diff --git a/Containerfile b/Containerfile
index 6c70564..4a9bdd7 100644
--- a/Containerfile
+++ b/Containerfile
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.25.7@sha256:5a79b94c34c299ac0361fbb7c7fca6dc552e166b42341050323fa3ab137d7be9 AS builder
+FROM golang:1.26.3@sha256:2d6c80227255c3112a4d08e67ba98e58efd3846daf15d9d7d4c389565d881b1a AS builder
 
 # Optional Go build tags (e.g. "otel" for OpenTelemetry support).
 # Default (empty) produces a standard build without optional features.
diff --git a/Containerfile.cli-stack.rh b/Containerfile.cli-stack.rh
index c2419dd..54a4795 100644
--- a/Containerfile.cli-stack.rh
+++ b/Containerfile.cli-stack.rh
@@ -3,7 +3,7 @@ FROM --platform=linux/arm64   quay.io/securesign/model-transparency-go@sha256:3d
 FROM --platform=linux/ppc64le quay.io/securesign/model-transparency-go@sha256:928348002b9119ea40585573b06141129bd83d7f5e4889e87b0f55e8427c84e0 AS build-ppc64le
 FROM --platform=linux/s390x   quay.io/securesign/model-transparency-go@sha256:2450dab5714b6870cdaf892fbcd06d65a0bc933e6a4acabd4b34b7b7e3781e69 AS build-s390x
 
-FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:12db9874bd753eb98b1ab3d840e75de5d6842ac0604fbd68c012adefe97140be AS packager
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:5b74fce9d6e629942a0c6dc0f546c193e70d7f974d999a48c948c53dd3d36362 AS packager
 USER root
 RUN mkdir -p /binaries
 
@@ -31,7 +31,7 @@ COPY --from=build-amd64 /usr/local/bin/model_transparency_cli_darwin_arm64.tar.g
 COPY --from=build-amd64 /usr/local/bin/model_transparency_cli_windows_amd64.exe.gz /binaries/
 
 # Final minimal image with all binaries
-FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:12db9874bd753eb98b1ab3d840e75de5d6842ac0604fbd68c012adefe97140be
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:5b74fce9d6e629942a0c6dc0f546c193e70d7f974d999a48c948c53dd3d36362
 
 LABEL description="Flat image containing model-transparency CLI binaries for all platforms and architectures"
 LABEL io.k8s.description="Flat image containing model-transparency CLI binaries for all platforms and architectures"
diff --git a/Containerfile.model-transparency-go.rh b/Containerfile.model-transparency-go.rh
index 5e6c654..85b9997 100644
--- a/Containerfile.model-transparency-go.rh
+++ b/Containerfile.model-transparency-go.rh
@@ -1,4 +1,4 @@
-FROM registry.redhat.io/ubi9/go-toolset:9.7-1778504036@sha256:2c17ce45c735ad308240139d807eeb22f4499fd90e883634ba5a191779f1ff94 AS build-env
+FROM registry.redhat.io/ubi9/go-toolset:9.8-1779769584@sha256:a82d974dae02330d0669fb0a5ced2ae498bd1bd708359d61493b9fb0dc0748eb AS build-env
 
 ARG BUILD_TAGS=""
 
@@ -47,7 +47,7 @@ RUN set -euo pipefail; \
         -o "model_transparency_cli_otel_linux_${NATIVE_ARCH}" ./cmd/model-signing; \
     tar czf "model_transparency_cli_otel_linux_${NATIVE_ARCH}.tar.gz" "model_transparency_cli_otel_linux_${NATIVE_ARCH}"
 
-FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:12db9874bd753eb98b1ab3d840e75de5d6842ac0604fbd68c012adefe97140be
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:5b74fce9d6e629942a0c6dc0f546c193e70d7f974d999a48c948c53dd3d36362
 
 COPY --from=build-env /opt/app-root/src/model_transparency_cli /usr/local/bin/model_transparency_cli
 COPY --from=build-env /opt/app-root/src/model_transparency_cli_linux_*.tar.gz /usr/local/bin/
diff --git a/Containerfile.pkcs11 b/Containerfile.pkcs11
index fa99f6a..f66db31 100644
--- a/Containerfile.pkcs11
+++ b/Containerfile.pkcs11
@@ -19,7 +19,7 @@
 # For hardware HSMs, bind-mount your vendor's PKCS#11 module at runtime
 # and pass the module path via --pkcs11-uri module-path attribute.
 
-FROM golang:1.25.7@sha256:5a79b94c34c299ac0361fbb7c7fca6dc552e166b42341050323fa3ab137d7be9 AS builder
+FROM golang:1.26.3@sha256:2d6c80227255c3112a4d08e67ba98e58efd3846daf15d9d7d4c389565d881b1a AS builder
 
 # Optional Go build tags (e.g. "otel" for OpenTelemetry support).
 # Default (empty) produces a standard build without optional features.