diff --git a/.circleci/config.yml b/.circleci/config.yml
index 27068008be..fb68da6665 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -3,7 +3,7 @@ jobs:
    build-alpine:
      working_directory: ~/please
      docker:
-       - image: ghcr.io/thought-machine/please_alpine:20250318
+       - image: ghcr.io/thought-machine/please_alpine:20260318
      resource_class: large
      environment:
        PLZ_ARGS: "--profile ci --profile alpine --exclude no-musl"
@@ -43,7 +43,7 @@ jobs:
    build-linux:
      working_directory: ~/please
      docker:
-       - image: ghcr.io/thought-machine/please_ubuntu:20250318
+       - image: ghcr.io/thought-machine/please_ubuntu:20260318
      resource_class: large
      environment:
        PLZ_ARGS: "--profile ci"
@@ -91,7 +91,7 @@ jobs:
    build-linux-alt:
      working_directory: ~/please
      docker:
-       - image: ghcr.io/thought-machine/please_ubuntu_alt:20250318
+       - image: ghcr.io/thought-machine/please_ubuntu_alt:20260318
      resource_class: large
      environment:
        PLZ_ARGS: "-c cover --profile ci-alt"
@@ -154,7 +154,7 @@ jobs:
    build-freebsd:
      working_directory: ~/please
      docker:
-       - image: ghcr.io/thought-machine/please_freebsd_builder:20250318
+       - image: ghcr.io/thought-machine/please_freebsd_builder:20260318
      resource_class: large
      steps:
        - checkout
@@ -180,7 +180,7 @@ jobs:
    build-linux-arm64:
      working_directory: ~/please
      docker:
-       - image: ghcr.io/thought-machine/please_ubuntu:20250318
+       - image: ghcr.io/thought-machine/please_ubuntu:20260318
      resource_class: large
      steps:
        - checkout
@@ -250,7 +250,7 @@ jobs:
    test-rex:
      working_directory: ~/please
      docker:
-       - image: ghcr.io/thought-machine/please_ubuntu:20250318
+       - image: ghcr.io/thought-machine/please_ubuntu:20260318
      resource_class: xlarge
      steps:
        - checkout
@@ -267,7 +267,7 @@ jobs:
    test-http-cache:
      working_directory: ~/please
      docker:
-       - image: ghcr.io/thought-machine/please_ubuntu:20250318
+       - image: ghcr.io/thought-machine/please_ubuntu:20260318
      resource_class: large
      steps:
        - checkout
@@ -283,7 +283,7 @@ jobs:
    # Releases to github and homebrew
    release:
      docker:
-       - image: ghcr.io/thought-machine/please_ubuntu:20250318
+       - image: ghcr.io/thought-machine/please_ubuntu:20260318
      environment:
        GOOGLE_APPLICATION_CREDENTIALS=/tmp/service_account.json
      steps:
@@ -298,7 +298,7 @@ jobs:
    # Releases the docs and the binaries to gs for please.build and get.please.build
    release-gs:
      docker:
-       - image: ghcr.io/thought-machine/please_ubuntu:20250318
+       - image: ghcr.io/thought-machine/please_ubuntu:20260318
      environment:
        GOOGLE_APPLICATION_CREDENTIALS=/tmp/service_account.json
      steps:
@@ -310,7 +310,7 @@ jobs:
    # Runs a benchmarking test and records some performance results.
    perf-test:
      docker:
-       - image: ghcr.io/thought-machine/please_ubuntu:20250318
+       - image: ghcr.io/thought-machine/please_ubuntu:20260318
      environment:
        GOOGLE_APPLICATION_CREDENTIALS=/tmp/service_account.json
      resource_class: xlarge  # Want to run these tests with a significant amount of parallelism
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index 409d2430e8..64007979d7 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -14,8 +14,8 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '^1.24'
+          go-version: '^1.26'
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v8
         with:
-          version: v2.2
+          version: v2.11
diff --git a/docs/codelabs/using_plugins.md b/docs/codelabs/using_plugins.md
index 88af3fbe6e..092c560f8f 100644
--- a/docs/codelabs/using_plugins.md
+++ b/docs/codelabs/using_plugins.md
@@ -126,7 +126,7 @@ help [language]`.
