diff --git a/.github/workflows/build_daily.yaml b/.github/workflows/build_daily.yaml
index d67ab9f1dd7..5f33c71a094 100644
--- a/.github/workflows/build_daily.yaml
+++ b/.github/workflows/build_daily.yaml
@@ -13,7 +13,7 @@ permissions:
 env:
   GOPROXY: https://proxy.golang.org/
   SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-  GO_VERSION: 1.22.5
+  GO_VERSION: 1.22.8
 
 jobs:
   e2e-contour-xds:
diff --git a/.github/workflows/build_tag.yaml b/.github/workflows/build_tag.yaml
index 4f84489a0c7..26b3949880e 100644
--- a/.github/workflows/build_tag.yaml
+++ b/.github/workflows/build_tag.yaml
@@ -19,7 +19,7 @@ permissions:
 env:
   GOPROXY: https://proxy.golang.org/
   SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-  GO_VERSION: 1.22.5
+  GO_VERSION: 1.22.8
 
 jobs:
   build:
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index ec06fcaa503..32d6c31e7c5 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -14,7 +14,7 @@ permissions:
 
 env:
   GOPROXY: https://proxy.golang.org/
-  GO_VERSION: 1.22.5
+  GO_VERSION: 1.22.8
 
 jobs:
   CodeQL-Build:
diff --git a/.github/workflows/prbuild.yaml b/.github/workflows/prbuild.yaml
index 7d83282738f..9b025ffede2 100644
--- a/.github/workflows/prbuild.yaml
+++ b/.github/workflows/prbuild.yaml
@@ -14,7 +14,7 @@ permissions:
 env:
   GOPROXY: https://proxy.golang.org/
   SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-  GO_VERSION: 1.22.5
+  GO_VERSION: 1.22.8
 jobs:
   lint:
     runs-on: ubuntu-latest
diff --git a/Makefile b/Makefile
index 57cdc9a8ffb..3b47615a9d8 100644
--- a/Makefile
+++ b/Makefile
@@ -6,7 +6,7 @@ IMAGE := $(REGISTRY)/$(PROJECT)
 SRCDIRS := ./cmd ./internal ./apis
 LOCAL_BOOTSTRAP_CONFIG = localenvoyconfig.yaml
 SECURE_LOCAL_BOOTSTRAP_CONFIG = securelocalenvoyconfig.yaml
-ENVOY_IMAGE = docker.io/envoyproxy/envoy:v1.30.4
+ENVOY_IMAGE = docker.io/envoyproxy/envoy:v1.31.3
 GATEWAY_API_VERSION ?= $(shell grep "sigs.k8s.io/gateway-api" go.mod | awk '{print $$2}')
 
 # Used to supply a local Envoy docker container an IP to connect to that is running
@@ -44,7 +44,7 @@ endif
 IMAGE_PLATFORMS ?= linux/amd64,linux/arm64
 
 # Base build image to use.
-BUILD_BASE_IMAGE ?= golang:1.22.5@sha256:829eff99a4b2abffe68f6a3847337bf6455d69d17e49ec1a97dac78834754bd6
+BUILD_BASE_IMAGE ?= golang:1.22.8@sha256:0ca97f4ab335f4b284a5b8190980c7cdc21d320d529f2b643e8a8733a69bfb6b
 
 # Enable build with CGO.
 BUILD_CGO_ENABLED ?= 0
diff --git a/cmd/contour/gatewayprovisioner.go b/cmd/contour/gatewayprovisioner.go
index eee1395bf6c..21f110bab5b 100644
--- a/cmd/contour/gatewayprovisioner.go
+++ b/cmd/contour/gatewayprovisioner.go
@@ -36,7 +36,7 @@ func registerGatewayProvisioner(app *kingpin.Application) (*kingpin.CmdClause, *
 
 	provisionerConfig := &gatewayProvisionerConfig{
 		contourImage:          "ghcr.io/projectcontour/contour:v1.30.0",
-		envoyImage:            "docker.io/envoyproxy/envoy:v1.31.0",
+		envoyImage:            "docker.io/envoyproxy/envoy:v1.31.3",
 		metricsBindAddress:    ":8080",
 		leaderElection:        false,
 		leaderElectionID:      "0d879e31.projectcontour.io",
diff --git a/examples/contour/03-envoy.yaml b/examples/contour/03-envoy.yaml
index 8fba96c2728..715ffe67f8c 100644
--- a/examples/contour/03-envoy.yaml
+++ b/examples/contour/03-envoy.yaml
@@ -46,7 +46,7 @@ spec:
         - --log-level info
         command:
         - envoy
-        image: docker.io/envoyproxy/envoy:v1.31.0
+        image: docker.io/envoyproxy/envoy:v1.31.3
         imagePullPolicy: IfNotPresent
         name: envoy
         env:
diff --git a/examples/deployment/03-envoy-deployment.yaml b/examples/deployment/03-envoy-deployment.yaml
index e1b7207b2f9..8f6b18aa26c 100644
--- a/examples/deployment/03-envoy-deployment.yaml
+++ b/examples/deployment/03-envoy-deployment.yaml
@@ -58,7 +58,7 @@ spec:
             - --log-level info
           command:
             - envoy
-          image: docker.io/envoyproxy/envoy:v1.31.0
+          image: docker.io/envoyproxy/envoy:v1.31.3
           imagePullPolicy: IfNotPresent
           name: envoy
           env:
diff --git a/examples/render/contour-deployment.yaml b/examples/render/contour-deployment.yaml
index 708ab3b6aa7..1b86871e4e8 100644
--- a/examples/render/contour-deployment.yaml
+++ b/examples/render/contour-deployment.yaml
@@ -9309,7 +9309,7 @@ spec:
             - --log-level info
           command:
             - envoy
-          image: docker.io/envoyproxy/envoy:v1.31.0
+          image: docker.io/envoyproxy/envoy:v1.31.3
           imagePullPolicy: IfNotPresent
           name: envoy
           env:
diff --git a/examples/render/contour-gateway.yaml b/examples/render/contour-gateway.yaml
index 415afdeeb55..15067e9edaa 100644
--- a/examples/render/contour-gateway.yaml
+++ b/examples/render/contour-gateway.yaml
@@ -9113,7 +9113,7 @@ spec:
         - --log-level info
         command:
         - envoy
-        image: docker.io/envoyproxy/envoy:v1.31.0
+        image: docker.io/envoyproxy/envoy:v1.31.3
         imagePullPolicy: IfNotPresent
         name: envoy
         env:
diff --git a/examples/render/contour.yaml b/examples/render/contour.yaml
index 160e3b23fa4..7f2fe2ce1e8 100644
--- a/examples/render/contour.yaml
+++ b/examples/render/contour.yaml
@@ -9297,7 +9297,7 @@ spec:
         - --log-level info
         command:
         - envoy
-        image: docker.io/envoyproxy/envoy:v1.31.0
+        image: docker.io/envoyproxy/envoy:v1.31.3
         imagePullPolicy: IfNotPresent
         name: envoy
         env: