diff --git a/.forgejo/workflows/build-release.yml b/.forgejo/workflows/build-release.yml
index c012991b3a..ef5c68d191 100644
--- a/.forgejo/workflows/build-release.yml
+++ b/.forgejo/workflows/build-release.yml
@@ -43,8 +43,7 @@ jobs:
 
       - uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.21"
-          check-latest: true
+          go-version: "1.21.8"
 
       - name: version from ref
         id: release-info
diff --git a/.forgejo/workflows/cascade-setup-end-to-end.yml b/.forgejo/workflows/cascade-setup-end-to-end.yml
index 85871ec31d..b8269e1d35 100644
--- a/.forgejo/workflows/cascade-setup-end-to-end.yml
+++ b/.forgejo/workflows/cascade-setup-end-to-end.yml
@@ -67,7 +67,7 @@ jobs:
           chown -R forgejo:forgejo .
       - uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.21"
+          go-version: "1.21.8"
       - name: make deps-backend
         run: |
           su forgejo -c 'make deps-backend'
diff --git a/.forgejo/workflows/e2e.yml b/.forgejo/workflows/e2e.yml
index 2104f6a067..7ace817bc1 100644
--- a/.forgejo/workflows/e2e.yml
+++ b/.forgejo/workflows/e2e.yml
@@ -17,8 +17,7 @@ jobs:
       - uses: https://code.forgejo.org/actions/checkout@v4
       - uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "~1.21"
-          check-latest: true
+          go-version: "1.21.8"
       - run: |
           apt-get -qq update
           apt-get -qq install -q sudo
diff --git a/.forgejo/workflows/publish-release.yml b/.forgejo/workflows/publish-release.yml
index eaa14c3693..68fb68eb75 100644
--- a/.forgejo/workflows/publish-release.yml
+++ b/.forgejo/workflows/publish-release.yml
@@ -64,7 +64,7 @@ jobs:
         if: vars.ROLE == 'forgejo-experimental' && secrets.OVH_APP_KEY != ''
         uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.21"
+          go-version: "1.21.8"
           check-latest: true
       - name: update the _release.experimental DNS record
         if: vars.ROLE == 'forgejo-experimental' && secrets.OVH_APP_KEY != ''
diff --git a/.forgejo/workflows/testing.yml b/.forgejo/workflows/testing.yml
index 80fd87152e..1bc23e16b0 100644
--- a/.forgejo/workflows/testing.yml
+++ b/.forgejo/workflows/testing.yml
@@ -17,7 +17,7 @@ jobs:
       - uses: https://code.forgejo.org/actions/checkout@v3
       - uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.21"
+          go-version: "1.21.8"
           check-latest: true
       - run: make deps-backend deps-tools
       - run: make --always-make -j$(nproc) lint-backend checks-backend # ensure the "go-licenses" make target runs
@@ -51,7 +51,7 @@ jobs:
       - uses: https://code.forgejo.org/actions/checkout@v3
       - uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.21"
+          go-version: "1.21.8"
       - run: |
           git config --add safe.directory '*'
           adduser --quiet --comment forgejo --disabled-password forgejo
@@ -96,7 +96,7 @@ jobs:
       - uses: https://code.forgejo.org/actions/checkout@v3
       - uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.21"
+          go-version: "1.21.8"
       - name: install dependencies & git >= 2.42
         run: |
           export DEBIAN_FRONTEND=noninteractive
@@ -143,7 +143,7 @@ jobs:
       - uses: https://code.forgejo.org/actions/checkout@v3
       - uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.21"
+          go-version: "1.21.8"
       - name: install dependencies & git >= 2.42
         run: |
           export DEBIAN_FRONTEND=noninteractive
@@ -180,7 +180,7 @@ jobs:
       - uses: https://code.forgejo.org/actions/checkout@v3
       - uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.21"
+          go-version: "1.21.8"
       - name: install dependencies & git >= 2.42
         run: |
           export DEBIAN_FRONTEND=noninteractive
diff --git a/go.mod b/go.mod
index 0924b9fdc0..788bb9f392 100644
--- a/go.mod
+++ b/go.mod
@@ -109,7 +109,7 @@ require (
 	golang.org/x/text v0.14.0
 	golang.org/x/tools v0.17.0
 	google.golang.org/grpc v1.60.1
-	google.golang.org/protobuf v1.32.0
+	google.golang.org/protobuf v1.33.0
 	gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df
 	gopkg.in/ini.v1 v1.67.0
 	gopkg.in/yaml.v3 v3.0.1
diff --git a/go.sum b/go.sum
index f8bf0567de..18e0aadd87 100644
--- a/go.sum
+++ b/go.sum
@@ -1239,8 +1239,8 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.32.0 h1:pPC6BG5ex8PDFnkbrGU3EixyhKcQ2aDuBS36lqK/C7I=
-google.golang.org/protobuf v1.32.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
+google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc h1:2gGKlE2+asNV9m7xrywl36YYNnBG5ZQ0r/BOOxqPpmk=
 gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc/go.mod h1:m7x9LTH6d71AHyAX77c9yqWCCa3UKHcVEj9y7hAtKDk=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=