 ```python
 plugin_repo(
   name = "go",
-  revision = "v1.17.2",
+  revision = "v1.29.0",
   plugin = "go-rules",
   owner = "please-build",
 )
diff --git a/docs/tools/plugin_config_tool/plugin_config_tool.go b/docs/tools/plugin_config_tool/plugin_config_tool.go
index a472e8162e..1cae87a797 100644
--- a/docs/tools/plugin_config_tool/plugin_config_tool.go
+++ b/docs/tools/plugin_config_tool/plugin_config_tool.go
@@ -87,7 +87,8 @@ func getRules(buildDefsDirs []string) *rules.Rules {
 		}
 	}
 
-	args := []string{"--noupdate", "query", "rules"}
+	args := make([]string, 0, 3+len(defs))
+	args = append(args, []string{"--noupdate", "query", "rules"}...)
 	cmd := exec.Command(opts.Please, append(args, defs...)...)
 	var outb, errb bytes.Buffer
 	cmd.Stdout = &outb
diff --git a/go.mod b/go.mod
index 98c3c534d8..146473503b 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/thought-machine/please
 
-go 1.24.0
+go 1.26.1
 
 require (
 	cloud.google.com/go/longrunning v0.5.5
diff --git a/plugins/BUILD b/plugins/BUILD
index 1222d07873..a8de84cc77 100644
--- a/plugins/BUILD
+++ b/plugins/BUILD
@@ -1,7 +1,7 @@
 plugin_repo(
     name = "go",
     plugin = "go-rules",
-    revision = "v1.21.5",
+    revision = "v1.29.0",
 )
 
 plugin_repo(
@@ -13,11 +13,11 @@ plugin_repo(
 plugin_repo(
     name = "shell",
     plugin = "shell-rules",
-    revision = "v0.1.1",
+    revision = "v0.2.1",
 )
 
 plugin_repo(
     name = "python",
     plugin = "python-rules",
-    revision = "v1.7.4",
+    revision = "v1.14.0",
 )
diff --git a/src/cli/suggest.go b/src/cli/suggest.go
index 4eb3406b61..a638af4bd4 100644
--- a/src/cli/suggest.go
+++ b/src/cli/suggest.go
@@ -2,6 +2,7 @@ package cli
 
 import (
 	"sort"
+	"strings"
 
 	"github.com/texttheater/golang-levenshtein/levenshtein"
 )
@@ -32,18 +33,20 @@ func PrettyPrintSuggestion(needle string, haystack []string, maxSuggestionDistan
 		return ""
 	}
 	// Obviously there's now more code to pretty-print the suggestions than to do the calculation...
-	msg := "\nMaybe you meant "
+	var msgBuilder strings.Builder
+	msgBuilder.WriteString("\nMaybe you meant ")
 	for i, o := range options {
 		if i > 0 {
 			if i < len(options)-1 {
-				msg += " , " // Leave a space before the comma so you can select them without getting the question mark
+				msgBuilder.WriteString(" , ") // Leave a space before the comma so you can select them without getting the question mark
 			} else {
-				msg += " or "
+				msgBuilder.WriteString(" or ")
 			}
 		}
-		msg += o
+		msgBuilder.WriteString(o)
 	}
-	return msg + " ?" // Leave a space so you can select them without getting the question mark
+	msgBuilder.WriteString(" ?") // Leave a space so you can select them without getting the question mark
+	return msgBuilder.String()
 }
 
 type suggestion struct {
diff --git a/src/core/build_target.go b/src/core/build_target.go
index d15a827b5b..3268e55f03 100644
--- a/src/core/build_target.go
+++ b/src/core/build_target.go
@@ -1021,7 +1021,7 @@ func (target *BuildTarget) SourcePaths(graph *BuildGraph, sources []BuildInput)
 // sourcePaths returns the source paths for a single source.
 func (target *BuildTarget) sourcePaths(graph *BuildGraph, source BuildInput, f buildPathsFunc) []string {
 	if label, ok := source.nonOutputLabel(); ok {
-		ret := []string{}
+		var ret []string // nolint:prealloc
 		for _, providedLabel := range graph.TargetOrDie(label).ProvideFor(target) {
 			ret = append(ret, f(providedLabel, graph)...)
