diff --git a/.github/workflows/.test.yml b/.github/workflows/.test.yml
index 224b23dab87c..157456fd6b82 100644
--- a/.github/workflows/.test.yml
+++ b/.github/workflows/.test.yml
@@ -27,7 +27,7 @@ on:
         type: string
 
 env:
-  GO_VERSION: "1.20"
+  GO_VERSION: "1.20.5"
   SETUP_BUILDX_VERSION: "latest"
   SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
   TESTFLAGS: "-v --parallel=6 --timeout=30m"
diff --git a/.github/workflows/buildkit.yml b/.github/workflows/buildkit.yml
index 3c2cb53f9ada..93de0931809c 100644
--- a/.github/workflows/buildkit.yml
+++ b/.github/workflows/buildkit.yml
@@ -21,7 +21,7 @@ on:
       - 'frontend/dockerfile/docs/**'
 
 env:
-  GO_VERSION: "1.20"
+  GO_VERSION: "1.20.5"
   SETUP_BUILDX_VERSION: "latest"
   SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
   IMAGE_NAME: "moby/buildkit"
diff --git a/.github/workflows/frontend.yml b/.github/workflows/frontend.yml
index 5eace41ef6dc..ccd41d42fdec 100644
--- a/.github/workflows/frontend.yml
+++ b/.github/workflows/frontend.yml
@@ -19,7 +19,7 @@ on:
       - 'frontend/dockerfile/docs/**'
 
 env:
-  GO_VERSION: "1.20"
+  GO_VERSION: "1.20.5"
   SETUP_BUILDX_VERSION: "latest"
   SETUP_BUILDKIT_TAG: "moby/buildkit:latest"
   IMAGE_NAME: "docker/dockerfile-upstream"
diff --git a/.github/workflows/test-os.yml b/.github/workflows/test-os.yml
index de7ed663ecb5..d2bb3278db1c 100644
--- a/.github/workflows/test-os.yml
+++ b/.github/workflows/test-os.yml
@@ -19,7 +19,7 @@ on:
       - 'frontend/dockerfile/docs/**'
 
 env:
-  GO_VERSION: "1.20"
+  GO_VERSION: "1.20.5"
   TESTFLAGS: "-v --parallel=6 --timeout=30m"
   GOTESTSUM_VERSION: "v1.9.0"  # same as one in Dockerfile
   GOTESTSUM_FORMAT: "standard-verbose"
diff --git a/Dockerfile b/Dockerfile
index 3a1044289022..bd718f4a0597 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -16,7 +16,7 @@ ARG MINIO_MC_VERSION=RELEASE.2022-05-04T06-07-55Z
 ARG AZURITE_VERSION=3.18.0
 ARG GOTESTSUM_VERSION=v1.9.0
 
-ARG GO_VERSION=1.20
+ARG GO_VERSION=1.20.5
 ARG ALPINE_VERSION=3.18
 
 # minio for s3 integration tests
diff --git a/examples/buildkit0/buildkit.go b/examples/buildkit0/buildkit.go
index cbfa9f63b368..91e261876d9b 100644
--- a/examples/buildkit0/buildkit.go
+++ b/examples/buildkit0/buildkit.go
@@ -33,7 +33,7 @@ func main() {
 }
 
 func goBuildBase() llb.State {
-	goAlpine := llb.Image("docker.io/library/golang:1.20-alpine")
+	goAlpine := llb.Image("docker.io/library/golang:1.20.5-alpine")
 	return goAlpine.
 		AddEnv("PATH", "/usr/local/go/bin:"+system.DefaultPathEnvUnix).
 		AddEnv("GOPATH", "/go").
diff --git a/examples/buildkit1/buildkit.go b/examples/buildkit1/buildkit.go
index d97781c676e5..5b81ce427e69 100644
--- a/examples/buildkit1/buildkit.go
+++ b/examples/buildkit1/buildkit.go
@@ -33,7 +33,7 @@ func main() {
 }
 
 func goBuildBase() llb.State {
-	goAlpine := llb.Image("docker.io/library/golang:1.20-alpine")
+	goAlpine := llb.Image("docker.io/library/golang:1.20.5-alpine")
 	return goAlpine.
 		AddEnv("PATH", "/usr/local/go/bin:"+system.DefaultPathEnvUnix).
 		AddEnv("GOPATH", "/go").
diff --git a/examples/buildkit2/buildkit.go b/examples/buildkit2/buildkit.go
index 757270eb4660..1325de7e54e3 100644
--- a/examples/buildkit2/buildkit.go
+++ b/examples/buildkit2/buildkit.go
@@ -33,7 +33,7 @@ func main() {
 }
 
 func goBuildBase() llb.State {
-	goAlpine := llb.Image("docker.io/library/golang:1.20-alpine")
+	goAlpine := llb.Image("docker.io/library/golang:1.20.5-alpine")
 	return goAlpine.
 		AddEnv("PATH", "/usr/local/go/bin:"+system.DefaultPathEnvUnix).
 		AddEnv("GOPATH", "/go").
diff --git a/examples/buildkit3/buildkit.go b/examples/buildkit3/buildkit.go
index b239312e33e5..ef8e77c78a33 100644
--- a/examples/buildkit3/buildkit.go
+++ b/examples/buildkit3/buildkit.go
@@ -34,7 +34,7 @@ func main() {
 }
 
