diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 45906c71d4..f173a2a851 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -49,7 +49,7 @@ jobs:
       - uses: actions/checkout@v2
       - uses: actions/setup-go@v2
         with:
-          go-version: "1.20.5"
+          go-version: "1.20.7"
       - run: make node
 
   algorand:
@@ -276,7 +276,7 @@ jobs:
       - uses: actions/checkout@v2
       - uses: actions/setup-go@v2
         with:
-          go-version: "1.20.5"
+          go-version: "1.20.7"
       - run: cd sdk/vaa && go test && go test -v -fuzz FuzzCalculateQuorum -run FuzzCalculateQuorum -fuzztime 15s
 
   # Run Go linters
@@ -293,7 +293,7 @@ jobs:
       - uses: actions/checkout@v2
       - uses: actions/setup-go@v2
         with:
-          go-version: "1.20.5"
+          go-version: "1.20.7"
       - name: Install formatter
         run: go install golang.org/x/tools/cmd/goimports@v0.8.0
       - name: Formatting checks
@@ -322,7 +322,7 @@ jobs:
       - uses: actions/checkout@v2
       - uses: actions/setup-go@v2
         with:
-          go-version: "1.20.5"
+          go-version: "1.20.7"
       # The go-ethereum and celo-blockchain packages both implement secp256k1 using the exact same header, but that causes duplicate symbols.
       - name: Run golang tests
         run: cd node && go test -v -timeout 5m -race -ldflags '-extldflags "-Wl,--allow-multiple-definition" ' ./...
diff --git a/Dockerfile.proto b/Dockerfile.proto
index b87a3e82d7..00c8267eec 100644
--- a/Dockerfile.proto
+++ b/Dockerfile.proto
@@ -1,5 +1,5 @@
 # syntax=docker.io/docker/dockerfile:1.3@sha256:42399d4635eddd7a9b8a24be879d2f9a930d0ed040a61324cfdf59ef1357b3b2
-FROM docker.io/golang:1.20.5@sha256:4b1fc02d16fca272e5e6e6adc98396219b43ef663a377eef4a97e881d364393f AS go-tools
+FROM docker.io/golang:1.20.7-bullseye@sha256:74b09b3b6fa5aa542df8ef974cb745eb477be72f6fcf821517fb410aff532b00 AS go-tools
 
 # Support additional root CAs
 COPY README.md cert.pem* /certs/
@@ -15,7 +15,7 @@ RUN --mount=type=cache,target=/root/.cache --mount=type=cache,target=/go \
 	cd /app/tools && CGO_ENABLED=0 ./build.sh
 
 # syntax=docker.io/docker/dockerfile:1.3@sha256:42399d4635eddd7a9b8a24be879d2f9a930d0ed040a61324cfdf59ef1357b3b2
-FROM docker.io/golang:1.20.5@sha256:4b1fc02d16fca272e5e6e6adc98396219b43ef663a377eef4a97e881d364393f AS go-build
+FROM docker.io/golang:1.20.7-bullseye@sha256:74b09b3b6fa5aa542df8ef974cb745eb477be72f6fcf821517fb410aff532b00 AS go-build
 
 # Support additional root CAs
 COPY README.md cert.pem* /certs/
diff --git a/node/Dockerfile b/node/Dockerfile
index 29e3d9c1a1..2df110dd1d 100644
--- a/node/Dockerfile
+++ b/node/Dockerfile
@@ -1,5 +1,5 @@
 # syntax=docker.io/docker/dockerfile:1.3@sha256:42399d4635eddd7a9b8a24be879d2f9a930d0ed040a61324cfdf59ef1357b3b2
-FROM --platform=linux/amd64 docker.io/golang:1.20.5@sha256:4b1fc02d16fca272e5e6e6adc98396219b43ef663a377eef4a97e881d364393f AS build
+FROM --platform=linux/amd64 docker.io/golang:1.20.7-bullseye@sha256:74b09b3b6fa5aa542df8ef974cb745eb477be72f6fcf821517fb410aff532b00 AS build
 # libwasmvm.so is not compatible with arm
 
 # Support additional root CAs
@@ -23,6 +23,7 @@ COPY wormchain wormchain
 ARG GO_BUILD_ARGS=-race
 
 RUN --mount=type=cache,target=/root/.cache --mount=type=cache,target=/go \
+  export CGO_ENABLED=1 && \
   cd node && \
   go build ${GO_BUILD_ARGS} -gcflags="all=-N -l" --ldflags '-extldflags "-Wl,--allow-multiple-definition" -X "github.com/certusone/wormhole/node/cmd/guardiand.Build=dev"' -mod=readonly -o /guardiand github.com/certusone/wormhole/node && \
   go get github.com/CosmWasm/wasmvm@v1.1.1 && \
diff --git a/scripts/Dockerfile.lint b/scripts/Dockerfile.lint
index 202190709b..f0a639d56c 100644
--- a/scripts/Dockerfile.lint
+++ b/scripts/Dockerfile.lint
@@ -1,5 +1,5 @@
 # syntax=docker.io/docker/dockerfile:1.3@sha256:42399d4635eddd7a9b8a24be879d2f9a930d0ed040a61324cfdf59ef1357b3b2
-FROM docker.io/golang:1.20.5@sha256:4b1fc02d16fca272e5e6e6adc98396219b43ef663a377eef4a97e881d364393f
+FROM docker.io/golang:1.20.7-bullseye@sha256:74b09b3b6fa5aa542df8ef974cb745eb477be72f6fcf821517fb410aff532b00
 
 RUN useradd -u 1000 -U -m -d /home/lint lint
 USER 1000
diff --git a/scripts/dev-setup.sh b/scripts/dev-setup.sh
index ff4d60214e..82dd878d2c 100755
--- a/scripts/dev-setup.sh
+++ b/scripts/dev-setup.sh
@@ -63,7 +63,7 @@ esac
 
 # Install Go
 ARCH=amd64
-GO=1.20.5
+GO=1.20.7
 
 (
   if [[ -d /usr/local/go ]]; then