 		}
diff --git a/src/core/command_replacements.go b/src/core/command_replacements.go
index b3e65ba52f..c3be16df7e 100644
--- a/src/core/command_replacements.go
+++ b/src/core/command_replacements.go
@@ -257,7 +257,7 @@ func checkAndReplaceSequence(state *BuildState, target, dep *BuildTarget, ep, in
 		}
 		return base64.RawURLEncoding.EncodeToString(h)
 	}
-	output := ""
+	var outputBuilder strings.Builder
 	if ep == "" {
 		for _, out := range dep.Outputs() {
 			if allOutputs || out == in {
@@ -266,24 +266,23 @@ func checkAndReplaceSequence(state *BuildState, target, dep *BuildTarget, ep, in
 					if err != nil {
 						log.Fatalf("Couldn't calculate relative path: %s", err)
 					}
-					output += quote(abs) + " "
+					outputBuilder.WriteString(quote(abs))
 				} else {
-					output += quote(fileDestination(target, dep, out, dir, outPrefix, test)) + " "
+					outputBuilder.WriteString(quote(fileDestination(target, dep, out, dir, outPrefix, test)))
 				}
+				outputBuilder.WriteString(" ")
 				if dir {
 					break
 				}
 			}
 		}
-	} else {
-		out, ok := dep.EntryPoints[ep]
-		if !ok {
-			log.Fatalf("%v has no entry point %s", dep, ep)
-		}
-		output = quote(fileDestination(target, dep, out, dir, outPrefix, test))
+		return strings.TrimRight(outputBuilder.String(), " ")
 	}
-
-	return strings.TrimRight(output, " ")
+	out, ok := dep.EntryPoints[ep]
+	if !ok {
+		log.Fatalf("%v has no entry point %s", dep, ep)
+	}
+	return quote(fileDestination(target, dep, out, dir, outPrefix, test))
 }
 
 func fileDestination(target, dep *BuildTarget, out string, dir, outPrefix, test bool) string {
diff --git a/src/core/cycle_detector.go b/src/core/cycle_detector.go
index 0a0c926e97..39dc99549e 100644
--- a/src/core/cycle_detector.go
+++ b/src/core/cycle_detector.go
@@ -75,10 +75,10 @@ type errCycle struct {
 }
 
 func (err *errCycle) Error() string {
-	labels := make([]string, len(err.Cycle))
+	labels := make([]string, len(err.Cycle)+1)
 	for i, t := range err.Cycle {
 		labels[i] = t.Label.String()
 	}
-	labels = append(labels, labels[0])
+	labels[len(labels)-1] = labels[0]
 	return fmt.Sprintf("Dependency cycle found:\n%s\nSorry, but you'll have to refactor your build files to avoid this cycle", strings.Join(labels, "\n -> "))
 }
diff --git a/src/help/help.go b/src/help/help.go
index 326f87eddb..eb1bc303fc 100644
--- a/src/help/help.go
+++ b/src/help/help.go
@@ -182,7 +182,7 @@ func formatPluginHelpMessage(message, description, docSite string, options map[s
 	if docSite != "" {
 		message += "\n" + docSite + "\n"
 	}
-	configOptions := ""
+	var configOptionsBuilder strings.Builder
 	for k, v := range options {
 		valueType := v.Type
 		if v.Type == "" {
@@ -210,31 +210,33 @@ func formatPluginHelpMessage(message, description, docSite string, options map[s
 		if def != "" {
 			def = " (" + def + ")"
 		}
-		configOptions += fmt.Sprintf("${BLUE}   %s${RESET} ${GREEN}(%s)${RESET}${WHITE}%s${RESET} %s\n",
+		_, _ = fmt.Fprintf(&configOptionsBuilder, "${BLUE}   %s${RESET} ${GREEN}(%s)${RESET}${WHITE}%s${RESET} %s\n",
 			key,
 			valueType,
 			def,
 			v.Help)
 	}
-	if configOptions != "" {
-		message += "\n${BOLD_YELLOW}This plugin has the following options:${RESET}\n" + configOptions
+	if configOptionsBuilder.Len() != 0 {
+		message += "\n${BOLD_YELLOW}This plugin has the following options:${RESET}\n" + configOptionsBuilder.String()
