diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 0b26353261a..4ac24dc2c1d 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,6 +5,13 @@ updates:
   - "/image"
   schedule:
     interval: "daily"
+  allow:
+  - dependency-name: "*"
+  ignore:
+  - dependency-name: "golang"
+    update-types:
+    - "version-update:semver-major"
+    - "version-update:semver-minor"
 - package-ecosystem: "gomod"
   open-pull-requests-limit: 20
   directories:
diff --git a/go.mod b/go.mod
index bae2843b678..53b05335acc 100644
--- a/go.mod
+++ b/go.mod
@@ -2,7 +2,7 @@ module github.com/pingcap/tidb-operator/v2
 
 go 1.24.0
 
-toolchain go1.25.7
+toolchain go1.25.8
 
 replace github.com/pingcap/tidb-operator/api/v2 => ./api
 
diff --git a/image/Dockerfile b/image/Dockerfile
index 11a29c653ab..30613d84da9 100644
--- a/image/Dockerfile
+++ b/image/Dockerfile
@@ -1,5 +1,5 @@
 # syntax=docker.io/docker/dockerfile:1.8.1@sha256:e87caa74dcb7d46cd820352bfea12591f3dba3ddc4285e19c7dcd13359f7cefd
-FROM --platform=$BUILDPLATFORM golang:1.25.7@sha256:cc737435e2742bd6da3b7d575623968683609a3d2e0695f9d85bee84071c08e6 AS builder
+FROM --platform=$BUILDPLATFORM golang:1.25.8@sha256:dfae680962532eeea67ab297f1166c2c4e686edb9a8f05f9d02d96fc9191833e AS builder
 
 ARG TARGETPLATFORM
 ARG TARGET