diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b586b42c5..751b07294 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,7 +13,7 @@ on:
     paths-ignore: [docs/**, "**.md", "**.mdx", "**.png", "**.jpg"]
 
 env:
-  GO_VERSION: '1.25.9'
+  GO_VERSION: '1.25.10'
   CERT_MANAGER_VERSION: 'v1.16.2'
 
 jobs:
diff --git a/.github/workflows/code-lint.yml b/.github/workflows/code-lint.yml
index e3ceb5da1..d6a977d52 100644
--- a/.github/workflows/code-lint.yml
+++ b/.github/workflows/code-lint.yml
@@ -14,7 +14,7 @@ on:
 
 env:
   # Common versions
-  GO_VERSION: "1.25.9"
+  GO_VERSION: "1.25.10"
 
 jobs:
   detect-noop:
diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index eda29e860..e00e92948 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6709caf80..2606cdf4b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,7 @@ env:
   HUB_AGENT_IMAGE_NAME: hub-agent
   MEMBER_AGENT_IMAGE_NAME: member-agent
   REFRESH_TOKEN_IMAGE_NAME: refresh-token
-  GO_VERSION: "1.25.9"
+  GO_VERSION: "1.25.10"
 
 jobs:
   export-registry:
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index a39f6b32c..c9bdf9706 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -18,7 +18,7 @@ env:
   MEMBER_AGENT_IMAGE_NAME: member-agent
   REFRESH_TOKEN_IMAGE_NAME: refresh-token
 
-  GO_VERSION: '1.25.9'
+  GO_VERSION: '1.25.10'
 
 jobs:
   export-registry:
diff --git a/.github/workflows/upgrade.yml b/.github/workflows/upgrade.yml
index 34e4f0f3b..6c4828f2c 100644
--- a/.github/workflows/upgrade.yml
+++ b/.github/workflows/upgrade.yml
@@ -17,7 +17,7 @@ on:
     paths-ignore: [docs/**, "**.md", "**.mdx", "**.png", "**.jpg"]
 
 env:
-  GO_VERSION: '1.25.9'
+  GO_VERSION: '1.25.10'
 
 jobs:
   detect-noop:
diff --git a/.golangci.yml b/.golangci.yml
index afad58749..73c1e09ff 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,6 +1,6 @@
 run:
   timeout: 15m
-  go: '1.25.9'
+  go: '1.25.10'
 
 linters-settings:
   stylecheck:
diff --git a/docker/crd-installer.Dockerfile b/docker/crd-installer.Dockerfile
index a8355aa8a..a4f3f6272 100644
--- a/docker/crd-installer.Dockerfile
+++ b/docker/crd-installer.Dockerfile
@@ -1,5 +1,5 @@
 # Build the crdinstaller binary
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.9 AS builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.10 AS builder
 
 ARG GOOS=linux
 ARG GOARCH=amd64
diff --git a/docker/hub-agent.Dockerfile b/docker/hub-agent.Dockerfile
index cd5253fe5..fe44d53f1 100644
--- a/docker/hub-agent.Dockerfile
+++ b/docker/hub-agent.Dockerfile
@@ -1,5 +1,5 @@
 # Build the hubagent binary
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.9 AS builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.10 AS builder
 
 ARG GOOS=linux
 ARG GOARCH=amd64
diff --git a/docker/member-agent.Dockerfile b/docker/member-agent.Dockerfile
index 74b19f6a5..14918e0ca 100644
--- a/docker/member-agent.Dockerfile
+++ b/docker/member-agent.Dockerfile
@@ -1,5 +1,5 @@
 # Build the memberagent binary
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.9 AS builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.10 AS builder
 
 ARG GOOS=linux
 ARG GOARCH=amd64
diff --git a/docker/refresh-token.Dockerfile b/docker/refresh-token.Dockerfile
index 10e5a05a5..de8995c6c 100644
--- a/docker/refresh-token.Dockerfile
+++ b/docker/refresh-token.Dockerfile
@@ -1,5 +1,5 @@
 # Build the refreshtoken binary
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.9 AS builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.10 AS builder
 
 ARG GOOS="linux"
 ARG GOARCH="amd64"
diff --git a/go.mod b/go.mod
index 70c80ae6e..aac29d955 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module go.goms.io/fleet
 
-go 1.25.9
+go 1.25.10
 
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0
diff --git a/pkg/utils/errors/errors_test.go b/pkg/utils/errors/errors_test.go
index 5b62fbee6..d026b56c8 100644
--- a/pkg/utils/errors/errors_test.go
+++ b/pkg/utils/errors/errors_test.go
@@ -87,14 +87,15 @@ func TestCommonUsePatterns(t *testing.T) {
 	outputStr = readFromBuffer(t, &bytesBuf)
 
 	// The full error output looks like the follows:
-	// errors_test.go:86: time=2026-04-29T02:49:04.560+10:00 level=ERROR msg="additional top/controller-level error description" err="additional high-level error description: additional low-level error description: cannot calculate resource hash" errCategory=unexpected k1=v1 callers="[{Function:go.goms.io/fleet/pkg/utils/errors.TestCommonUsePatterns File:SomeFilePath Line:74} {Function:testing.tRunner File:SomeFilePath Line:1934} {Function:runtime.goexit File:SomeFilePath Line:1268}]" k2=v2
+	// errors_test.go:86: time=2026-04-29T02:49:04.560+10:00 level=ERROR msg="additional top/controller-level error description" err="additional high-level error description: additional low-level error description: cannot calculate resource hash" errCategory=unexpected k1=v1 callers="[{Function:github.com/kubefleet-dev/kubefleet/pkg/utils/errors.TestCommonUsePatterns File:SomeFilePath Line:74} {Function:testing.tRunner File:SomeFilePath Line:1934} {Function:runtime.goexit File:SomeFilePath Line:1268}]" k2=v2
 	wantSubStrings = []string{
 		"msg=\"additional top/controller-level error description\"",
 		"err=\"additional high-level error description: additional low-level error description: cannot calculate resource hash\"",
 		"errCategory=unexpected",
 		"k1=v1",
 		"callers=",
-		"Function:github.com/kubefleet-dev/kubefleet/pkg/utils/errors.TestCommonUsePatterns",
+		"Function:",
+		"/pkg/utils/errors.TestCommonUsePatterns",
 		"k2=v2",
 	}
 	for _, subStr := range wantSubStrings {
@@ -557,7 +558,7 @@ func TestNewUnexpectedError(t *testing.T) {
 
 	// Verify the first frame (the current test code).
 	callerFunc := frames[0].Function
-	if callerFunc != "go.goms.io/fleet/pkg/utils/errors.TestNewUnexpectedError" {
+	if !strings.Contains(callerFunc, "/pkg/utils/errors.TestNewUnexpectedError") {
 		t.Errorf("NewUnexpectedError() first caller function = %s, want TestNewUnexpectedError", callerFunc)
 	}
 	callerFile := frames[0].File