 	}
 
-	buildDefs := ""
+	var buildDefsBuilder strings.Builder
 	for k, v := range buildRulesMap {
-		buildDefs += fmt.Sprintf("${BLUE}   %v${RESET}", strings.ToLower(k))
-		arglist := "("
+		_, _ = fmt.Fprintf(&buildDefsBuilder, "${BLUE}   %v${RESET}", strings.ToLower(k))
+		var argListBuilder strings.Builder
+		argListBuilder.WriteString("(")
 		for i, arg := range v.FuncDef.Arguments {
+			argListBuilder.WriteString(arg.Name)
 			if i != len(v.FuncDef.Arguments)-1 {
-				arglist += arg.Name + ", "
+				argListBuilder.WriteString(", ")
 			} else {
-				arglist += arg.Name + ")"
+				argListBuilder.WriteString(")")
 			}
 		}
-		buildDefs += fmt.Sprintf("${GREEN}%v${RESET}\n", arglist)
+		_, _ = fmt.Fprintf(&buildDefsBuilder, "${GREEN}%v${RESET}\n", argListBuilder.String())
 	}
-	if buildDefs != "" {
-		message += "\n${BOLD_YELLOW}And provides the following build defs:${RESET}\n" + buildDefs
+	if buildDefsBuilder.Len() != 0 {
+		message += "\n${BOLD_YELLOW}And provides the following build defs:${RESET}\n" + buildDefsBuilder.String()
 	}
 
 	return message
diff --git a/src/output/shell_output.go b/src/output/shell_output.go
index 613361db43..972078c477 100644
--- a/src/output/shell_output.go
+++ b/src/output/shell_output.go
@@ -630,16 +630,16 @@ var errorMessageRe = deferredregex.DeferredRegex{Re: `^([^ ]+\.[^: /]+):([0-9]+)
 
 // unbuiltTargetsMessage returns a message for any targets that are supposed to build but haven't yet.
 func unbuiltTargetsMessage(graph *core.BuildGraph) string {
-	msg := ""
+	var msgBuilder strings.Builder
 	for _, target := range graph.AllTargets() {
 		if target.State() == core.Active {
-			msg += fmt.Sprintf("  %s", target.Label)
+			_, _ = fmt.Fprintf(&msgBuilder, "  %s", target.Label)
 		} else if target.State() == core.Pending {
-			msg += fmt.Sprintf("  %s (pending build)\n", target.Label)
+			_, _ = fmt.Fprintf(&msgBuilder, "  %s (pending build)\n", target.Label)
 		}
 	}
-	if msg != "" {
-		return "\nThe following targets have not yet built:\n" + msg
+	if msgBuilder.Len() == 0 {
+		return "\nThe following targets have not yet built:\n" + msgBuilder.String()
 	}
 	return ""
 }
diff --git a/src/parse/asp/builtins.go b/src/parse/asp/builtins.go
index 353478b07a..62e0a4380a 100644
--- a/src/parse/asp/builtins.go
+++ b/src/parse/asp/builtins.go
@@ -881,14 +881,14 @@ func mapFunc(s *scope, args []pyObject) pyObject {
 	s.Assert(isFunc, "Argument mapper must be callable, not %s", args[0].Type())
 	s.Assert(isList, "Argument seq must be a list, not %s", args[1].Type())
 
-	var ret pyList
-	for _, li := range l {
+	ret := make(pyList, len(l))
+	for i, li := range l {
 		c := &Call{
 			Arguments: []CallArgument{{
 				Value: Expression{optimised: &optimisedExpression{Constant: li}},
 			}},
 		}
-		ret = append(ret, mapper.Call(s, c))
+		ret[i] = mapper.Call(s, c)
 	}
 	return ret
 }
diff --git a/src/remote/action.go b/src/remote/action.go
index 69f6eaa6eb..2098ec48c3 100644
--- a/src/remote/action.go
+++ b/src/remote/action.go
@@ -90,7 +90,8 @@ func (c *Client) buildCommand(target *core.BuildTarget, inputRoot *pb.Directory,
 	}
 	// We can't predict what variables like this should be so we sneakily bung something on
 	// the front of the command. It'd be nicer if there were a better way though...
