diff --git a/.github/actions/setup-go/action.yaml b/.github/actions/setup-go/action.yaml
index d17948074d..125d0a6ac6 100644
--- a/.github/actions/setup-go/action.yaml
+++ b/.github/actions/setup-go/action.yaml
@@ -4,7 +4,7 @@ description: |
 inputs:
   version:
     description: "The Go version to use."
-    default: "1.25.6"
+    default: "1.25.7"
   use-preinstalled-go:
     description: "Whether to use preinstalled Go."
     default: "false"
diff --git a/dogfood/coder/Dockerfile b/dogfood/coder/Dockerfile
index 7f5967aa33..a2c8101c42 100644
--- a/dogfood/coder/Dockerfile
+++ b/dogfood/coder/Dockerfile
@@ -11,8 +11,8 @@ RUN cargo install jj-cli typos-cli watchexec-cli
 FROM ubuntu:jammy@sha256:c7eb020043d8fc2ae0793fb35a37bff1cf33f156d4d4b12ccc7f3ef8706c38b1 AS go
 
 # Install Go manually, so that we can control the version
-ARG GO_VERSION=1.25.6
-ARG GO_CHECKSUM="f022b6aad78e362bcba9b0b94d09ad58c5a70c6ba3b7582905fababf5fe0181a"
+ARG GO_VERSION=1.25.7
+ARG GO_CHECKSUM="12e6d6a191091ae27dc31f6efc630e3a3b8ba409baf3573d955b196fdf086005"
 
 # Boring Go is needed to build FIPS-compliant binaries.
 RUN apt-get update && \
diff --git a/flake.nix b/flake.nix
index 38eb53b68f..23405fc911 100644
--- a/flake.nix
+++ b/flake.nix
@@ -94,7 +94,7 @@
         # 3. Update the sha256 and run again
         # 4. Nix will fail with the correct vendorHash
         # 5. Update the vendorHash
-        sqlc-custom = unstablePkgs.buildGo124Module {
+        sqlc-custom = unstablePkgs.buildGo125Module {
           pname = "sqlc";
           version = "coder-fork-aab4e865a51df0c43e1839f81a9d349b41d14f05";
 
@@ -156,7 +156,7 @@
             gnused
             gnugrep
             gnutar
-            unstablePkgs.go_1_24
+            unstablePkgs.go_1_25
             gofumpt
             go-migrate
             (pinnedPkgs.golangci-lint)
@@ -224,7 +224,7 @@
         # slim bundle into it's own derivation.
         buildFat =
           osArch:
-          unstablePkgs.buildGo124Module {
+          unstablePkgs.buildGo125Module {
             name = "coder-${osArch}";
             # Updated with ./scripts/update-flake.sh`.
             # This should be updated whenever go.mod changes!
diff --git a/go.mod b/go.mod
index 58bdef588c..68857bfb23 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/coder/coder/v2
 
-go 1.25.6
+go 1.25.7
 
 // Required until a v3 of chroma is created to lazily initialize all XML files.
 // None of our dependencies seem to use the registries anyways, so this
diff --git a/testutil/unixsocket.go b/testutil/unixsocket.go
index 3b09d5d653..008c13ec94 100644
--- a/testutil/unixsocket.go
+++ b/testutil/unixsocket.go
@@ -16,19 +16,24 @@ import (
 // During tests on darwin we hit the max path length limit for unix sockets
 // pretty easily in the default location, so this function uses /tmp instead to
 // get shorter paths.
+//
+// On Linux, we also hit this limit on GitHub Actions runners where TMPDIR is
+// set to a long path like /home/runner/work/_temp/go-tmp/.
 func TempDirUnixSocket(t *testing.T) string {
 	t.Helper()
-	if runtime.GOOS == "darwin" {
-		testName := strings.ReplaceAll(t.Name(), "/", "_")
-		dir, err := os.MkdirTemp("/tmp", testName)
-		require.NoError(t, err, "create temp dir for gpg test")
-
-		t.Cleanup(func() {
-			err := os.RemoveAll(dir)
-			assert.NoError(t, err, "remove temp dir", dir)
-		})
-		return dir
+	// Windows doesn't have the same unix socket path length limits,
+	// and callers of this function are generally gated to !windows.
+	if runtime.GOOS == "windows" {
+		return t.TempDir()
 	}
 
-	return t.TempDir()
+	testName := strings.ReplaceAll(t.Name(), "/", "_")
+	dir, err := os.MkdirTemp("/tmp", testName)
+	require.NoError(t, err, "create temp dir for unix socket test")
+
+	t.Cleanup(func() {
+		err := os.RemoveAll(dir)
+		assert.NoError(t, err, "remove temp dir", dir)
+	})
+	return dir
 }