diff --git a/docker-bake.hcl b/docker-bake.hcl
index 9714b746..38e28b1d 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -600,7 +600,7 @@ target "_pkg-cagent" {
     PKG_NAME = PKG_NAME != null && PKG_NAME != "" ? PKG_NAME : "cagent"
     PKG_REPO = PKG_REPO != null && PKG_REPO != "" ? PKG_REPO : "https://github.com/docker/cagent.git"
     PKG_REF = PKG_REF != null && PKG_REF != "" ? PKG_REF : "main"
-    GO_VERSION = GO_VERSION != null && GO_VERSION != "" ? GO_VERSION : "1.25.3" # https://github.com/docker/cagent/blob/26330cc0e1579ab91fd24a3459986256680d8330/Dockerfile#L6
+    GO_VERSION = GO_VERSION != null && GO_VERSION != "" ? GO_VERSION : "1.25.4" # https://github.com/docker/cagent/blob/259774ed55b2b51c4b602d9636d68a6bb23117ec/Dockerfile#L6
     GO_IMAGE_VARIANT = GO_IMAGE_VARIANT != null && GO_IMAGE_VARIANT != "" ? GO_IMAGE_VARIANT : "bookworm"
     PKG_DEB_EPOCH = PKG_DEB_EPOCH != null && PKG_DEB_EPOCH != "" ? PKG_DEB_EPOCH : ""
   }
diff --git a/pkg/cagent/Dockerfile b/pkg/cagent/Dockerfile
index 11dab8ba..8df8da89 100644
--- a/pkg/cagent/Dockerfile
+++ b/pkg/cagent/Dockerfile
@@ -29,7 +29,7 @@ ARG PKG_REPO="https://github.com/docker/cagent.git"
 ARG PKG_REF="master"
 
 ARG GO_IMAGE="golang"
-ARG GO_VERSION="1.25.3"
+ARG GO_VERSION="1.25.4"
 ARG GO_IMAGE_VARIANT="bookworm"
 
 # stage used as named context that mounts hack/scripts