diff --git a/go.mod b/go.mod
index bcdc7e19d..12ffd3ebd 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module tailscale.com
 
-go 1.25.6
+go 1.25.7
 
 require (
 	filippo.io/mkcert v1.4.4
diff --git a/go.toolchain.next.rev b/go.toolchain.next.rev
index be0f53a9c..abdc21022 100644
--- a/go.toolchain.next.rev
+++ b/go.toolchain.next.rev
@@ -1 +1 @@
-64a6cb4cba579e2865654747d4d672ead07b8375
+5ba287c89a4cef2f4a419aed4e6bc3121c5c4dad
diff --git a/go.toolchain.rev b/go.toolchain.rev
index cb3fa6462..05e37f312 100644
--- a/go.toolchain.rev
+++ b/go.toolchain.rev
@@ -1 +1 @@
-779d878b6a943cecd2f359699001a03d7cedf222
+692441891e061f8ae2cb2f8f2c898f86bb1c5dca
diff --git a/go.toolchain.rev.sri b/go.toolchain.rev.sri
index 3b8ce70f3..b7a7163f7 100644
--- a/go.toolchain.rev.sri
+++ b/go.toolchain.rev.sri
@@ -1 +1 @@
-sha256-e081DbI45vGMmi3drwqz2UOxRwffEuEDSVZupDtOVuk=
+sha256-gWKrpBTXfsQmgOWoMrbvCaWGsBXCt5X12BAcwfAPMQY=
diff --git a/go.toolchain.version b/go.toolchain.version
index 198ec23cc..f1968aa88 100644
--- a/go.toolchain.version
+++ b/go.toolchain.version
@@ -1 +1 @@
-1.25.6
+1.25.7
diff --git a/pull-toolchain.sh b/pull-toolchain.sh
index b10e3cd68..c80c913bb 100755
--- a/pull-toolchain.sh
+++ b/pull-toolchain.sh
@@ -25,6 +25,7 @@ fi
 # don't yet support TS_GO_NEXT=1 with flake.nix or in our corp CI.
 if [ "${TS_GO_NEXT:-}" != "1" ]; then
     ./tool/go version 2>/dev/null | awk '{print $3}' | sed 's/^go//' > go.toolchain.version
+    ./tool/go mod edit -go "$(cat go.toolchain.version)"
     ./update-flake.sh
 fi