diff --git a/.github/workflows/pr-golangci-lint.yaml b/.github/workflows/pr-golangci-lint.yaml
index 553f9cba37..3e12f1daaa 100644
--- a/.github/workflows/pr-golangci-lint.yaml
+++ b/.github/workflows/pr-golangci-lint.yaml
@@ -23,5 +23,5 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@639cd343e1d3b897ff35927a75193d57cfcba299 # tag=v3.6.0
         with:
-          version: v1.53.3
+          version: v1.55.2
           args: --out-format=colored-line-number
diff --git a/.golangci.yml b/.golangci.yml
index 1908b771d1..10f197e023 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,3 +1,13 @@
+run:
+  timeout: 10m
+  go: "1.21"
+  skip-files:
+  - ".*zz_generated.*\\.go"
+  - "contrib/.*"
+  - "apis/v1alpha3/.*"
+  - "apis/v1alpha4/.*"
+  allow-parallel-runners: true
+
 linters:
   disable-all: true
   enable:
@@ -40,13 +50,6 @@ linters:
 linters-settings:
   gci:
     local-prefixes: sigs.k8s.io/cluster-api-provider-vsphere
-run:
-  skip-files:
-  - ".*zz_generated.*\\.go"
-  - "contrib/.*"
-  - "apis/v1alpha3/.*"
-  - "apis/v1alpha4/.*"
-  timeout: 5m
 issue:
   max-same-issues: 0
   max-per-linter: 0
diff --git a/Makefile b/Makefile
index a0e3441064..2293653d81 100644
--- a/Makefile
+++ b/Makefile
@@ -23,7 +23,7 @@ SHELL:=/usr/bin/env bash
 #
 # Go.
 #
-GO_VERSION ?= 1.20.12
+GO_VERSION ?= 1.21.5
 GO_CONTAINER_IMAGE ?= docker.io/library/golang:$(GO_VERSION)
 
 # Use GOPROXY environment variable if set
diff --git a/hack/ensure-go.sh b/hack/ensure-go.sh
index a09074f173..f9c2152de3 100755
--- a/hack/ensure-go.sh
+++ b/hack/ensure-go.sh
@@ -19,7 +19,9 @@ set -o nounset
 set -o pipefail
 
 # MIN_GO_VERSION is the minimum, supported Go version.
-MIN_GO_VERSION="go${MIN_GO_VERSION:-1.20}"
+# Note: Enforce only the minor version as we can't guarantee that
+# the images we use in ProwJobs already use the latest patch version.
+MIN_GO_VERSION="go${MIN_GO_VERSION:-1.21}"
 
 # Ensure the go tool exists and is a viable version.
 verify_go_version() {
diff --git a/main.go b/main.go
index 62a38ba53f..5b376102c9 100644
--- a/main.go
+++ b/main.go
@@ -20,7 +20,6 @@ import (
 	"errors"
 	"flag"
 	"fmt"
-	"math/rand"
 	"net/http"
 	"net/http/pprof"
 	"os"
@@ -154,8 +153,6 @@ func InitFlags(fs *pflag.FlagSet) {
 }
 
 func main() {
-	rand.Seed(time.Now().UnixNano())
-
 	InitFlags(pflag.CommandLine)
 	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
 	pflag.CommandLine.SetNormalizeFunc(cliflag.WordSepNormalizeFunc)
diff --git a/pkg/services/govmomi/util_test.go b/pkg/services/govmomi/util_test.go
index 33f05b2704..b6964a7797 100644
--- a/pkg/services/govmomi/util_test.go
+++ b/pkg/services/govmomi/util_test.go
@@ -81,7 +81,8 @@ func Test_ShouldRetryTask(t *testing.T) {
 				{baseTask(types.TaskInfoStateRunning, ""), false},
 				{baseTask(types.TaskInfoStateSuccess, ""), true},
 			}
-			for _, tt := range tests {
+			for i := range tests {
+				tt := tests[i]
 				t.Run(fmt.Sprintf("state: %s", tt.task.Info.State), func(t *testing.T) {
 					g = NewWithT(t)
 					reconciled, err := checkAndRetryTask(vmCtx, &tt.task)
diff --git a/pkg/services/network/nsxt_provider.go b/pkg/services/network/nsxt_provider.go
index 49439da05e..f91d85c9ac 100644
--- a/pkg/services/network/nsxt_provider.go
+++ b/pkg/services/network/nsxt_provider.go
@@ -117,7 +117,7 @@ func (np *nsxtNetworkProvider) ProvisionClusterNetwork(ctx *vmware.ClusterContex
 					"cluster", clusterKey, "ip", systemNSSnatIP)
 
 				// WhitelistSourceRanges accept cidrs only
-				vnet.Spec.WhitelistSourceRanges = systemNSSnatIP + "/32"
+				vnet.Spec.WhitelistSourceRanges = systemNSSnatIP + "/32" //nolint:goconst
 			}
 		}
 
diff --git a/pkg/services/vmoperator/vmopmachine_test.go b/pkg/services/vmoperator/vmopmachine_test.go
index 2080666c64..993bb9a93c 100644
--- a/pkg/services/vmoperator/vmopmachine_test.go
+++ b/pkg/services/vmoperator/vmopmachine_test.go
@@ -196,7 +196,7 @@ var _ = Describe("VirtualMachine tests", func() {
 
 			// Provide valid bootstrap data.
 			By("bootstrap data is created")
-			secretName := machine.GetName() + "-data"
+			secretName := machine.GetName() + "-data" //nolint:goconst
 			secret := &corev1.Secret{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      secretName,