diff --git a/cmd/vulndash/Makefile b/cmd/vulndash/Makefile
index d38a4c148c4..137efd9ac87 100644
--- a/cmd/vulndash/Makefile
+++ b/cmd/vulndash/Makefile
@@ -20,7 +20,7 @@ SHELL=/bin/bash -o pipefail
 
 REGISTRY ?= gcr.io/k8s-staging-artifact-promoter
 IMGNAME = vulndash
-IMAGE_VERSION ?= v0.4.3-6
+IMAGE_VERSION ?= v0.4.3-7
 CONFIG ?= buster
 
 IMAGE = $(REGISTRY)/$(IMGNAME)
@@ -28,7 +28,7 @@ IMAGE = $(REGISTRY)/$(IMGNAME)
 TAG ?= $(shell git describe --tags --always --dirty)
 
 # Build args
-GO_VERSION ?= 1.16.1
+GO_VERSION ?= 1.16.3
 DISTROLESS_IMAGE ?= static-debian10
 
 PLATFORMS ?= linux/amd64
diff --git a/cmd/vulndash/variants.yaml b/cmd/vulndash/variants.yaml
index 433f35c3727..180424e248e 100644
--- a/cmd/vulndash/variants.yaml
+++ b/cmd/vulndash/variants.yaml
@@ -1,5 +1,5 @@
 variants:
   default:
-    IMAGE_VERSION: 'v0.4.3-6'
-    GO_VERSION: '1.16.1'
+    IMAGE_VERSION: 'v0.4.3-7'
+    GO_VERSION: '1.16.3'
     DISTROLESS_IMAGE: 'static-debian10'
diff --git a/dependencies.yaml b/dependencies.yaml
index 28a3d880e5a..19291991e5e 100644
--- a/dependencies.yaml
+++ b/dependencies.yaml
@@ -57,7 +57,7 @@ dependencies:
 
   # Golang
   - name: "golang"
-    version: 1.16.1
+    version: 1.16.3
     refPaths:
     - path: cmd/vulndash/Makefile
       match: GO_VERSION\ \?=\ \d+.\d+(alpha|beta|rc)?\.?(\d+)?
@@ -100,13 +100,13 @@ dependencies:
 
   # Golang images
   - name: "gcr.io/k8s-staging-releng/releng-ci"
-    version: v0.5.0
+    version: v0.5.1
     refPaths:
     - path: images/releng/ci/cloudbuild.yaml
       match: v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)
 
   - name: "k8s.gcr.io/artifact-promoter/vulndash"
-    version: v0.4.3-6
+    version: v0.4.3-7
     refPaths:
     - path: cmd/vulndash/Makefile
       match: IMAGE_VERSION\ \?=\ v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)-([0-9]+)
@@ -114,7 +114,7 @@ dependencies:
       match: v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)-([0-9]+)
 
   - name: "k8s.gcr.io/build-image/go-runner"
-    version: v2.3.1-go1.16.1-buster.0
+    version: v2.3.1-go1.16.3-buster.0
     refPaths:
     - path: images/build/go-runner/variants.yaml
       match: v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)
@@ -128,7 +128,7 @@ dependencies:
       match: REVISION:\ '\d+'
 
   - name: "k8s.gcr.io/build-image/kube-cross"
-    version: v1.16.1-2
+    version: v1.16.3-1
     refPaths:
     - path: images/build/cross/variants.yaml
       match: v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)-\d+
diff --git a/images/build/cross/Makefile b/images/build/cross/Makefile
index 795abd6e155..61d2881fa52 100644
--- a/images/build/cross/Makefile
+++ b/images/build/cross/Makefile
@@ -21,7 +21,7 @@ CONFIG ?= go1.16
 TYPE ?= default
 
