diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6fc93f253..5f750d5a8 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -20,14 +20,14 @@ jobs:
     uses: caarlos0/meta/.github/workflows/govulncheck.yml@main
     with:
       cache: true
-      go-version: '>=1.20.1'
+      go-version: '>=1.20.2'
   semgrep:
     uses: caarlos0/meta/.github/workflows/semgrep.yml@main
   ruleguard:
     uses: caarlos0/meta/.github/workflows/ruleguard.yml@main
     with:
       cache: true
-      go-version: '>=1.20.1'
+      go-version: '>=1.20.2'
       args: '-disable largeloopcopy'
   test:
     runs-on: ubuntu-latest
@@ -52,7 +52,7 @@ jobs:
           mkdir -p $HOME/.cache/snapcraft/stage-packages
       - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3
         with:
-          go-version: '>=1.20.1'
+          go-version: '>=1.20.2'
           cache: true
       - uses: sigstore/cosign-installer@v3.0.1
       - uses: anchore/sbom-action/download-syft@v0.13.3
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index cb311b51a..1e5be9b68 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -18,7 +18,7 @@ jobs:
     - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3
     - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3
       with:
-        go-version: '>=1.20.1'
+        go-version: '>=1.20.2'
         cache: true
     - uses: github/codeql-action/init@32dc499307d133bb5085bae78498c0ac2cf762d5 # v2
     - uses: github/codeql-action/autobuild@32dc499307d133bb5085bae78498c0ac2cf762d5 # v2
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 31bd1acd0..03f738ae5 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -23,7 +23,7 @@ jobs:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
       - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3
         with:
-          go-version: '>=1.20.1'
+          go-version: '>=1.20.2'
       - run: task docs:build
       - uses: wjdp/htmltest-action@09118714cd26bef56bd3d0819e4f9b1dce6f60a9 # master
         with:
diff --git a/.github/workflows/fig.yml b/.github/workflows/fig.yml
index 2c319b2f2..98eb59c5e 100644
--- a/.github/workflows/fig.yml
+++ b/.github/workflows/fig.yml
@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3
       - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3
         with:
-          go-version: '>=1.20.1'
+          go-version: '>=1.20.2'
           cache: true
       - run: go run . generate-fig-spec >goreleaser.ts
       - uses: withfig/push-to-fig-autocomplete-action@v1
diff --git a/.github/workflows/generate.yml b/.github/workflows/generate.yml
index ace9b9098..6749086d8 100644
--- a/.github/workflows/generate.yml
+++ b/.github/workflows/generate.yml
@@ -24,7 +24,7 @@ jobs:
           token: ${{ secrets.GH_PAT }}
       - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3
         with:
-          go-version: '>=1.20.1'
+          go-version: '>=1.20.2'
           cache: true
       - uses: arduino/setup-task@e26d8975574116b0097a1161e0fe16ba75d84c1c # v1
       - run: task docs:generate
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 7e39aa71d..f05071718 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -19,7 +19,7 @@ jobs:
     steps:
       - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3
         with:
-          go-version: '>=1.20.1'
+          go-version: '>=1.20.2'
       - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3
       - name: golangci-lint
         uses: golangci/golangci-lint-action@08e2f20817b15149a52b5b3ebe7de50aff2ba8c5 # v3
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5cc612695..688ec0abc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -88,7 +88,7 @@ jobs:
           mkdir -p $HOME/.cache/snapcraft/stage-packages
       - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3
         with:
-          go-version: '>=1.20.1'
+          go-version: '>=1.20.2'
           cache: true
       - uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # v3
         with:
diff --git a/Dockerfile b/Dockerfile
index 60b736858..a0ad44453 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.20.1-alpine@sha256:87d0a3309b34e2ca732efd69fb899d3c420d3382370fd6e7e6d2cb5c930f27f9
+FROM golang:1.20.2-alpine@sha256:4e6bc0eafc261b6c8ba9bd9999b6698e8cefbe21e6d90fbc10c34599d75dc608
 
 RUN apk add --no-cache bash \
 	curl \
diff --git a/www/docs/ci/actions.md b/www/docs/ci/actions.md
index 181951c30..898ee3624 100644
--- a/www/docs/ci/actions.md
+++ b/www/docs/ci/actions.md
@@ -36,7 +36,7 @@ jobs:
       - run: git fetch --force --tags
       - uses: actions/setup-go@v3
         with:
-          go-version: '>=1.20.1'
+          go-version: '>=1.20.2'
           cache: true
       # More assembly might be required: Docker logins, GPG, etc. It all depends
       # on your needs.