diff --git a/Makefile b/Makefile
index 360cb40362..c726b07305 100644
--- a/Makefile
+++ b/Makefile
@@ -38,7 +38,7 @@ GO_DIR := $(OUTPUT_DIR)/go
 
 # Base image used for all golang containers
 # Uses trusted google-built golang image
-GOLANG_IMAGE_VERSION := 1.26.4
+GOLANG_IMAGE_VERSION := 1.26.10
 GOLANG_IMAGE := google-go.pkg.dev/golang:$(GOLANG_IMAGE_VERSION)
 # Base image used for debian containers
 # When updating you can use this command:
diff --git a/scripts/update-component-image.sh b/scripts/update-component-image.sh
index f57a36ac3b..2dc2ebc485 100755
--- a/scripts/update-component-image.sh
+++ b/scripts/update-component-image.sh
@@ -97,6 +97,8 @@ elif [[ "${UPDATE_TYPE}" == "latest-build" ]]; then
   if [[ "${COMPONENT}" == "debian-base" ]]; then
     BASE_VERSION=$(echo "${CURRENT_TAG}" | sed -E "s/${STRIP_BASE_PATTERN}//")
   else
+    # STRIP_BASE_PATTERN is a glob (e.g. "-gke.*"), so it must stay unquoted.
+    # shellcheck disable=SC2295
     BASE_VERSION=${CURRENT_TAG%${STRIP_BASE_PATTERN}}
   fi
   FILTER="tags:${BASE_VERSION}*"