diff --git a/Containerfile.external-dns-operator b/Containerfile.external-dns-operator
index f73d565f..6ae3fb24 100644
--- a/Containerfile.external-dns-operator
+++ b/Containerfile.external-dns-operator
@@ -9,7 +9,7 @@ COPY Dockerfile .
 RUN test "$(sha1sum Dockerfile.cached | cut -d' ' -f1)" = "$(sha1sum Dockerfile | cut -d' ' -f1)"
 
 
-FROM registry.access.redhat.com/ubi9/go-toolset:1.25.9-1778675823 as builder
+FROM registry.access.redhat.com/ubi9/go-toolset:1.25.11 as builder
 # dummy copy to trigger the drift detection
 COPY --from=drift /app/Dockerfile.cached .
 WORKDIR /workspace
diff --git a/Dockerfile b/Dockerfile
index 3b7cbd0f..c50ead38 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM registry.access.redhat.com/ubi9/go-toolset:1.25 as builder
+FROM registry.access.redhat.com/ubi9/go-toolset:1.25.11 as builder
 
 WORKDIR /opt/app-root/src
 COPY . .
diff --git a/drift-cache/Dockerfile b/drift-cache/Dockerfile
index 3b7cbd0f..c50ead38 100644
--- a/drift-cache/Dockerfile
+++ b/drift-cache/Dockerfile
@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM registry.access.redhat.com/ubi9/go-toolset:1.25 as builder
+FROM registry.access.redhat.com/ubi9/go-toolset:1.25.11 as builder
 
 WORKDIR /opt/app-root/src
 COPY . .
diff --git a/go.mod b/go.mod
index 7a72056f..3f48ec5e 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,8 @@ module github.com/openshift/external-dns-operator
 
 go 1.25.0
 
+toolchain go1.25.11
+
 require (
 	github.com/Azure/azure-sdk-for-go v60.1.0+incompatible
 	github.com/Azure/go-autorest/autorest v0.11.27