-	var commandPrefix = "export TMP_DIR=\"`pwd`\" && export HOME=$TMP_DIR && "
+	var commandPrefixBuilder strings.Builder
+	commandPrefixBuilder.WriteString("export TMP_DIR=\"`pwd`\" && export HOME=$TMP_DIR && ")
 
 	// Similarly, we need to export these so that things like $TMP_DIR get expanded correctly.
 	if len(target.Env) > 0 {
@@ -100,13 +101,13 @@ func (c *Client) buildCommand(target *core.BuildTarget, inputRoot *pb.Directory,
 		}
 		sort.Strings(keys)
 		for _, k := range keys {
-			commandPrefix += fmt.Sprintf("export %s=%s && ", k, shellescape.Quote(target.Env[k]))
+			_, _ = fmt.Fprintf(&commandPrefixBuilder, "export %s=%s && ", k, shellescape.Quote(target.Env[k]))
 		}
 	}
 
 	outs := target.AllOutputs()
 	if len(target.Outputs()) == 1 { // $OUT is relative when running remotely; make it absolute
-		commandPrefix += `export OUT="$TMP_DIR/$OUT" && `
+		commandPrefixBuilder.WriteString(`export OUT="$TMP_DIR/$OUT" && `)
 	}
 	if target.IsRemoteFile {
 		// Synthesize something for the Command proto. We never execute this, but it does get hashed for caching
@@ -127,7 +128,7 @@ func (c *Client) buildCommand(target *core.BuildTarget, inputRoot *pb.Directory,
 	cmd, err := core.ReplaceSequences(state, target, cmd)
 	return &pb.Command{
 		Platform:             c.targetPlatformProperties(target),
-		Arguments:            process.BashCommand(c.shellPath, commandPrefix+cmd, state.Config.Build.ExitOnError),
+		Arguments:            process.BashCommand(c.shellPath, commandPrefixBuilder.String()+cmd, state.Config.Build.ExitOnError),
 		EnvironmentVariables: c.buildEnv(target, c.stampedBuildEnvironment(state, target, inputRoot, stamp, isTest || isRun), target.Sandbox),
 		OutputPaths:          outs,
 	}, err
diff --git a/src/remote/utils.go b/src/remote/utils.go
index 2e365615f7..d81d70700a 100644
--- a/src/remote/utils.go
+++ b/src/remote/utils.go
@@ -609,19 +609,18 @@ func reencodeSRI(target *core.BuildTarget, h string) string {
 
 // dialOpts returns a set of dial options to apply based on the config.
 func (c *Client) dialOpts() ([]grpc.DialOption, error) {
-	opts := []grpc.DialOption{
-		grpc.WithStatsHandler(c.stats),
-		// Set an arbitrarily large (400MB) max message size so it isn't a limitation.
-		grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(419430400)),
-		grpc.WithChainUnaryInterceptor(grpc_prometheus.UnaryClientInterceptor),
-		grpc.WithChainStreamInterceptor(grpc_prometheus.StreamClientInterceptor),
-	}
+	opts := make([]grpc.DialOption, 4, 5)
+	opts[0] = grpc.WithStatsHandler(c.stats)
+	// Set an arbitrarily large (400MB) max message size so it isn't a limitation.
+	opts[1] = grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(419430400))
+	opts[2] = grpc.WithChainUnaryInterceptor(grpc_prometheus.UnaryClientInterceptor)
+	opts[3] = grpc.WithChainStreamInterceptor(grpc_prometheus.StreamClientInterceptor)
 	if c.state.Config.Remote.TokenFile == "" {
 		return opts, nil
 	}
 	token, err := os.ReadFile(c.state.Config.Remote.TokenFile)
 	if err != nil {
-		return opts, fmt.Errorf("Failed to load token from file: %s", err)
+		return opts, fmt.Errorf("failed to load token from file: %s", err)
 	}
 	return append(opts, grpc.WithPerRPCCredentials(preSharedToken(string(token)))), nil
 }
diff --git a/src/scm/git.go b/src/scm/git.go
index 6332593087..3471f196ba 100644
--- a/src/scm/git.go
+++ b/src/scm/git.go
@@ -67,15 +67,15 @@ func (g *git) ChangesIn(diffSpec string, relativeTo string) []string {
 	if relativeTo == "" {
 		relativeTo = g.repoRoot
 	}
-	files := make([]string, 0)
 	command := []string{"diff-tree", "--no-commit-id", "--name-only", "-r", diffSpec}
 	out, err := exec.Command("git", command...).CombinedOutput()
 	if err != nil {
 		log.Fatalf("unable to determine changes: %s\nOutput:\n%s", err, string(out))
 	}
 	output := strings.Split(string(out), "\n")
-	for _, o := range output {
-		files = append(files, g.fixGitRelativePath(strings.TrimSpace(o), relativeTo))
+	files := make([]string, len(output))
+	for i, o := range output {
+		files[i] = g.fixGitRelativePath(strings.TrimSpace(o), relativeTo)
 	}
 	return files
 }
@@ -86,7 +86,8 @@ func (g *git) ChangedFiles(fromCommit string, includeUntracked bool, relativeTo
 		relativeTo = g.repoRoot
 	}
 	relSuffix := []string{"--", relativeTo}
-	command := []string{"diff", "--name-only", "HEAD"}
+	command := make([]string, 0, 3+len(relSuffix))
+	command = append(command, []string{"diff", "--name-only", "HEAD"}...)