 # Build args
-GO_VERSION?=1.16.1
+GO_VERSION?=1.16.3
 BASEIMAGE?=golang:$(GO_VERSION)
 PROTOBUF_VERSION?=3.7.0
 ETCD_VERSION?=v3.4.13
diff --git a/images/build/cross/variants.yaml b/images/build/cross/variants.yaml
index 414d3627b10..acd3ca2e0ac 100644
--- a/images/build/cross/variants.yaml
+++ b/images/build/cross/variants.yaml
@@ -2,15 +2,15 @@ variants:
   canary:
     TYPE: 'default'
     CONFIG: 'canary'
-    GO_VERSION: '1.16.1'
-    IMAGE_VERSION: 'v1.16.1-canary-2'
+    GO_VERSION: '1.16.3'
+    IMAGE_VERSION: 'v1.16.3-canary-1'
     PROTOBUF_VERSION: '3.7.0'
     ETCD_VERSION: 'v3.4.13'
   go1.16:
     TYPE: 'default'
     CONFIG: 'go1.16'
-    GO_VERSION: '1.16.1'
-    IMAGE_VERSION: 'v1.16.1-2'
+    GO_VERSION: '1.16.3'
+    IMAGE_VERSION: 'v1.16.3-1'
     PROTOBUF_VERSION: '3.7.0'
     ETCD_VERSION: 'v3.4.13'
   go1.15:
diff --git a/images/build/go-runner/Makefile b/images/build/go-runner/Makefile
index 387961fd3b7..49d5bcae607 100644
--- a/images/build/go-runner/Makefile
+++ b/images/build/go-runner/Makefile
@@ -22,7 +22,7 @@ OS_CODENAME ?= buster
 REVISION ?= 0
 
 # Build args
-GO_VERSION ?= 1.16.1
+GO_VERSION ?= 1.16.3
 DISTROLESS_IMAGE ?= static-debian10
 
 # Configuration
diff --git a/images/build/go-runner/variants.yaml b/images/build/go-runner/variants.yaml
index 7087f84ac2b..e9bb60b5ada 100644
--- a/images/build/go-runner/variants.yaml
+++ b/images/build/go-runner/variants.yaml
@@ -1,11 +1,11 @@
 variants:
   go1.16-buster:
     CONFIG: 'go1.16-buster'
-    IMAGE_VERSION: 'v2.3.1-go1.16.1-buster.0'
+    IMAGE_VERSION: 'v2.3.1-go1.16.3-buster.0'
     GO_MINOR_VERSION: '1.16'
     OS_CODENAME: 'buster'
     REVISION: '0'
-    GO_VERSION: '1.16.1'
+    GO_VERSION: '1.16.3'
     DISTROLESS_IMAGE: 'static-debian10'
   go1.15-buster:
     CONFIG: 'go1.15-buster'
diff --git a/images/releng/ci/cloudbuild.yaml b/images/releng/ci/cloudbuild.yaml
index 24bdf4334e1..95ca1d4a242 100644
--- a/images/releng/ci/cloudbuild.yaml
+++ b/images/releng/ci/cloudbuild.yaml
@@ -24,8 +24,8 @@ substitutions:
   # vYYYYMMDD-hash, and can be used as a substitution
   _GIT_TAG: '12345'
   _PULL_BASE_REF: 'dev'
-  _IMAGE_VERSION: 'v0.5.0'
-  _GO_VERSION: '1.16.1'
+  _IMAGE_VERSION: 'v0.5.1'
+  _GO_VERSION: '1.16.3'
   _REGISTRY: 'fake.repository/registry-name'
 images:
   - 'gcr.io/$PROJECT_ID/releng-ci:${_GIT_TAG}'
diff --git a/packages/deb/Dockerfile b/packages/deb/Dockerfile
index b06c29146cc..98738cc3e89 100644
--- a/packages/deb/Dockerfile
+++ b/packages/deb/Dockerfile
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.16.1
+FROM golang:1.16.3
 
 RUN export DEBIAN_FRONTEND=noninteractive \
     && apt-get update -y \