diff --git a/.github/actions/setup-go/action.yaml b/.github/actions/setup-go/action.yaml
index 4d696ef298b12..968f1f1ab8d27 100644
--- a/.github/actions/setup-go/action.yaml
+++ b/.github/actions/setup-go/action.yaml
@@ -4,7 +4,7 @@ description: |
 inputs:
   version:
     description: "The Go version to use."
-    default: "1.20.6"
+    default: "1.20.7"
 runs:
   using: "composite"
   steps:
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 3e5838f2a1501..c7de75393874b 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -224,7 +224,7 @@ jobs:
         with:
           # This doesn't need caching. It's super fast anyways!
           cache: false
-          go-version: 1.20.6
+          go-version: 1.20.7
 
       - name: Install shfmt
         run: go install mvdan.cc/sh/v3/cmd/shfmt@v3.5.0
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index d78fbe7c5a5b9..ab27aa12d117c 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -28,10 +28,6 @@ env:
   # https://github.blog/changelog/2022-06-10-github-actions-inputs-unified-across-manual-and-reusable-workflows/
   CODER_RELEASE: ${{ !inputs.dry_run }}
   CODER_DRY_RUN: ${{ inputs.dry_run }}
-  # For some reason, setup-go won't actually pick up a new patch version if
-  # it has an old one cached. We need to manually specify the versions so we
-  # can get the latest release. Never use "~1.xx" here!
-  CODER_GO_VERSION: "1.20.6"
 
 jobs:
   release:
diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml
index 48c8f16fd9bea..04c3b1562147b 100644
--- a/.github/workflows/security.yaml
+++ b/.github/workflows/security.yaml
@@ -21,9 +21,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-security
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
-env:
-  CODER_GO_VERSION: "1.20.6"
-
 jobs:
   codeql:
     runs-on: ${{ github.repository_owner == 'coder' && 'buildjet-8vcpu-ubuntu-2204' || 'ubuntu-latest' }}
diff --git a/dogfood/Dockerfile b/dogfood/Dockerfile
index c5f1481679147..c5145ecb98629 100644
--- a/dogfood/Dockerfile
+++ b/dogfood/Dockerfile
@@ -8,7 +8,7 @@ FROM ubuntu:jammy AS go
 
 RUN apt-get update && apt-get install --yes curl gcc
 # Install Go manually, so that we can control the version
-ARG GO_VERSION=1.20.6
+ARG GO_VERSION=1.20.7
 RUN mkdir --parents /usr/local/go
 
 # Boring Go is needed to build FIPS-compliant binaries.