diff --git a/.github/workflows/build_daily.yaml b/.github/workflows/build_daily.yaml
index d67ab9f1dd7..5f33c71a094 100644
--- a/.github/workflows/build_daily.yaml
+++ b/.github/workflows/build_daily.yaml
@@ -13,7 +13,7 @@ permissions:
 env:
   GOPROXY: https://proxy.golang.org/
   SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-  GO_VERSION: 1.22.5
+  GO_VERSION: 1.22.8
 
 jobs:
   e2e-contour-xds:
diff --git a/.github/workflows/build_tag.yaml b/.github/workflows/build_tag.yaml
index 985730c3eb5..cc89652060c 100644
--- a/.github/workflows/build_tag.yaml
+++ b/.github/workflows/build_tag.yaml
@@ -19,7 +19,7 @@ permissions:
 env:
   GOPROXY: https://proxy.golang.org/
   SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-  GO_VERSION: 1.22.5
+  GO_VERSION: 1.22.8
 
 jobs:
   build:
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index ec06fcaa503..32d6c31e7c5 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -14,7 +14,7 @@ permissions:
 
 env:
   GOPROXY: https://proxy.golang.org/
-  GO_VERSION: 1.22.5
+  GO_VERSION: 1.22.8
 
 jobs:
   CodeQL-Build:
diff --git a/.github/workflows/prbuild.yaml b/.github/workflows/prbuild.yaml
index d3a67084957..85dc6dc23f2 100644
--- a/.github/workflows/prbuild.yaml
+++ b/.github/workflows/prbuild.yaml
@@ -14,7 +14,7 @@ permissions:
 env:
   GOPROXY: https://proxy.golang.org/
   SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-  GO_VERSION: 1.22.5
+  GO_VERSION: 1.22.8
 jobs:
   lint:
     runs-on: ubuntu-latest
diff --git a/Makefile b/Makefile
index 69302a9b1e1..e0855911e3a 100644
--- a/Makefile
+++ b/Makefile
@@ -6,7 +6,7 @@ IMAGE := $(REGISTRY)/$(PROJECT)
 SRCDIRS := ./cmd ./internal ./apis
 LOCAL_BOOTSTRAP_CONFIG = localenvoyconfig.yaml
 SECURE_LOCAL_BOOTSTRAP_CONFIG = securelocalenvoyconfig.yaml
-ENVOY_IMAGE = docker.io/envoyproxy/envoy:v1.30.4
+ENVOY_IMAGE = docker.io/envoyproxy/envoy:v1.30.7
 GATEWAY_API_VERSION ?= $(shell grep "sigs.k8s.io/gateway-api" go.mod | awk '{print $$2}')
 
 # Used to supply a local Envoy docker container an IP to connect to that is running
@@ -44,7 +44,7 @@ endif
 IMAGE_PLATFORMS ?= linux/amd64,linux/arm64
 
 # Base build image to use.
-BUILD_BASE_IMAGE ?= golang:1.22.5@sha256:829eff99a4b2abffe68f6a3847337bf6455d69d17e49ec1a97dac78834754bd6
+BUILD_BASE_IMAGE ?= golang:1.22.8@sha256:0ca97f4ab335f4b284a5b8190980c7cdc21d320d529f2b643e8a8733a69bfb6b
 
 # Enable build with CGO.
 BUILD_CGO_ENABLED ?= 0
diff --git a/cmd/contour/gatewayprovisioner.go b/cmd/contour/gatewayprovisioner.go
index e1782841c91..f57517f2b3d 100644
--- a/cmd/contour/gatewayprovisioner.go
+++ b/cmd/contour/gatewayprovisioner.go
@@ -36,7 +36,7 @@ func registerGatewayProvisioner(app *kingpin.Application) (*kingpin.CmdClause, *
 
 	provisionerConfig := &gatewayProvisionerConfig{
 		contourImage:          "ghcr.io/projectcontour/contour:v1.29.2",
-		envoyImage:            "docker.io/envoyproxy/envoy:v1.30.4",
+		envoyImage:            "docker.io/envoyproxy/envoy:v1.30.7",
 		metricsBindAddress:    ":8080",
 		leaderElection:        false,
 		leaderElectionID:      "0d879e31.projectcontour.io",
diff --git a/examples/contour/03-envoy.yaml b/examples/contour/03-envoy.yaml
index d1a319464b4..57e89e94c97 100644
--- a/examples/contour/03-envoy.yaml
+++ b/examples/contour/03-envoy.yaml
@@ -50,7 +50,7 @@ spec:
         - --log-level info
         command:
         - envoy
-        image: docker.io/envoyproxy/envoy:v1.30.4
+        image: docker.io/envoyproxy/envoy:v1.30.7
         imagePullPolicy: IfNotPresent
         name: envoy
         env:
diff --git a/examples/deployment/03-envoy-deployment.yaml b/examples/deployment/03-envoy-deployment.yaml
index 61bced48fb4..39e143db0c0 100644
--- a/examples/deployment/03-envoy-deployment.yaml
+++ b/examples/deployment/03-envoy-deployment.yaml
@@ -62,7 +62,7 @@ spec:
             - --log-level info
           command:
             - envoy
-          image: docker.io/envoyproxy/envoy:v1.30.4
+          image: docker.io/envoyproxy/envoy:v1.30.7
           imagePullPolicy: IfNotPresent
           name: envoy
           env:
diff --git a/examples/render/contour-deployment.yaml b/examples/render/contour-deployment.yaml
index 0fe23d87b71..41316a9793f 100644
--- a/examples/render/contour-deployment.yaml
+++ b/examples/render/contour-deployment.yaml
@@ -9267,7 +9267,7 @@ spec:
             - --log-level info
           command:
             - envoy
-          image: docker.io/envoyproxy/envoy:v1.30.4
+          image: docker.io/envoyproxy/envoy:v1.30.7
           imagePullPolicy: IfNotPresent
           name: envoy
           env:
diff --git a/examples/render/contour-gateway.yaml b/examples/render/contour-gateway.yaml
index ddd4afb0e79..4a9810dd5ac 100644
--- a/examples/render/contour-gateway.yaml
+++ b/examples/render/contour-gateway.yaml
@@ -9071,7 +9071,7 @@ spec:
         - --log-level info
         command:
         - envoy
-        image: docker.io/envoyproxy/envoy:v1.30.4
+        image: docker.io/envoyproxy/envoy:v1.30.7
         imagePullPolicy: IfNotPresent
         name: envoy
         env:
diff --git a/examples/render/contour.yaml b/examples/render/contour.yaml
index 11268e35e6d..7c0885e8e2b 100644
--- a/examples/render/contour.yaml
+++ b/examples/render/contour.yaml
@@ -9255,7 +9255,7 @@ spec:
         - --log-level info
         command:
         - envoy
-        image: docker.io/envoyproxy/envoy:v1.30.4
+        image: docker.io/envoyproxy/envoy:v1.30.7
         imagePullPolicy: IfNotPresent
         name: envoy
         env: