diff --git a/docs/content/contributing/getting-started.md b/docs/content/contributing/getting-started.md
index ad59d28a79c..cac1f60ec6d 100644
--- a/docs/content/contributing/getting-started.md
+++ b/docs/content/contributing/getting-started.md
@@ -3,7 +3,7 @@
 ## Prerequisites
 
 1. Clone the [kcp-dev/kcp](https://github.com/kcp-dev/kcp) repository.
-2. [Install Go](https://golang.org/doc/install) (currently 1.23.10).
+2. [Install Go](https://golang.org/doc/install) (at least 1.23).
 3. Install [kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl).
 
 Please note that the go language version numbers in these files must exactly agree: go/go.mod file, kcp/Dockerfile, and in all the kcp/.github/workflows yaml files that specify go-version. In kcp/Dockerfile it is indicated by the "golang" attribute. In go.mod it is indicated by the "go" directive." In the .github/workflows yaml files it is indicated by "go-version".
diff --git a/docs/generators/cli-doc/go.mod b/docs/generators/cli-doc/go.mod
index bfabb58e1c3..8d2c539f647 100644
--- a/docs/generators/cli-doc/go.mod
+++ b/docs/generators/cli-doc/go.mod
@@ -1,6 +1,6 @@
 module github.com/kcp-dev/kcp/docs/generators/cli-doc
 
-go 1.23.7
+go 1.23.0
 
 require (
 	github.com/kcp-dev/kcp v0.0.0-00010101000000-000000000000
diff --git a/docs/generators/cli-doc/go.sum b/docs/generators/cli-doc/go.sum
index 967c97923ad..fabcd827d4c 100644
--- a/docs/generators/cli-doc/go.sum
+++ b/docs/generators/cli-doc/go.sum
@@ -69,8 +69,8 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/kcp-dev/apimachinery/v2 v2.0.1-0.20250512171935-ebb573a40077 h1:lDi9nZ75ypmRJwDFXUN70Cdu8+HxAjPU1kcnn+l4MvI=
 github.com/kcp-dev/apimachinery/v2 v2.0.1-0.20250512171935-ebb573a40077/go.mod h1:jnMZxVnCuKlkIXc4J1Qtmy1Lyo171CDF/RQhNAo0tvA=
-github.com/kcp-dev/client-go v0.0.0-20250512170835-5457a0f4bd98 h1:A1Hc2zVGd9LRSQqlGGqfzin+4skWJVcsNXw2+MjU6z4=
-github.com/kcp-dev/client-go v0.0.0-20250512170835-5457a0f4bd98/go.mod h1:79pmlxmvE/hohqD/qvhKaaoXmNDF/uhKnnAO6Vf5hZk=
+github.com/kcp-dev/client-go v0.0.0-20250707095244-decc4df45adb h1:PTfc4FGjz1Dx+6epz92G4RJj3BYrqg0+XYTiGJQR1cc=
+github.com/kcp-dev/client-go v0.0.0-20250707095244-decc4df45adb/go.mod h1:iv3cC1ShwBGzFfNjB+6KWvZviWPe6+MbRlQ7SZoZPFc=
 github.com/kcp-dev/logicalcluster/v3 v3.0.5 h1:JbYakokb+5Uinz09oTXomSUJVQsqfxEvU4RyHUYxHOU=
 github.com/kcp-dev/logicalcluster/v3 v3.0.5/go.mod h1:EWBUBxdr49fUB1cLMO4nOdBWmYifLbP1LfoL20KkXYY=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
@@ -150,8 +150,8 @@ go.opentelemetry.io/otel v1.33.0 h1:/FerN9bax5LoK51X/sI0SVYrjSE0/yUL7DpxW4K3FWw=
 go.opentelemetry.io/otel v1.33.0/go.mod h1:SUUkR6csvUQl+yjReHu5uM3EtVV7MBm5FHKRlNx4I8I=
 go.opentelemetry.io/otel/trace v1.33.0 h1:cCJuF7LRjUFso9LPnEAHJDB2pqzp+hbO8eu1qqW2d/s=
 go.opentelemetry.io/otel/trace v1.33.0/go.mod h1:uIcdVUZMpTAmz0tI1z04GoVSezK37CbGV4fr1f2nBck=
-go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
-go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/goleak v1.3.1-0.20241121203838-4ff5fa6529ee h1:uOMbcH1Dmxv45VkkpZQYoerZFeDncWpjbN7ATiQOO7c=
+go.uber.org/goleak v1.3.1-0.20241121203838-4ff5fa6529ee/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
diff --git a/go.mod b/go.mod
index 2e2a9566f59..5dbe4b12245 100644
--- a/go.mod
+++ b/go.mod
@@ -1,5 +1,12 @@
 module github.com/kcp-dev/kcp
 
+// Two Go versions are maintained - the minimum supported Go version as
+// noted in the go directive and the build version used in PROW and GHA
+// jobs and Docker builds as noted in the comment.
+// The script hack/verify-go-versions.sh checks that all version
+// references across the codebase are consistent with the versions
+// maintained here.
+// go-build-version 1.23.10
 go 1.23.0
 
 require (
diff --git a/hack/verify-go-versions.sh b/hack/verify-go-versions.sh
index 86344e68214..7ca521595a8 100755
--- a/hack/verify-go-versions.sh
+++ b/hack/verify-go-versions.sh
@@ -17,20 +17,62 @@
 set -e
 set -o pipefail
 
-VERSION=$(grep "go 1." go.mod | sed 's/go //' | sed 's/.0$//')
+gomod_version() {
+    awk '/^go / { print $2 }' "$1" | sed 's/.0$//'
+}
 
-grep "FROM .* docker.io/golang:" Dockerfile | { ! grep -v "${VERSION}"; } || { echo "Wrong go version in Dockerfile, expected ${VERSION}"; exit 1; }
-grep -w "go-version:" .github/workflows/*.yaml | { ! grep -v "go-version: v${VERSION}"; } || { echo "Wrong go version in .github/workflows/*.yaml, expected ${VERSION}"; exit 1; }
+minimum_go_version="$(gomod_version go.mod)"
+build_go_version="$(awk '/go-build-version/ { print $3 }' go.mod)"
+errors=0
 
-shopt -s dotglob
-# Note CONTRIBUTING.md isn't copied in the Dockerfile
-for f in docs/content/contributing/getting-started.md; do
-  grep "golang.org/doc/install" "$f" | { ! grep -v "${VERSION}"; } || { echo "Wrong go version in $f; expected ${VERSION}"; exit 1; }
+echo "Verifying minimum Go version: $minimum_go_version"
+
+for gomod in $(git ls-files '**/go.mod'); do
+    if [[ "$(gomod_version $gomod)" != "$minimum_go_version" ]]; then
+        echo "  Wrong go version in $gomod, expected $minimum_go_version"
+        errors=$((errors + 1))
+    fi
+done
+
+if ! grep "golang.org/doc/install" $(git ls-files 'docs/**/*.md') | grep -q "$minimum_go_version"; then
+    echo "  Wrong go version in docs/content/contributing/getting-started.md; expected $minimum_go_version"
+fi
+
+echo "Verifying build Go version: $build_go_version"
+
+for dockerfile in $(git ls-files Dockerfile '**/Dockerfile'); do
+    for version in $(sed -nE -e '/^FROM .*golang:/ s#^.*:([1-9.-rc]+).*$#\1#p' "$dockerfile"); do
+        if [[ "$version" != "$build_go_version" ]]; then
+            echo "  Wrong go version in $dockerfile, expected $build_go_version, found $version"
+            errors=$((errors + 1))
+        fi
+    done
 done
 
-# Check prow config
-grep "ghcr.io/kcp-dev/infra/build" ".prow.yaml" | { ! grep -v "${VERSION}"; } || { echo "Wrong go version in .prow.yaml; expected ${VERSION}"; exit 1; }
+for workflow in $(git ls-files '.github/workflows/*.yaml' '.github/workflows/*.yml'); do
+    if grep -q 'go-version-file:' "$workflow"; then
+        echo "  Workflow $workflow uses go-version-file, should use go-version instead"
+        errors=$((errors + 1))
+    fi
 
-if [ -z "${IGNORE_GO_VERSION}" ]; then
-  go version | { ! grep -v go${VERSION}; } || { echo "Unexpected go version installed, expected ${VERSION}. Use IGNORE_GO_VERSION=1 to skip this check."; exit 1; }
+    for version in $(sed -nE -e '/go-version:/ s#^.*v([1-9.-rc]+)$#\1#p' "$workflow"); do
+        if [[ "$version" != "$build_go_version" ]]; then
+            echo "  Wrong go version in $workflow, expected v${build_go_version}, found v${version}"
+            errors=$((errors + 1))
+        fi
+    done
+done
+
+for prow_image_version in $(sed -nE -e '/kcp-dev\/infra/ s#^.*:([1-9.-rc]+)-[1-9]+.*$#\1#p' .prow.yaml); do
+    if [[ "$prow_image_version" != "$build_go_version" ]]; then
+        echo "  Wrong go version in .prow.yaml, expected ${build_go_version}, found ${prow_image_version}"
+        errors=$((errors + 1))
+    fi
+done
+
+if [[ "$CI" == true ]] && ! go version | grep -q "go${build_go_version}"; then
+    echo "  Wrong go version detected, expected ${build_go_version}"
+    errors=$((errors + 1))
 fi
+
+exit $errors