/controller/gen/common/net/net.pb.go
index efc9d2ffeba05..b44042c6227b0 100644
--- a/controller/gen/common/net/net.pb.go
+++ b/controller/gen/common/net/net.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.35.2
-// 	protoc        v6.31.1
+// 	protoc        v6.32.1
 // source: common/net.proto
 
 package net
diff --git a/go.mod b/go.mod
index 115a7d01666ec..ee0808fc1f601 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/linkerd/linkerd2
 
-go 1.24.0
+go 1.25.0
 
 require (
 	contrib.go.opencensus.io/exporter/ocagent v0.7.0
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index e88baf106b9e6..ff100edcbbe7c 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,2 +1,2 @@
 [toolchain]
-channel = "1.88.0"
+channel = "1.90.0"
diff --git a/test/integration/deep/dualstack/testdata/ipfamilies-server-client.yml b/test/integration/deep/dualstack/testdata/ipfamilies-server-client.yml
index 2cd540b8ad50a..892773cc89699 100644
--- a/test/integration/deep/dualstack/testdata/ipfamilies-server-client.yml
+++ b/test/integration/deep/dualstack/testdata/ipfamilies-server-client.yml
@@ -15,7 +15,6 @@ spec:
     spec:
       containers:
       - image: ghcr.io/alpeb/family-server:v1
-        image: golang:1.24-alpine
         name: ipfamilies-server
         ports:
         - containerPort: 8080
diff --git a/viz/metrics-api/Dockerfile b/viz/metrics-api/Dockerfile
index 67b3df71d93f3..d065248e7b301 100644
--- a/viz/metrics-api/Dockerfile
+++ b/viz/metrics-api/Dockerfile
@@ -1,7 +1,7 @@
 ARG BUILDPLATFORM=linux/amd64
 
 # Precompile key slow-to-build dependencies
-FROM --platform=$BUILDPLATFORM golang:1.24-alpine AS go-deps
+FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS go-deps
 WORKDIR /linkerd-build
 COPY go.mod go.sum ./
 COPY bin/install-deps bin/
diff --git a/viz/metrics-api/gen/viz/viz.pb.go b/viz/metrics-api/gen/viz/viz.pb.go
index 529176bf7e1f9..8e2e7c876834b 100644
--- a/viz/metrics-api/gen/viz/viz.pb.go
+++ b/viz/metrics-api/gen/viz/viz.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.35.2
-// 	protoc        v6.31.1
+// 	protoc        v6.32.1
 // source: viz.proto
 
 package viz
diff --git a/viz/metrics-api/gen/viz/viz_grpc.pb.go b/viz/metrics-api/gen/viz/viz_grpc.pb.go
index bc00aba0f4708..ce66fbe4fb277 100644
--- a/viz/metrics-api/gen/viz/viz_grpc.pb.go
+++ b/viz/metrics-api/gen/viz/viz_grpc.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
 // - protoc-gen-go-grpc v1.5.1
-// - protoc             v6.31.1
+// - protoc             v6.32.1
 // source: viz.proto
 
 package viz
diff --git a/viz/tap/Dockerfile b/viz/tap/Dockerfile
index 1fa24386194ef..f63de46e4b77d 100644
--- a/viz/tap/Dockerfile
+++ b/viz/tap/Dockerfile
@@ -1,7 +1,7 @@
 ARG BUILDPLATFORM=linux/amd64
 
 # Precompile key slow-to-build dependencies
-FROM --platform=$BUILDPLATFORM golang:1.24-alpine AS go-deps
+FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS go-deps
 WORKDIR /linkerd-build
 COPY go.mod go.sum ./
 COPY bin/install-deps bin/
diff --git a/viz/tap/gen/tap/viz_tap.pb.go b/viz/tap/gen/tap/viz_tap.pb.go
index 02d731cc1e751..5a9f8fa8732de 100644
--- a/viz/tap/gen/tap/viz_tap.pb.go
+++ b/viz/tap/gen/tap/viz_tap.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.35.2
-// 	protoc        v6.31.1
+// 	protoc        v6.32.1
 // source: viz_tap.proto
 
 package tap
diff --git a/viz/tap/gen/tap/viz_tap_grpc.pb.go b/viz/tap/gen/tap/viz_tap_grpc.pb.go
index e6c67668f4eb7..504fffc06f10a 100644
--- a/viz/tap/gen/tap/viz_tap_grpc.pb.go
+++ b/viz/tap/gen/tap/viz_tap_grpc.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
 // - protoc-gen-go-grpc v1.5.1
-// - protoc             v6.31.1
+// - protoc             v6.32.1
 // source: viz_tap.proto
 
 package tap
diff --git a/web/Dockerfile b/web/Dockerfile
index f557dbf8448fc..01cf8599f3a72 100644
--- a/web/Dockerfile
+++ b/web/Dockerfile
@@ -1,7 +1,7 @@
 ARG BUILDPLATFORM=linux/amd64
 
 # Precompile key slow-to-build dependencies
-FROM --platform=$BUILDPLATFORM golang:1.24-alpine AS go-deps
+FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS go-deps
 WORKDIR /linkerd-build
 COPY go.mod go.sum ./
 COPY bin/install-deps bin/