diff --git a/docker-bake.hcl b/docker-bake.hcl
index 8b060d93..8f4d88aa 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -603,7 +603,7 @@ target "_pkg-containerd" {
     PKG_NAME = PKG_NAME != null && PKG_NAME != "" ? PKG_NAME : "containerd.io"
     PKG_REPO = PKG_REPO != null && PKG_REPO != "" ? PKG_REPO : "https://github.com/containerd/containerd.git"
     PKG_REF = PKG_REF != null && PKG_REF != "" ? PKG_REF : "release/2.2"
-    GO_VERSION = GO_VERSION != null && GO_VERSION != "" ? GO_VERSION : "1.25.9" # https://github.com/containerd/containerd/blob/release/2.2/.github/workflows/release/Dockerfile
+    GO_VERSION = GO_VERSION != null && GO_VERSION != "" ? GO_VERSION : "1.25.10" # https://github.com/containerd/containerd/blob/release/2.2/.github/workflows/release/Dockerfile
     GO_IMAGE_VARIANT = GO_IMAGE_VARIANT != null && GO_IMAGE_VARIANT != "" ? GO_IMAGE_VARIANT : "bookworm"
     PKG_DEB_EPOCH = PKG_DEB_EPOCH != null && PKG_DEB_EPOCH != "" ? PKG_DEB_EPOCH : ""
     RUNC_REF = RUNC_REF != null && RUNC_REF != "" ? RUNC_REF : null
diff --git a/pkg/containerd/Dockerfile b/pkg/containerd/Dockerfile
index 4ecdf5f8..bbdc250c 100644
--- a/pkg/containerd/Dockerfile
+++ b/pkg/containerd/Dockerfile
@@ -34,7 +34,7 @@ ARG PKG_REPO="https://github.com/containerd/containerd.git"
 ARG PKG_REF="main"
 
 ARG GO_IMAGE="golang"
-ARG GO_VERSION="1.25.9"
+ARG GO_VERSION="1.25.10"
 ARG GO_IMAGE_VARIANT="bookworm"
 
 # stage used as named context that mounts hack/scripts