 
 	out, err := exec.Command("git", append(command, relSuffix...)...).CombinedOutput()
 	if err != nil {
@@ -97,9 +98,10 @@ func (g *git) ChangedFiles(fromCommit string, includeUntracked bool, relativeTo
 	if fromCommit != "" {
 		// Grab the diff from the merge-base to HEAD using ... syntax.  This ensures we have just
 		// the changes that have occurred on the current branch.
-		command = []string{"diff", "--name-only", fromCommit + "...HEAD"}
-		command = append(command, relSuffix...)
-		out, err = exec.Command("git", command...).CombinedOutput()
+		fromCommand := make([]string, 0, 3+len(relSuffix))
+		fromCommand = append(fromCommand, []string{"diff", "--name-only", fromCommit + "...HEAD"}...)
+		fromCommand = append(fromCommand, relSuffix...)
+		out, err = exec.Command("git", fromCommand...).CombinedOutput()
 		if err != nil {
 			log.Fatalf("unable to check diff vs. %s: %s\nOutput:\n%s", fromCommit, err, string(out))
 		}
@@ -107,8 +109,9 @@ func (g *git) ChangedFiles(fromCommit string, includeUntracked bool, relativeTo
 		files = append(files, committedChanges...)
 	}
 	if includeUntracked {
-		command = []string{"ls-files", "--other", "--exclude-standard"}
-		out, err = exec.Command("git", append(command, relSuffix...)...).CombinedOutput()
+		includeCommand := make([]string, 0, 3+len(relSuffix))
+		includeCommand = append(includeCommand, []string{"ls-files", "--other", "--exclude-standard"}...)
+		out, err = exec.Command("git", append(includeCommand, relSuffix...)...).CombinedOutput()
 		if err != nil {
 			log.Fatalf("unable to determine untracked files: %s\nOutput:\n%s", err, string(out))
 		}
@@ -116,9 +119,9 @@ func (g *git) ChangedFiles(fromCommit string, includeUntracked bool, relativeTo
 		files = append(files, untracked...)
 	}
 	// git will report changed files relative to the worktree: re-relativize to relativeTo
-	normalized := make([]string, 0)
-	for _, f := range files {
-		normalized = append(normalized, g.fixGitRelativePath(strings.TrimSpace(f), relativeTo))
+	normalized := make([]string, len(files))
+	for i, f := range files {
+		normalized[i] = g.fixGitRelativePath(strings.TrimSpace(f), relativeTo)
 	}
 	return normalized
 }
diff --git a/src/tool/tool.go b/src/tool/tool.go
index 2b859608c7..e3a830bfa2 100644
--- a/src/tool/tool.go
+++ b/src/tool/tool.go
@@ -26,8 +26,9 @@ type Tool string
 
 // Complete suggests completions for a partial tool name.
 func (tool Tool) Complete(match string) []flags.Completion {
-	ret := []flags.Completion{}
-	for k := range matchingTools(core.DefaultConfiguration(), match) {
+	matches := matchingTools(core.DefaultConfiguration(), match)
+	ret := make([]flags.Completion, 0, len(matches))
+	for k := range matches {
 		ret = append(ret, flags.Completion{Item: k})
 	}
 	return ret
@@ -80,8 +81,9 @@ func MatchingTool(config *core.Configuration, tool string) (string, bool) {
 
 // allToolNames returns the names of all available tools.
 func allToolNames(config *core.Configuration, prefix string) []string {
-	ret := []string{}
-	for k := range matchingTools(config, prefix) {
+	matches := matchingTools(config, prefix)
+	ret := make([]string, 0, len(matches))
+	for k := range matches {
 		ret = append(ret, k)
 	}
 	sort.Strings(ret)
diff --git a/test/audit/test_repo/BUILD.test b/test/audit/test_repo/BUILD.test
index d8a4b2e66e..25f1f74fa8 100644
--- a/test/audit/test_repo/BUILD.test
+++ b/test/audit/test_repo/BUILD.test
@@ -1,5 +1,5 @@
 plugin_repo(
     name = "go",
     plugin = "go-rules",
-    revision = "v1.21.5",
+    revision = "v1.29.0",
 )
diff --git a/test/entry_point/test_repo/plugins/BUILD_FILE b/test/entry_point/test_repo/plugins/BUILD_FILE
index f492afde36..fbbd6e2947 100644
--- a/test/entry_point/test_repo/plugins/BUILD_FILE
+++ b/test/entry_point/test_repo/plugins/BUILD_FILE
@@ -1,11 +1,11 @@
 plugin_repo(
     name = "shell",
     plugin = "shell-rules",
-    revision = "v0.1.1",
+    revision = "v0.2.1",
 )
 
 plugin_repo(
     name = "go",
     plugin = "go-rules",
-    revision = "v1.21.5",
+    revision = "v1.29.0",
 )
diff --git a/test/include/test_repo/plugins/BUILD_FILE b/test/include/test_repo/plugins/BUILD_FILE
index 3adcdb079a..8fae843d39 100644
--- a/test/include/test_repo/plugins/BUILD_FILE
+++ b/test/include/test_repo/plugins/BUILD_FILE
@@ -1,5 +1,5 @@
 plugin_repo(
     name = "shell",
     plugin = "shell-rules",
-    revision = "v0.1.1",
+    revision = "v0.2.1",
 )
diff --git a/test/plugins/self_referencing_plugin/plugins/BUILD_FILE b/test/plugins/self_referencing_plugin/plugins/BUILD_FILE
index 3adcdb079a..8fae843d39 100644
--- a/test/plugins/self_referencing_plugin/plugins/BUILD_FILE
+++ b/test/plugins/self_referencing_plugin/plugins/BUILD_FILE
@@ -1,5 +1,5 @@
 plugin_repo(
     name = "shell",
     plugin = "shell-rules",
-    revision = "v0.1.1",
+    revision = "v0.2.1",
 )
diff --git a/test/plugins/test_repo/plugins/BUILD_FILE b/test/plugins/test_repo/plugins/BUILD_FILE
index 9959376271..e88c935636 100644
--- a/test/plugins/test_repo/plugins/BUILD_FILE
+++ b/test/plugins/test_repo/plugins/BUILD_FILE
@@ -6,5 +6,5 @@ plugin_repo(
 plugin_repo(
     name = "go",
     plugin = "go-rules",
-    revision = "v1.21.5",
+    revision = "v1.29.0",
 )
diff --git a/test/plz_exec/test_repo/plugins/BUILD_FILE b/test/plz_exec/test_repo/plugins/BUILD_FILE
index 7d8213ed38..115f299e5d 100644
--- a/test/plz_exec/test_repo/plugins/BUILD_FILE
+++ b/test/plz_exec/test_repo/plugins/BUILD_FILE
@@ -6,5 +6,5 @@ plugin_repo(
 plugin_repo(
     name = "go",
     plugin = "go-rules",
-    revision = "v1.21.5",
+    revision = "v1.29.0",
 )
diff --git a/test/plz_run/test_repo/plugins/BUILD_FILE b/test/plz_run/test_repo/plugins/BUILD_FILE
index 3adcdb079a..8fae843d39 100644
--- a/test/plz_run/test_repo/plugins/BUILD_FILE
+++ b/test/plz_run/test_repo/plugins/BUILD_FILE
@@ -1,5 +1,5 @@
 plugin_repo(
     name = "shell",
     plugin = "shell-rules",
-    revision = "v0.1.1",
+    revision = "v0.2.1",
 )
diff --git a/test/preloaded_subinc/test_repo/plugins/BUILD_FILE b/test/preloaded_subinc/test_repo/plugins/BUILD_FILE
