diff --git a/MODULE.bazel b/MODULE.bazel
index e512c524e8..b116e02055 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -125,10 +125,10 @@ register_toolchains("//:cc_toolchain_aarch64")
 
 ### Go
 go_sdk = use_extension("@io_bazel_rules_go//go:extensions.bzl", "go_sdk")
-go_sdk.download(
+go_sdk.from_file(
     patch_strip = 1,
     patches = ["//tools:go_types_memoize.patch"],
-    version = "1.24.1",
+    go_mod = "//:go.mod",
 )
 
 go_deps = use_extension("@bazel_gazelle//:extensions.bzl", "go_deps")
diff --git a/go.mod b/go.mod
index 05ea1fb9d8..a747b8c614 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module gvisor.dev/gvisor
 
-go 1.24.1
+go 1.25.5
 
 require (
 	github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c
diff --git a/images/default/Dockerfile b/images/default/Dockerfile
index 9fd59a2b36..9f938ee8d6 100644
--- a/images/default/Dockerfile
+++ b/images/default/Dockerfile
@@ -41,7 +41,7 @@ RUN curl https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud
 
 # FIXME: rules_go is configured in MODULE.bazel to download its own Go SDK and
 # it should not use other go binaries.
-ENV GO_VERSION 1.25.1
+ENV GO_VERSION 1.25.5
 ENV GO_DOWNLOAD_BASE_URL https://dl.google.com/go/
 RUN ARCH="$(uname -m)" && \
     case "$ARCH" in \
diff --git a/images/gpu/cuda-tests-12-8/install_go.sh b/images/gpu/cuda-tests-12-8/install_go.sh
index 824ca69249..dcde010da9 100644
--- a/images/gpu/cuda-tests-12-8/install_go.sh
+++ b/images/gpu/cuda-tests-12-8/install_go.sh
@@ -20,6 +20,6 @@ if [[ "$(uname -m)" == "aarch64" ]]; then
         ARCH="arm64"
 fi
 
-wget "https://go.dev/dl/go1.24.1.linux-${ARCH}.tar.gz" && \
-    tar -C /usr/local -xzf "go1.24.1.linux-${ARCH}.tar.gz" && \
+wget "https://go.dev/dl/go1.25.5.linux-${ARCH}.tar.gz" && \
+    tar -C /usr/local -xzf "go1.25.5.linux-${ARCH}.tar.gz" && \
     ln -s /usr/local/go/bin/go /usr/local/bin/go
diff --git a/tools/build_cover.sh b/tools/build_cover.sh
index cb9e49e0f1..b595254792 100755
--- a/tools/build_cover.sh
+++ b/tools/build_cover.sh
@@ -31,7 +31,7 @@ export GOMODCACHE GOCACHE
 (
   # The gVisor code coverate implementation uses internal packages. More details
   # can be found here: https://github.com/golang/go/issues/76098.
-  curl -L https://go.dev/dl/go1.25.3.src.tar.gz | tar -xz
+  curl -L https://go.dev/dl/go1.25.5.src.tar.gz | tar -xz
   cd go
   patch -p1 < "$golang_patch"
   cd src
diff --git a/tools/checkescape/checkescape.go b/tools/checkescape/checkescape.go
index 822d10bc3d..25bab92786 100644
--- a/tools/checkescape/checkescape.go
+++ b/tools/checkescape/checkescape.go
@@ -396,7 +396,7 @@ func loadObjdump(binary io.Reader) (finalResults map[string][]string, finalErr e
 		input = f
 	}
 
-	// Execute go tool objdump ggiven the input.
+	// Execute go tool objdump given the input.
 	cmd := exec.Command(flags.Go, "tool", "objdump", input.Name())
 	pipeOut, err := cmd.StdoutPipe()
 	if err != nil {
diff --git a/tools/nogo/defs.bzl b/tools/nogo/defs.bzl
index 15ec91dcf6..840900a79a 100644
--- a/tools/nogo/defs.bzl
+++ b/tools/nogo/defs.bzl
@@ -279,12 +279,20 @@ def _nogo_aspect_impl(target, ctx):
     # Build the argument file, and the runner.
     facts_file = ctx.actions.declare_file(ctx.label.name + ".facts")
     findings_file = ctx.actions.declare_file(ctx.label.name + ".findings")
+    env = dict(go_ctx.env)
+
+    # Go 1.25 distributions do not ship objdump in $GOROOT/pkg/tool, but
+    # analyzers may exec "go tool objdump". The go command can build it on
+    # demand, but that requires a writable build cache.
+    #
+    # Reference: https://go.dev/issue/71867
+    env["GOCACHE"] = ctx.bin_dir.path + "/.gocache"
     ctx.actions.run(
         inputs = inputs + srcs,
         outputs = [findings_file, facts_file],
         tools = depset(go_ctx.runfiles.to_list() + ctx.files._nogo),
         executable = ctx.files._nogo[0],
-        env = go_ctx.env,
+        env = env,
         mnemonic = "GoStaticAnalysis",
         progress_message = "Analyzing %s" % target.label,
         # See above.