diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index ca85a28aa12ff8..80adfa9060a8f3 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -196,7 +196,7 @@ RUN curl -sSL "https://awscli.amazonaws.com/awscli-exe-linux-$(arch).zip" -o aws
     ./aws/install --bin-dir /usr/local/bin --install-dir /usr/local/aws-cli --update && \
     rm -rf awscliv2.zip ./aws
 
-ENV GO_VERSION=1.25.9
+ENV GO_VERSION=1.26.9
 ENV GOPATH=/root/go-packages
 ENV GOROOT=/root/go
 ENV PATH=$GOROOT/bin:$GOPATH/bin:$PATH
@@ -255,7 +255,7 @@ RUN curl -fsSL https://github.com/csweichel/oci-tool/releases/download/v0.2.0/oc
     && chmod +x /usr/local/bin/oci-tool
 
 # Install golangci-lint
-RUN go install -v github.com/golangci/golangci-lint/cmd/golangci-lint@latest
+RUN GOBIN=/opt/golangci-lint/bin go install -v github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.15.0
 
 ENV USE_GKE_GCLOUD_AUTH_PLUGIN=True
 
@@ -376,3 +376,6 @@ ENV PRE_COMMIT_HOME=/workspace/.pre-commit
 # terminal sessions in Gitpod workspaces.
 ENV PREVIEW_ENV_DEV_SA_KEY_PATH=/root/.config/gcloud/sa.json
 ENV GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES=1
+
+# Prefer the pinned linter over tools installed elsewhere in the image.
+ENV PATH=/opt/golangci-lint/bin:$PATH
diff --git a/dev/image/Dockerfile b/dev/image/Dockerfile
index 4b4fc76e61d46c..d8d31a06bdb6c1 100644
--- a/dev/image/Dockerfile
+++ b/dev/image/Dockerfile
@@ -11,7 +11,7 @@ USER root
 ### Go ###
 # Pin Go version explicitly to ensure all CI-built binaries use a
 # non-vulnerable toolchain (CVE-2026-27143 requires >= 1.25.9).
-ENV GO_VERSION=1.25.9
+ENV GO_VERSION=1.26.9
 RUN rm -rf /usr/local/go /home/gitpod/go /home/gitpod/.cache/go-build \
     && curl -fsSL "https://dl.google.com/go/go${GO_VERSION}.linux-amd64.tar.gz" | tar -C /usr/local -xz \
     && ln -sf /usr/local/go/bin/go /usr/bin/go \
@@ -19,6 +19,9 @@ RUN rm -rf /usr/local/go /home/gitpod/go /home/gitpod/.cache/go-build \
 ENV GOROOT=/usr/local/go
 ENV PATH=/usr/local/go/bin:$PATH
 
+# Install golangci-lint separately from tools inherited from the base image.
+RUN GOBIN=/opt/golangci-lint/bin go install -v github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.15.0
+
 ### cloud_sql_proxy ###
 ARG CLOUD_SQL_PROXY=/usr/local/bin/cloud_sql_proxy
 RUN curl -fsSL https://dl.google.com/cloudsql/cloud_sql_proxy.linux.amd64 > $CLOUD_SQL_PROXY \
@@ -289,10 +292,10 @@ RUN curl -fsSL https://github.com/ericchiang/pup/releases/download/v0.4.0/pup_v0
 RUN curl -fsSL https://github.com/csweichel/oci-tool/releases/download/v0.2.0/oci-tool_0.2.0_linux_amd64.tar.gz | sudo tar xz -C /usr/local/bin \
     && sudo chmod +x /usr/local/bin/oci-tool
 
-# Install golangci-lint
-RUN go install -v github.com/golangci/golangci-lint/cmd/golangci-lint@latest
-
 RUN sudo install-packages pigz
 
 # Install pre-commit hooks under /workspace during prebuilds
 ENV PRE_COMMIT_HOME=/workspace/.pre-commit
+
+# Prefer the pinned linter over any copy inherited from the base image.
+ENV PATH=/opt/golangci-lint/bin:$PATH