diff --git a/.github/workflows/build-cli.yaml b/.github/workflows/build-cli.yaml
index 05770f06..2c752381 100644
--- a/.github/workflows/build-cli.yaml
+++ b/.github/workflows/build-cli.yaml
@@ -27,7 +27,7 @@ jobs:
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: '1.23'
+          go-version: '1.25'
           cache: true
 
       - name: Build binary
@@ -56,10 +56,9 @@ jobs:
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          # This job runs the e2e module (go 1.24); install the Go it declares
-          # so `go test` doesn't hard-fail under GOTOOLCHAIN=local with
-          # "go.mod requires go >= 1.24.0". The root build job above stays on
-          # the root go.mod's 1.23.
+          # This job runs the e2e module; install the Go it declares so `go test`
+          # doesn't hard-fail under GOTOOLCHAIN=local. The root build job above
+          # uses the root go.mod's version (1.25).
           go-version-file: e2e/go.mod
           cache: true
           cache-dependency-path: e2e/go.sum
diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index a4ac5302..533217a8 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -53,7 +53,7 @@ jobs:
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: '1.23'
+          go-version: '1.25'
           cache: true
 
       - name: Run unit tests
@@ -77,13 +77,13 @@ jobs:
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: '1.23'
+          go-version: '1.25'
           cache: true
 
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@d6238b002a20823d52840fda27e2d4891c5952dc # v4
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8
         with:
-          version: latest
+          version: v2.10.1
 
   workflow-drift:
     name: Workflow Drift Check
@@ -93,7 +93,7 @@ jobs:
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: '1.23'
+          go-version: '1.25'
           cache: true
 
       - name: Build cascade CLI
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 3d6d40e0..1fcfd9d4 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -40,15 +40,15 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.23"
+          go-version: "1.25"
 
       - name: Run tests
         run: go test -v ./...
 
       - name: Run linter
-        uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8
         with:
-          version: latest
+          version: v2.10.1
 
   release:
     name: Release
@@ -62,7 +62,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.23"
+          go-version: "1.25"
 
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
diff --git a/.github/workflows/validate.yaml b/.github/workflows/validate.yaml
index d3033c62..7017bb7d 100644
--- a/.github/workflows/validate.yaml
+++ b/.github/workflows/validate.yaml
@@ -41,7 +41,7 @@ jobs:
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: '1.23'
+          go-version: '1.25'
           cache: true
 
       - name: Run tests
@@ -61,13 +61,13 @@ jobs:
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: '1.23'
+          go-version: '1.25'
           cache: true
 
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@d6238b002a20823d52840fda27e2d4891c5952dc # v4
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8
         with:
-          version: latest
+          version: v2.10.1
 
   validate:
     name: Validation Gate
diff --git a/Dockerfile b/Dockerfile
index 457adb7e..734fa1d2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Build stage
-FROM golang:1.23-alpine AS builder
+FROM golang:1.25-alpine AS builder
 
 WORKDIR /build
 
diff --git a/docs/src/content/docs/adoption.md b/docs/src/content/docs/adoption.md
index 72cf04a7..b285ee6a 100644
--- a/docs/src/content/docs/adoption.md
+++ b/docs/src/content/docs/adoption.md
@@ -18,7 +18,7 @@ The flow in one line: you write a manifest plus callback workflows, run `cascade
 - **GitHub Actions enabled** on the repository, with trunk-based development (a single primary branch).
 - **Conventional Commits - required.** cascade derives the semver bump, the changelog, and breaking-change detection entirely from Conventional Commit messages. This is not optional. Commits that do not follow the convention are not processed correctly and version derivation can fail. See [Versioning and schema compatibility](/cascade/versioning/).
 - **GitHub setup**: environments for each deploy stage, branch and tag protection, the secrets your callbacks consume, and scoped tokens. The [Security and Hardening](/cascade/security/hardening/) checklist is the authoritative list; wire it up before your first production promotion.
-- The `cascade` CLI for local generation (Go 1.23+ to `go install`; in Actions, the setup action installs it for you). See [Getting Started](/cascade/getting-started/).
+- The `cascade` CLI for local generation (Go 1.25+ to `go install`; in Actions, the setup action installs it for you). See [Getting Started](/cascade/getting-started/).
 
 ## Build a pipeline from scratch
 
diff --git a/docs/src/content/docs/callback-contract.md b/docs/src/content/docs/callback-contract.md
index 907891a9..17dd8ad4 100644
--- a/docs/src/content/docs/callback-contract.md
+++ b/docs/src/content/docs/callback-contract.md
@@ -315,7 +315,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.23"
+          go-version: "1.25"
 
       - name: Lint
         if: ${{ inputs.check_lint }}
diff --git a/docs/src/content/docs/getting-started.md b/docs/src/content/docs/getting-started.md
index b9bed696..985800df 100644
--- a/docs/src/content/docs/getting-started.md
+++ b/docs/src/content/docs/getting-started.md
@@ -7,7 +7,7 @@ This guide walks through setting up `cascade` in your repository.
 
 ## Prerequisites
 
-- Go 1.23+ (for the CLI)
+- Go 1.25+ (for the CLI)
 - A GitHub repository with Actions enabled
 - Trunk-based development (single primary branch)
 
diff --git a/go.mod b/go.mod
index 7178752e..53b242ac 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/stablekernel/cascade
 
-go 1.23
+go 1.25
 
 require (
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2