diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index f5a1d4d26..8079efb57 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -92,7 +92,7 @@ jobs:
     steps:
     - uses: actions/setup-go@v6
       with:
-        go-version: '1.24.x'
+        go-version: '1.25.x'
     - name: Install k3d
       run: |
         wget -q -O - https://raw.githubusercontent.com/rancher/k3d/v5.8.3/install.sh | bash
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 62a67e9d1..4b3ce8376 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -38,7 +38,7 @@ jobs:
         fetch-depth: '0'
     - uses: actions/setup-go@v6
       with:
-        go-version: '1.24.x'
+        go-version: '1.25.x'
     - name: golangci-lint
       uses: golangci/golangci-lint-action@v9.2.0
       with:
@@ -241,7 +241,7 @@ jobs:
     steps:
     - uses: actions/setup-go@v6
       with:
-        go-version: '1.24.x'
+        go-version: '1.25.x'
     - name: Install k3d
       run: |
         wget -q -O - https://raw.githubusercontent.com/rancher/k3d/v5.8.3/install.sh | bash
@@ -271,7 +271,7 @@ jobs:
     steps:
     - uses: actions/setup-go@v6
       with:
-        go-version: '1.24.x'
+        go-version: '1.25.x'
     - name: Install k3d
       run: |
         wget -q -O - https://raw.githubusercontent.com/rancher/k3d/v5.8.3/install.sh | bash
@@ -316,7 +316,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.24.x'
+          go-version: '1.25.x'
       - uses: actions/checkout@v6
         with:
           path: src/github.com/containerd/stargz-snapshotter
diff --git a/Dockerfile b/Dockerfile
index bc356831b..9eb6ac70b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -34,10 +34,10 @@ ARG CRI_TOOLS_VERSION=v1.30.1
 # Legacy builder that doesn't support TARGETARCH should set this explicitly using --build-arg.
 # If TARGETARCH isn't supported by the builder, the default value is "amd64".
 
-FROM golang:1.24-bullseye AS golang-base
+FROM golang:1.25-bookworm AS golang-base
 
 # Build containerd
-FROM --platform=$BUILDPLATFORM golang:1.24-bullseye AS containerd-dev
+FROM --platform=$BUILDPLATFORM golang:1.25-bookworm AS containerd-dev
 ARG CONTAINERD_VERSION
 ARG TARGETARCH
 RUN git clone -b ${CONTAINERD_VERSION} --depth 1 \
@@ -46,7 +46,7 @@ RUN git clone -b ${CONTAINERD_VERSION} --depth 1 \
     GOARCH=$TARGETARCH make && DESTDIR=/out/ PREFIX= make install
 
 # Build containerd with builtin stargz snapshotter
-FROM --platform=$BUILDPLATFORM golang:1.24-bullseye AS containerd-snapshotter-dev
+FROM --platform=$BUILDPLATFORM golang:1.25-bookworm AS containerd-snapshotter-dev
 ARG CONTAINERD_VERSION
 ARG TARGETARCH
 COPY . $GOPATH/src/github.com/containerd/stargz-snapshotter
@@ -69,7 +69,7 @@ RUN git clone -b ${CONTAINERD_VERSION} --depth 1 \
     make vendor && GOARCH=$TARGETARCH make && DESTDIR=/out/ PREFIX= make install
 
 # Build runc
-FROM golang:1.24-bullseye AS runc-dev
+FROM golang:1.25-bookworm AS runc-dev
 ARG RUNC_VERSION
 RUN apt-get update -y && apt-get install -y libseccomp-dev && \
     git clone -b ${RUNC_VERSION} --depth 1 \
@@ -78,7 +78,7 @@ RUN apt-get update -y && apt-get install -y libseccomp-dev && \
     make && make install PREFIX=/out/
 
 # Build stargz snapshotter
-FROM --platform=$BUILDPLATFORM golang:1.24-bullseye AS snapshotter-dev
+FROM --platform=$BUILDPLATFORM golang:1.25-bookworm AS snapshotter-dev
 ARG TARGETARCH
 ARG GOARM
 ARG SNAPSHOTTER_BUILD_FLAGS
@@ -112,7 +112,7 @@ RUN apt-get update -y && apt-get install -y libseccomp-dev libgpgme-dev && \
 