 func goBuildBase() llb.State {
-	goAlpine := llb.Image("docker.io/library/golang:1.20-alpine")
+	goAlpine := llb.Image("docker.io/library/golang:1.20.5-alpine")
 	return goAlpine.
 		AddEnv("PATH", "/usr/local/go/bin:"+system.DefaultPathEnvUnix).
 		AddEnv("GOPATH", "/go").
diff --git a/examples/buildkit4/buildkit.go b/examples/buildkit4/buildkit.go
index 9513e7815a5f..da41d1f98504 100644
--- a/examples/buildkit4/buildkit.go
+++ b/examples/buildkit4/buildkit.go
@@ -37,7 +37,7 @@ func main() {
 }
 
 func goBuildBase() llb.State {
-	goAlpine := llb.Image("docker.io/library/golang:1.20-alpine")
+	goAlpine := llb.Image("docker.io/library/golang:1.20.5-alpine")
 	return goAlpine.
 		AddEnv("PATH", "/usr/local/go/bin:"+system.DefaultPathEnvUnix).
 		AddEnv("GOPATH", "/go").
diff --git a/examples/nested-llb/main.go b/examples/nested-llb/main.go
index 9372ade41c6e..2c8ec257fecd 100644
--- a/examples/nested-llb/main.go
+++ b/examples/nested-llb/main.go
@@ -32,7 +32,7 @@ func main() {
 }
 
 func goBuildBase() llb.State {
-	goAlpine := llb.Image("docker.io/library/golang:1.20-alpine")
+	goAlpine := llb.Image("docker.io/library/golang:1.20.5-alpine")
 	return goAlpine.
 		AddEnv("PATH", "/usr/local/go/bin:"+system.DefaultPathEnvUnix).
 		AddEnv("GOPATH", "/go").
diff --git a/frontend/dockerfile/cmd/dockerfile-frontend/Dockerfile b/frontend/dockerfile/cmd/dockerfile-frontend/Dockerfile
index 9106ba47c623..62fe5a35dcb7 100644
--- a/frontend/dockerfile/cmd/dockerfile-frontend/Dockerfile
+++ b/frontend/dockerfile/cmd/dockerfile-frontend/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile-upstream:master
 
-ARG GO_VERSION=1.20
+ARG GO_VERSION=1.20.5
 
 # xx is a helper for cross-compilation
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:master@sha256:d4254d9739ce2de9fb88e09bdc716aa0c65f0446a2a2143399f991d71136a3d4 AS xx
diff --git a/hack/dockerfiles/docs.Dockerfile b/hack/dockerfiles/docs.Dockerfile
index 104da1bd90b7..1827770be949 100644
--- a/hack/dockerfiles/docs.Dockerfile
+++ b/hack/dockerfiles/docs.Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.20
+ARG GO_VERSION=1.20.5
 
 FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS golatest
 
diff --git a/hack/dockerfiles/generated-files.Dockerfile b/hack/dockerfiles/generated-files.Dockerfile
index 346435683b2a..214f4df8751c 100644
--- a/hack/dockerfiles/generated-files.Dockerfile
+++ b/hack/dockerfiles/generated-files.Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile-upstream:master
 
-ARG GO_VERSION="1.20"
+ARG GO_VERSION="1.20.5"
 ARG PROTOC_VERSION="3.11.4"
 
 # protoc is dynamically linked to glibc so can't use alpine base
diff --git a/hack/dockerfiles/lint.Dockerfile b/hack/dockerfiles/lint.Dockerfile
index 177a4ffd469b..5eb35f7585b3 100644
--- a/hack/dockerfiles/lint.Dockerfile
+++ b/hack/dockerfiles/lint.Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile-upstream:master
 
-ARG GO_VERSION=1.20
+ARG GO_VERSION=1.20.5
 
 FROM golang:${GO_VERSION}-alpine
 ENV GOFLAGS="-buildvcs=false"
diff --git a/hack/dockerfiles/vendor.Dockerfile b/hack/dockerfiles/vendor.Dockerfile
index 965958b061e2..29a2e0a34dbe 100644
--- a/hack/dockerfiles/vendor.Dockerfile
+++ b/hack/dockerfiles/vendor.Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile-upstream:master
 
-ARG GO_VERSION=1.20
+ARG GO_VERSION=1.20.5
 ARG MODOUTDATED_VERSION=v0.9.0
 
 FROM golang:${GO_VERSION}-alpine AS base
diff --git a/util/archutil/Dockerfile b/util/archutil/Dockerfile
index 2b24b230b385..51ad96fd53ab 100644
--- a/util/archutil/Dockerfile
+++ b/util/archutil/Dockerfile
@@ -52,7 +52,7 @@ FROM base AS exit-mips64
 COPY fixtures/exit.mips64.s .
 RUN mips64-linux-gnuabi64-as --noexecstack -o exit.o exit.mips64.s && mips64-linux-gnuabi64-ld -o exit -s exit.o
 
-FROM golang:1.20-alpine AS generate
+FROM golang:1.20.5-alpine AS generate
 WORKDIR /src
 COPY --from=exit-amd64 /src/exit amd64
 COPY --from=exit-386 /src/exit 386