diff --git a/docker/build-tools/Dockerfile b/docker/build-tools/Dockerfile
index 61232ae064..4adb6c549d 100644
--- a/docker/build-tools/Dockerfile
+++ b/docker/build-tools/Dockerfile
@@ -29,7 +29,7 @@ ARG BASE_OS_CONTEXT=base_os_context
 ################
 # Binary tools
 ################
-ARG GOLANG_IMAGE=golang:1.25.0-bookworm
+ARG GOLANG_IMAGE=golang:1.25.1-bookworm
 # hadolint ignore=DL3006
 FROM ${GOLANG_IMAGE} AS binary_tools_context_base
 # TARGETARCH is an automatic platform ARG enabled by Docker BuildKit.
@@ -39,7 +39,7 @@ ARG TARGETARCH
 ARG ISTIO_TOOLS_SHA
 
 # Pinned versions of stuff we pull in, keep this list sorted alphabetically
-ENV APKO_VERSION=v0.30.6
+ENV APKO_VERSION=v0.30.7
 ENV BENCHSTAT_VERSION=9c9101da8316
 ENV BOM_VERSION=v0.6.0
 ENV BUF_VERSION=v1.57.0
@@ -60,7 +60,7 @@ ENV VT_PROTOBUF_VERSION=ba97887b0a2597d20399eb70221c99c95520e8c1
 ENV GO_BINDATA_VERSION=v3.1.2
 ENV GO_JUNIT_REPORT_VERSION=df0ed838addb0fa189c4d76ad4657f6007a5811c
 ENV GO_VULNCHECK_VERSION=v1.1.4
-ENV HADOLINT_VERSION=v2.12.0
+ENV HADOLINT_VERSION=v2.13.1
 ENV HELM3_VERSION=v3.18.6
 # Consult the Docs WG before bumping Hugo.
 # Specifically, the version here should match netlify.toml in istio/istio.io.
@@ -79,14 +79,14 @@ ENV KUBECTL_VERSION=1.34.0
 ENV KUBECTX_VERSION=0.9.5
 ENV KUBETEST2_VERSION=b019714a389563c9a788f119f801520d059b6533
 ENV OC_VERSION=4.19.9
-ENV ORAS_VERSION=1.2.2
+ENV ORAS_VERSION=1.3.0
 ENV OTEL_CLI_VERSION=v0.4.5
 ENV PROTOC_GEN_GRPC_GATEWAY_VERSION=v1.16.0
 ENV PROTOC_VERSION=32.0
 ENV PROTOLOCK_VERSION=v0.17.0
 ENV SHELLCHECK_VERSION=v0.11.0
 ENV SU_EXEC_VERSION=0.3.1
-ENV TRIVY_VERSION=0.65.0
+ENV TRIVY_VERSION=0.66.0
 ENV YQ_VERSION=4.45.4
 
 ENV GO111MODULE=on
@@ -562,8 +562,8 @@ FROM ubuntu:noble AS base_os_context
 ENV DEBIAN_FRONTEND=noninteractive
 
 ENV CONTAINERD_VERSION=1.7.27-1
-ENV DOCKER_VERSION=5:28.3.3-1~ubuntu.24.04~noble
-ENV DOCKER_BUILDX_VERSION=0.26.1-1~ubuntu.24.04~noble
+ENV DOCKER_VERSION=5:28.4.0-1~ubuntu.24.04~noble
+ENV DOCKER_BUILDX_VERSION=0.27.0-1~ubuntu.24.04~noble
 ENV RUST_VERSION=1.89.0
 
 ENV OUTDIR=/out