 # Build CRI-O
 # FROM golang-base AS cri-o-dev
-FROM golang:1.24-bullseye AS cri-o-dev
+FROM golang:1.25-bookworm AS cri-o-dev
 ARG CRIO_VERSION
 RUN apt-get update -y && apt-get install -y libseccomp-dev libgpgme-dev && \
     git clone https://github.com/cri-o/cri-o $GOPATH/src/github.com/cri-o/cri-o && \
diff --git a/script/cri-containerd/test.sh b/script/cri-containerd/test.sh
index 6a86a0410..e6a5381e9 100755
--- a/script/cri-containerd/test.sh
+++ b/script/cri-containerd/test.sh
@@ -153,7 +153,7 @@ ENV PATH=$PATH:/usr/local/go/bin
 ENV GOPATH=/go
 # Do not install git and its dependencies here which will cause failure of building the image
 RUN apt-get update && apt-get install -y --no-install-recommends make && \
-    curl -Ls https://dl.google.com/go/go1.24.0.linux-\${TARGETARCH:-amd64}.tar.gz | tar -C /usr/local -xz && \
+    curl -Ls https://dl.google.com/go/go1.25.3.linux-\${TARGETARCH:-amd64}.tar.gz | tar -C /usr/local -xz && \
     go install github.com/onsi/ginkgo/ginkgo@${GINKGO_VERSION} && \
     mkdir -p \${GOPATH}/src/github.com/kubernetes-sigs/cri-tools /tmp/cri-tools && \
     curl -sL https://github.com/kubernetes-sigs/cri-tools/archive/refs/tags/v${CRI_TOOLS_VERSION}.tar.gz | tar -C /tmp/cri-tools -xz && \
diff --git a/script/cri-o/test.sh b/script/cri-o/test.sh
index 6caf89188..635238e9e 100755
--- a/script/cri-o/test.sh
+++ b/script/cri-o/test.sh
@@ -66,7 +66,7 @@ ENV PATH=$PATH:/usr/local/go/bin
 ENV GOPATH=/go
 # Do not install git and its dependencies here which will cause failure of building the image
 RUN apt-get update && apt-get install -y --no-install-recommends make && \
-    curl -Ls https://dl.google.com/go/go1.24.0.linux-\${TARGETARCH:-amd64}.tar.gz | tar -C /usr/local -xz && \
+    curl -Ls https://dl.google.com/go/go1.25.3.linux-\${TARGETARCH:-amd64}.tar.gz | tar -C /usr/local -xz && \
     go install github.com/onsi/ginkgo/ginkgo@${GINKGO_VERSION} && \
     mkdir -p \${GOPATH}/src/github.com/kubernetes-sigs/cri-tools /tmp/cri-tools && \
     curl -sL https://github.com/kubernetes-sigs/cri-tools/archive/refs/tags/v${CRI_TOOLS_VERSION}.tar.gz | tar -C /tmp/cri-tools -xz && \
diff --git a/script/integration/test.sh b/script/integration/test.sh
index 4ed7c6a0e..75e6f06b2 100755
--- a/script/integration/test.sh
+++ b/script/integration/test.sh
@@ -101,7 +101,7 @@ cat <<EOF > "${TMP_CONTEXT}/Dockerfile"
 FROM ${INTEGRATION_BASE_IMAGE_NAME}
 
 RUN apt-get update -y && \
-    apt-get --no-install-recommends install -y iptables jq netcat && \
+    apt-get install -y iptables jq netcat-openbsd && \
     go install github.com/google/crfs/stargz/stargzify@71d77da419c90be7b05d12e59945ac7a8c94a543 && \
     wget https://dist.ipfs.io/go-ipfs/${IPFS_VERSION}/go-ipfs_${IPFS_VERSION}_linux-amd64.tar.gz && \
     tar -xvzf go-ipfs_${IPFS_VERSION}_linux-amd64.tar.gz && \