diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index a43959a9a..aafeca347 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -61,7 +61,7 @@ jobs:
         uses: actions/setup-go@v6
         with:
           cache: false
-          go-version: 1.26.0
+          go-version: 1.26.2
       - name: Set common go env vars
         run: |-
           case $(go env GOARCH) in
@@ -85,7 +85,7 @@ jobs:
         uses: goreleaser/goreleaser-action@v6
         with:
           install-only: true
-          version: v2.13.3
+          version: v2.15.4
       - name: Run GoReleaser with CUE
         env:
           GITHUB_TOKEN: ${{ secrets.CUECKOO_GITHUB_PAT }}
diff --git a/internal/ci/repo/repo.cue b/internal/ci/repo/repo.cue
index 9fc358ad5..7e90de088 100644
--- a/internal/ci/repo/repo.cue
+++ b/internal/ci/repo/repo.cue
@@ -32,9 +32,9 @@ linuxMachine: base.linuxLargeMachine
 // Use a specific latest version for release builds.
 // Note that we don't want ".x" for the sake of reproducibility,
 // so we instead pin a specific Go release.
-pinnedReleaseGo: "1.26.0"
+pinnedReleaseGo: "1.26.2"
 
-goreleaserVersion: "v2.13.3"
+goreleaserVersion: "v2.15.4"
 
 // zeroReleaseTagSuffix is the suffix used to identify all "zero" releases.
 // When we create a release branch for v0.$X.0, it's likely that commits on the