diff --git a/client/go.mod b/client/go.mod
index cc1f33a6..ddbe64ee 100644
--- a/client/go.mod
+++ b/client/go.mod
@@ -1,6 +1,6 @@
 module github.com/docker/secrets-engine/client
 
-go 1.25.11
+go 1.25.12
 
 // This `replace` is only for CI to function.
 // The correct version will get resolved from below when this module is
diff --git a/go.work b/go.work
index b356c01a..2f208818 100644
--- a/go.work
+++ b/go.work
@@ -1,4 +1,4 @@
-go 1.25.11
+go 1.25.12
 
 use (
 	./client
diff --git a/plugin/go.mod b/plugin/go.mod
index 3edb5bbf..88dce32b 100644
--- a/plugin/go.mod
+++ b/plugin/go.mod
@@ -1,6 +1,6 @@
 module github.com/docker/secrets-engine/plugin
 
-go 1.25.11
+go 1.25.12
 
 // This `replace` is only for CI to function.
 // The correct version will get resolved from below when this module is
diff --git a/plugins/credentialhelper/go.mod b/plugins/credentialhelper/go.mod
index 1f1d05ba..4249de31 100644
--- a/plugins/credentialhelper/go.mod
+++ b/plugins/credentialhelper/go.mod
@@ -1,6 +1,6 @@
 module github.com/docker/secrets-engine/plugins/credentialhelper
 
-go 1.25.11
+go 1.25.12
 
 // This `replace` is only for CI to function.
 // The correct version will get resolved from below when this module is
diff --git a/plugins/pass/go.mod b/plugins/pass/go.mod
index e57c1894..768edcf5 100644
--- a/plugins/pass/go.mod
+++ b/plugins/pass/go.mod
@@ -1,6 +1,6 @@
 module github.com/docker/secrets-engine/plugins/pass
 
-go 1.25.11
+go 1.25.12
 
 replace github.com/docker/secrets-engine/client => ./../../client
 
diff --git a/store/docker-bake.hcl b/store/docker-bake.hcl
index 8888a3bc..ca409c27 100644
--- a/store/docker-bake.hcl
+++ b/store/docker-bake.hcl
@@ -24,7 +24,7 @@ group "default" {
 }
 
 variable "GO_VERSION" {
-  default = "1.24"
+  default = "1.25.12"
 }
 
 target "fedora_43_gnome_keyring" {
diff --git a/store/go.mod b/store/go.mod
index c0c3fcb8..35881308 100644
--- a/store/go.mod
+++ b/store/go.mod
@@ -1,6 +1,6 @@
 module github.com/docker/secrets-engine/store
 
-go 1.25.11
+go 1.25.12
 
 // This `replace` is only for CI to function.
 // The correct version will get resolved from below when this module is
diff --git a/vendor/modules.txt b/vendor/modules.txt
index d4907616..6724ed35 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -40,13 +40,13 @@ github.com/davecgh/go-spew/spew
 github.com/docker/docker-credential-helpers/client
 github.com/docker/docker-credential-helpers/credentials
 # github.com/docker/secrets-engine/client v0.0.29 => ./client
-## explicit; go 1.25.11
+## explicit; go 1.25.12
 # github.com/docker/secrets-engine/plugin v0.1.0 => ./plugin
-## explicit; go 1.25.11
+## explicit; go 1.25.12
 # github.com/docker/secrets-engine/store v0.2.0 => ./store
-## explicit; go 1.25.11
+## explicit; go 1.25.12
 # github.com/docker/secrets-engine/x v0.1.0-do.not.use => ./x
-## explicit; go 1.25.11
+## explicit; go 1.25.12
 # github.com/go-logr/logr v1.4.3
 ## explicit; go 1.18
 github.com/go-logr/logr
diff --git a/x/go.mod b/x/go.mod
index 7da4bba0..b4c56b8f 100644
--- a/x/go.mod
+++ b/x/go.mod
@@ -1,6 +1,6 @@
 module github.com/docker/secrets-engine/x
 
-go 1.25.11
+go 1.25.12
 
 require (
 	connectrpc.com/connect v1.19.1