index ab5596925b..d8b879817e 100644
--- a/test/preloaded_subinc/test_repo/plugins/BUILD_FILE
+++ b/test/preloaded_subinc/test_repo/plugins/BUILD_FILE
@@ -1,7 +1,7 @@
 plugin_repo(
     name = "shell",
     plugin = "shell-rules",
-    revision = "v0.1.1",
+    revision = "v0.2.1",
 )
 
 plugin_repo(
diff --git a/test/proto_plugin/test_repo/plugins/BUILD_FILE b/test/proto_plugin/test_repo/plugins/BUILD_FILE
index 1cdae4cb31..1ca312d0f9 100644
--- a/test/proto_plugin/test_repo/plugins/BUILD_FILE
+++ b/test/proto_plugin/test_repo/plugins/BUILD_FILE
@@ -6,7 +6,7 @@ plugin_repo(
 plugin_repo(
     name = "go",
     plugin = "go-rules",
-    revision = "v1.21.5",
+    revision = "v1.29.0",
 )
 
 plugin_repo(
diff --git a/third_party/go/BUILD b/third_party/go/BUILD
index e4a905761e..45ebbd5279 100644
--- a/third_party/go/BUILD
+++ b/third_party/go/BUILD
@@ -5,14 +5,14 @@ package(default_visibility = ["PUBLIC"])
 go_toolchain(
     name = "toolchain",
     hashes = [
-        "fde05d84f7f64c8d01564f299ea1897fe94457d20d8d9054200ac1f8ae1c2bc3",  # go1.24.10.darwin-amd64.tar.gz
-        "71c70841bcdadf4b5d2f7c0f099952907969f25235663622a47d6f2233ad39aa",  # go1.24.10.darwin-arm64.tar.gz
-        "cb917b64aa4a407ed3310b397cc4dca10f0a3e2b0dd184ed74164ceaeab2625e",  # go1.24.10.freebsd-amd64.tar.gz
-        "dd52b974e3d9c5a7bbfb222c685806def6be5d6f7efd10f9caa9ca1fa2f47955",  # go1.24.10.linux-amd64.tar.gz
-        "94a99dae43dab8a3fe337485bbb89214b524285ec53ea02040514b0c2a9c3f94",  # go1.24.10.linux-arm64.tar.gz
+        "65773dab2f8cc4cd23d93ba6d0a805de150ca0b78378879292be0b903b8cdd08",  # go1.26.1.darwin-amd64.tar.gz
+        "353df43a7811ce284c8938b5f3c7df40b7bfb6f56cb165b150bc40b5e2dd541f",  # go1.26.1.darwin-arm64.tar.gz
+        "d89034a0b54fdc234815fecfb76d7d06a7d180d7a6124aa47715a4cacc9fe999",  # go1.26.1.freebsd-amd64.tar.gz
+        "031f088e5d955bab8657ede27ad4e3bc5b7c1ba281f05f245bcc304f327c987a",  # go1.26.1.linux-amd64.tar.gz
+        "a290581cfe4fe28ddd737dde3095f3dbeb7f2e4065cab4eae44dfc53b760c2f7",  # go1.26.1.linux-arm64.tar.gz
     ],
     install_std = False,
-    version = "1.24.10",
+    version = "1.26.1",
 )
 
 go_stdlib(
@@ -116,7 +116,7 @@ go_repo(
 
 go_repo(
     module = "golang.org/x/net",
-    version = "v0.47.0",
+    version = "v0.52.0",
 )
 
 go_repo(
diff --git a/tools/build_langserver/lsp/test_data/plugins/test.build b/tools/build_langserver/lsp/test_data/plugins/test.build
index d8a4b2e66e..25f1f74fa8 100644
--- a/tools/build_langserver/lsp/test_data/plugins/test.build
+++ b/tools/build_langserver/lsp/test_data/plugins/test.build
@@ -1,5 +1,5 @@
 plugin_repo(
     name = "go",
     plugin = "go-rules",
-    revision = "v1.21.5",
+    revision = "v1.29.0",
 )
diff --git a/tools/images/alpine/Dockerfile b/tools/images/alpine/Dockerfile
index b040b6ab17..bbb7889242 100644
--- a/tools/images/alpine/Dockerfile
+++ b/tools/images/alpine/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.24-alpine
+FROM golang:1.26-alpine
 LABEL org.opencontainers.image.authors="please <at> thoughtmachine <dot> net"
 LABEL org.opencontainers.image.source=https://github.com/thought-machine/please