diff --git a/Dockerfile b/Dockerfile
index 257a954c8..fcab211db 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # use `docker buildx imagetools inspect <image>` to get the multi-platform sha256
-FROM golang:1.25.7-alpine@sha256:81d49e1de26fa223b9ae0b4d5a4065ff8176a7d80aa5ef0bd9f2eee430afe4d7 AS spicedb-builder
+FROM golang:1.25.8-alpine@sha256:8e02eb337d9e0ea459e041f1ee5eece41cbb61f1d83e7d883a3e2fb4862063fa AS spicedb-builder
 WORKDIR /go/src/app
 RUN apk update && apk add --no-cache git
 COPY . .
@@ -7,7 +7,7 @@ COPY . .
 RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg/mod CGO_ENABLED=0 go build -tags memoryprotection -v -ldflags=-checklinkname=0 -o spicedb ./cmd/spicedb
 
 # use `docker buildx imagetools inspect <image>` to get the multi-platform sha256
-FROM golang:1.25.7-alpine@sha256:81d49e1de26fa223b9ae0b4d5a4065ff8176a7d80aa5ef0bd9f2eee430afe4d7 AS health-probe-builder
+FROM golang:1.25.8-alpine@sha256:8e02eb337d9e0ea459e041f1ee5eece41cbb61f1d83e7d883a3e2fb4862063fa AS health-probe-builder
 WORKDIR /go/src/app
 RUN apk update && apk add --no-cache git
 RUN git clone https://github.com/authzed/grpc-health-probe.git
diff --git a/Dockerfile.release b/Dockerfile.release
index 9cdd7bedf..3d68c1997 100644
--- a/Dockerfile.release
+++ b/Dockerfile.release
@@ -1,7 +1,7 @@
 # vim: syntax=dockerfile
 # use `docker buildx imagetools inspect <image>` to get the multi-platform sha256
 ARG BASE=cgr.dev/chainguard/static@sha256:99a5f826e71115aef9f63368120a6aa518323e052297718e9bf084fb84def93c
-FROM golang:1.25.7-alpine@sha256:81d49e1de26fa223b9ae0b4d5a4065ff8176a7d80aa5ef0bd9f2eee430afe4d7 AS health-probe-builder
+FROM golang:1.25.8-alpine@sha256:8e02eb337d9e0ea459e041f1ee5eece41cbb61f1d83e7d883a3e2fb4862063fa AS health-probe-builder
 WORKDIR /go/src/app
 RUN apk update && apk add --no-cache git
 RUN git clone https://github.com/authzed/grpc-health-probe.git
diff --git a/e2e/go.mod b/e2e/go.mod
index 3dad4a53a..d413ce012 100644
--- a/e2e/go.mod
+++ b/e2e/go.mod
@@ -1,6 +1,6 @@
 module github.com/authzed/spicedb/e2e
 
-go 1.25.7
+go 1.25.8
 
 replace github.com/authzed/spicedb => ../
 
diff --git a/go.mod b/go.mod
index 13d088362..7bfce77dc 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/authzed/spicedb
 
-go 1.25.7
+go 1.25.8
 
 // NOTE: We are using a *copy* of `cel-go` here to ensure there isn't a conflict
 // with the version used in Kubernetes. This is a temporary measure until we can
diff --git a/magefiles/go.mod b/magefiles/go.mod
index 6480ac9da..52fceb6c7 100644
--- a/magefiles/go.mod
+++ b/magefiles/go.mod
@@ -1,6 +1,6 @@
 module magefiles
 
-go 1.25.7
+go 1.25.8
 
 require (
 	github.com/agnivade/wasmbrowsertest v0.11.0
diff --git a/magefiles/test.go b/magefiles/test.go
index b5b0c4da6..634e4fc2a 100644
--- a/magefiles/test.go
+++ b/magefiles/test.go
@@ -41,7 +41,7 @@ func (t Test) Unit(ctx context.Context) error {
 }
 
 func (Test) unit(ctx context.Context, coverage bool) error {
-	args := []string{"-tags", "ci,skipintegrationtests,memoryprotection", "-race", "-timeout", "10m", "-count=1"}
+	args := []string{"-tags", "ci,skipintegrationtests,memoryprotection", "-race", "-timeout", "15m", "-count=1"}
 	if coverage {
 		fmt.Println("running unit tests with coverage")
 		args = append(args, coverageFlags...)
diff --git a/tools/analyzers/go.mod b/tools/analyzers/go.mod
index 0005bfba8..36c1fd89b 100644
--- a/tools/analyzers/go.mod
+++ b/tools/analyzers/go.mod
@@ -1,6 +1,6 @@
 module github.com/authzed/spicedb/tools/analyzers
 
-go 1.25.7
+go 1.25.8
 
 require (
 	github.com/samber/lo v1.52.0
diff --git a/tools/analyzers/go.work b/tools/analyzers/go.work
index 348b56d70..fd8d428fb 100644
--- a/tools/analyzers/go.work
+++ b/tools/analyzers/go.work
@@ -1,4 +1,4 @@
-go 1.25.7
+go 1.25.8
 
 use (
 	.