diff --git a/.github/actions/setup-go/action.yaml b/.github/actions/setup-go/action.yaml
index c654c1953f652..e54bcf36a9e29 100644
--- a/.github/actions/setup-go/action.yaml
+++ b/.github/actions/setup-go/action.yaml
@@ -7,7 +7,7 @@ runs:
     - uses: buildjet/setup-go@v4
       with:
         cache: true
-        go-version: "~1.20"
+        go-version: "1.20.5"
     - name: Install gotestsum
       uses: jaxxstorm/action-install-gh-release@v1.10.0
       with:
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 203a6c05dd49e..e4c7b12b5a712 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -6,10 +6,6 @@ on:
       - "v*"
   workflow_dispatch:
     inputs:
-      go_version:
-        description: "Go version to use for building."
-        required: false
-        default: "1.20.4"
       dry_run:
         description: Perform a dry-run release (devel). Note that ref must be an annotated tag when run without dry-run.
         type: boolean
@@ -35,7 +31,7 @@ env:
   # For some reason, setup-go won't actually pick up a new patch version if
   # it has an old one cached. We need to manually specify the versions so we
   # can get the latest release. Never use "~1.xx" here!
-  CODER_GO_VERSION: "1.20.4"
+  CODER_GO_VERSION: "1.20.5"
 
 jobs:
   release:
@@ -98,10 +94,7 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: buildjet/setup-go@v4
-        with:
-          go-version: ${{ env.CODER_GO_VERSION }}
-          cache: true
+      - uses: ./.github/actions/setup-go
 
       - name: Cache Node
         id: cache-node
diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml
index 373aa9456e934..1f835a247bcb0 100644
--- a/.github/workflows/security.yaml
+++ b/.github/workflows/security.yaml
@@ -19,7 +19,7 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
-  CODER_GO_VERSION: "1.20.4"
+  CODER_GO_VERSION: "1.20.5"
 
 jobs:
   codeql:
@@ -32,10 +32,7 @@ jobs:
         with:
           languages: go, javascript
 
-      - name: Setup Go
-        uses: buildjet/setup-go@v4
-        with:
-          go-version: ${{ env.CODER_GO_VERSION }}
+      - uses: ./.github/actions/setup-go
 
       # Workaround to prevent CodeQL from building the dashboard.
       - name: Remove Makefile
@@ -63,10 +60,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: buildjet/setup-go@v4
-        with:
-          go-version: ${{ env.CODER_GO_VERSION }}
-          cache: true
+      - uses: ./.github/actions/setup-go
 
       - name: Cache Node
         id: cache-node
diff --git a/dogfood/Dockerfile b/dogfood/Dockerfile
index 6c624cfe508d2..cf9b3a017b7e6 100644
--- a/dogfood/Dockerfile
+++ b/dogfood/Dockerfile
@@ -8,7 +8,7 @@ FROM ubuntu:jammy AS go
 
 RUN apt-get update && apt-get install --yes curl gcc
 # Install Go manually, so that we can control the version
-ARG GO_VERSION=1.20.4
+ARG GO_VERSION=1.20.5
 RUN mkdir --parents /usr/local/go
 
 # Boring Go is needed to build FIPS-compliant binaries.