diff --git a/.changelog/20062.txt b/.changelog/20062.txt
new file mode 100644
index 000000000000..95e7cd6db614
--- /dev/null
+++ b/.changelog/20062.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+Upgrade to use Go 1.21.5.
+```
diff --git a/.github/workflows/reusable-lint.yml b/.github/workflows/reusable-lint.yml
index 2c63d841971e..b834d564918d 100644
--- a/.github/workflows/reusable-lint.yml
+++ b/.github/workflows/reusable-lint.yml
@@ -51,10 +51,12 @@ jobs:
         with:
           go-version: ${{ inputs.go-version }}
       - run: go env
+      - name: Set golangci-lint version
+        run: echo "GOLANGCI_LINT_VERSION=$(make --no-print-directory print-GOLANGCI_LINT_VERSION)" >> $GITHUB_ENV
       - name: lint-${{ matrix.directory }}
         uses: golangci/golangci-lint-action@639cd343e1d3b897ff35927a75193d57cfcba299 # v3.6.0
         with:
           working-directory: ${{ matrix.directory }}
-          version: v1.51.1
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
           args: --build-tags="${{ env.GOTAGS }}" -v
           skip-cache: true
diff --git a/.go-version b/.go-version
index adcfeed91395..ce2dd53570bb 100644
--- a/.go-version
+++ b/.go-version
@@ -1 +1 @@
-1.20.12
\ No newline at end of file
+1.21.5
diff --git a/.golangci.yml b/.golangci.yml
index 0d426b34cd02..b87fa40a2e61 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -98,18 +98,14 @@ linters-settings:
               - google.golang.org/protobuf
 
   depguard:
-    list-type: denylist
-    include-go-root: true
-    # A list of packages for the list type specified.
-    # Default: []
-    packages:
-      - net/rpc
-    # A list of packages for the list type specified.
-    # Specify an error message to output when a denied package is used.
-    # Default: []
-    packages-with-error-message:
-      - net/rpc: "only use forked copy in github.com/hashicorp/consul-net-rpc/net/rpc"
-      - github.com/golang/protobuf: "only use google.golang.org/protobuf"
+    rules:
+      main:
+        listMode: lax
+        deny:
+        - pkg: net/rpc
+          desc: "only use forked copy in github.com/hashicorp/consul-net-rpc/net/rpc"
+        - pkg: github.com/golang/protobuf
+          desc: "only use google.golang.org/protobuf"
 
 run:
   timeout: 10m
diff --git a/Makefile b/Makefile
index 3f609ef962aa..75833c7d6a96 100644
--- a/Makefile
+++ b/Makefile
@@ -10,7 +10,7 @@ GO_MODULES := $(shell find . -name go.mod -exec dirname {} \; | grep -v "proto-g
 # These version variables can either be a valid string for "go install <module>@<version>"
 # or the string @DEV to imply use what is currently installed locally.
 ###
-GOLANGCI_LINT_VERSION='v1.51.1'
+GOLANGCI_LINT_VERSION='v1.55.2'
 MOCKERY_VERSION='v2.37.1'
 BUF_VERSION='v1.26.0'
 
diff --git a/api/api_test.go b/api/api_test.go
index d1af29fbddf7..e8a03f7218cc 100644
--- a/api/api_test.go
+++ b/api/api_test.go
@@ -717,8 +717,11 @@ func TestAPI_ClientTLSOptions(t *testing.T) {
 
 		// Should fail
 		_, err = client.Agent().Self()
-		if err == nil || !strings.Contains(err.Error(), "bad certificate") {
-			t.Fatal(err)
+		// Check for one of the possible cert error messages
+		// See https://cs.opensource.google/go/go/+/62a994837a57a7d0c58bb364b580a389488446c9
+		if err == nil || !(strings.Contains(err.Error(), "tls: bad certificate") ||
+			strings.Contains(err.Error(), "tls: certificate required")) {
+			t.Fatalf("expected tls certificate error, but got '%v'", err)
 		}
 	})
 
diff --git a/internal/mesh/internal/controllers/sidecarproxy/builder/local_app.go b/internal/mesh/internal/controllers/sidecarproxy/builder/local_app.go
index 871cb444bd5d..8405b639c7fa 100644
--- a/internal/mesh/internal/controllers/sidecarproxy/builder/local_app.go
+++ b/internal/mesh/internal/controllers/sidecarproxy/builder/local_app.go
@@ -138,6 +138,7 @@ func destinationRulesByPort(allPorts []string, destinationRules []*pbauth.Destin
 	return out
 }
 
+//nolint:unparam
 func convertDestinationRule(allPorts []string, dr *pbauth.DestinationRule) ([]string, DestinationRule) {
 	ports := make(map[string]struct{})
 	if len(dr.PortNames) > 0 {