diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7be2744..4d1d9ec 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -12,7 +12,7 @@ jobs:
       - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
-          go-version: '1.22'
+          go-version-file: './go.mod'
           check-latest: true
       - uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a49dbba..f1e6c9d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,7 +16,8 @@ jobs:
       - run: git fetch --prune --unshallow
       - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
-          go-version-file: 'go.mod'
+          go-version-file: './go.mod'
+          check-latest: true
           cache: true
 
       # This is provisioned here: https://github.com/chainguard-dev/secrets/blob/main/terraform-provider-ko.tf
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index fc4975c..e19426f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -12,7 +12,7 @@ jobs:
       - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
-          go-version: '1.22'
+          go-version-file: './go.mod'
           check-latest: true
       - run: go generate ./...
       - name: git diff
@@ -27,14 +27,14 @@ jobs:
       fail-fast: false
       matrix:
         terraform:
-          - '1.6.*'
           - '1.7.*'
           - '1.8.*'
+          - '1.9.*'
     steps:
       - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
-          go-version: '1.22'
+          go-version-file: './go.mod'
           check-latest: true
 
       - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 31c59a1..4e89849 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -16,11 +16,10 @@ jobs:
 
       - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
-          go-version: '1.22'
+          go-version-file: './go.mod'
           check-latest: true
 
       - name: golangci-lint
         uses: golangci/golangci-lint-action@aaa42aa0628b4ae2578232a66b541047968fac86 # v6.1.0
         with:
-          version: v1.56
-          args: --timeout=10m
+          version: v1.61
diff --git a/.golangci.yaml b/.golangci.yaml
index 73b1d54..8ebe011 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -1,5 +1,5 @@
 run:
-  timeout: 5m
+  timeout: 10m
 
 issues:
   exclude-rules:
diff --git a/.goreleaser.yml b/.goreleaser.yml
index d34c222..dce64c9 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -1,6 +1,6 @@
 version: 2
-before:
 
+before:
   hooks:
     - go mod tidy
     - /bin/bash -c 'if [ -n "$(git --no-pager diff --exit-code go.mod go.sum)" ]; then exit 1; fi'
diff --git a/go.mod b/go.mod
index c6570b0..5d6febe 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/ko-build/terraform-provider-ko
 
-go 1.22.3
+go 1.23
 
 require (
 	github.com/aws/aws-lambda-go v1.47.0
diff --git a/internal/provider/resource_ko_build.go b/internal/provider/resource_ko_build.go
index e5382c0..c8ef1b8 100644
--- a/internal/provider/resource_ko_build.go
+++ b/internal/provider/resource_ko_build.go
@@ -277,7 +277,7 @@ func doPublish(ctx context.Context, r build.Result, opts buildOptions) (string,
 		publish.WithUserAgent(userAgent),
 	}
 
-	if opts.tags != nil && len(opts.tags) > 0 {
+	if len(opts.tags) > 0 {
 		po = append(po, publish.WithTags(opts.tags))
 	}