diff --git a/build/build-image/cross/VERSION b/build/build-image/cross/VERSION
index 5cc1851a5b5..ed2ba9288a5 100644
--- a/build/build-image/cross/VERSION
+++ b/build/build-image/cross/VERSION
@@ -1 +1 @@
-v1.15.7-2
+v1.15.8-1
diff --git a/build/common.sh b/build/common.sh
index bf831d0ab1c..c893a183374 100755
--- a/build/common.sh
+++ b/build/common.sh
@@ -92,7 +92,7 @@ readonly KUBE_CONTAINER_RSYNC_PORT=8730
 # $1 - server architecture
 kube::build::get_docker_wrapped_binaries() {
   local debian_iptables_version=buster-v1.5.0
-  local go_runner_version=buster-v2.2.4
+  local go_runner_version=buster-v2.3.1
   ### If you change any of these lists, please also update DOCKERIZED_BINARIES
   ### in build/BUILD. And kube::golang::server_image_targets
   local targets=(
diff --git a/build/dependencies.yaml b/build/dependencies.yaml
index 794062a94e1..6779076e81b 100644
--- a/build/dependencies.yaml
+++ b/build/dependencies.yaml
@@ -99,7 +99,7 @@ dependencies:
 
   # Golang
   - name: "golang: upstream version"
-    version: 1.15.7
+    version: 1.15.8
     refPaths:
     - path: build/build-image/cross/VERSION
     - path: build/root/WORKSPACE
@@ -112,7 +112,7 @@ dependencies:
       match: 'default-go-version\: \d+.\d+(alpha|beta|rc)?\.?(\d+)?'
 
   - name: "k8s.gcr.io/kube-cross: dependents"
-    version: v1.15.7-2
+    version: v1.15.8-1
     refPaths:
     - path: build/build-image/cross/VERSION
     - path: test/images/sample-apiserver/Makefile
@@ -146,7 +146,7 @@ dependencies:
       match: configs\[DebianIptables\] = Config{buildImageRegistry, "debian-iptables", "[a-zA-Z]+\-v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)"}
 
   - name: "k8s.gcr.io/go-runner: dependents"
-    version: buster-v2.2.4
+    version: buster-v2.3.1
     refPaths:
     - path: build/common.sh
       match: go_runner_version=
diff --git a/build/root/WORKSPACE b/build/root/WORKSPACE
index 08434886db4..96cbe8556a5 100644
--- a/build/root/WORKSPACE
+++ b/build/root/WORKSPACE
@@ -23,7 +23,7 @@ load("@io_k8s_repo_infra//:repos.bzl", repo_infra_configure = "configure", repo_
 #            'override_go_version': used to specify an alternate go version provided
 #                                   by kubernetes/repo-infra
 repo_infra_configure(
-    go_version = "1.15.7",
+    go_version = "1.15.8",
     minimum_bazel_version = "3.4.1",
 )
 
diff --git a/build/workspace.bzl b/build/workspace.bzl
index 560362565e6..dce3900c59a 100644
--- a/build/workspace.bzl
+++ b/build/workspace.bzl
@@ -103,14 +103,14 @@ _DEBIAN_IPTABLES_DIGEST = {
 #
 # Example
 # Manifest: skopeo inspect docker://gcr.io/k8s-staging-build-image/go-runner:buster-v2.2.4
-# Arches: skopeo inspect --raw docker://gcr.io/k8s-staging-build-image/go-runner:buster-v2.2.4
+# Arches: skopeo inspect --raw docker://gcr.io/k8s-staging-build-image/go-runner:buster-v2.3.1
 _GO_RUNNER_DIGEST = {
-    "manifest": "sha256:059fd64240ad0fcd0f6eee6a791004747f1b4a5d3c44dd5ca68258bda4555e67",
-    "amd64": "sha256:66cdf0be9ba12e3183c43664f9f02b14e2642b19a3d82784d15f56d01e521017",
-    "arm": "sha256:61eefb4de21f946c1d4bc8e941f17a2a77c38f66c8b4a07d6da6d1e8918d47c4",
-    "arm64": "sha256:4b8dcdf86964ae8ceea7eca409ca7b87ad01421c1db0a0a99cc99676785496e3",
-    "ppc64le": "sha256:1e9368e5a81184eb1fd17053b7796f20663724c2046d17ce394b40f5e47affb1",
-    "s390x": "sha256:9ed1b51936ff6057d1534f5d22309d4e7369211d302b3bd72554e9d3963dbae3",
+    "manifest": "sha256:cd45714e4824eeff6f107d9e3b4f79be9ee0cf5071dc46caf755d3f324a36089",
+    "amd64": "sha256:309379049147b749d2bc63cd8bb2d6c46a68f45fd7fc5fd391d221b42e2c7196",
+    "arm": "sha256:81ad4220d42a19e5e11ccb4b385b404ab287d6417f9b51077ea15df5196d6e75",
+    "arm64": "sha256:93ccd74b2a434e21cd150cf89b10c6fc5e0bf66691ee5c8f22bf1241d168c445",
+    "ppc64le": "sha256:4a7f8dce0f4505e43790fb660b67f4cebad91fae1835c79d0132ba6ecf480701",
+    "s390x": "sha256:e6fa60bd53c8f3706c4d1cd6cd6bc3e95d01b4a924daab004fca9bf403b03e41",
 }
 
 def _digest(d, arch):
@@ -127,7 +127,7 @@ def image_dependencies():
             digest = _digest(_GO_RUNNER_DIGEST, arch),
             registry = "k8s.gcr.io/build-image",
             repository = "go-runner",
-            tag = "buster-v2.2.4",  # ignored, but kept here for documentation
+            tag = "buster-v2.3.1",  # ignored, but kept here for documentation
         )
 
         container_pull(
diff --git a/cluster/addons/fluentd-elasticsearch/es-image/Dockerfile b/cluster/addons/fluentd-elasticsearch/es-image/Dockerfile
index 0ca3950c685..0ba4802acc0 100644
--- a/cluster/addons/fluentd-elasticsearch/es-image/Dockerfile
+++ b/cluster/addons/fluentd-elasticsearch/es-image/Dockerfile
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.15.7 AS builder
+FROM golang:1.15.8 AS builder
 COPY elasticsearch_logging_discovery.go go.mod go.sum /
 RUN CGO_ENABLED=0 GOOS=linux GO111MODULE=on go build -a -ldflags "-w" -o /elasticsearch_logging_discovery /elasticsearch_logging_discovery.go
 
diff --git a/staging/publishing/rules.yaml b/staging/publishing/rules.yaml
index d9ec978e5c5..fa0b1ee2d6f 100644
--- a/staging/publishing/rules.yaml
+++ b/staging/publishing/rules.yaml
@@ -4,7 +4,7 @@ recursive-delete-patterns:
 - BUILD.bazel
 - "*/BUILD.bazel"
 - Gopkg.toml
-default-go-version: 1.15.7
+default-go-version: 1.15.8
 rules:
 - destination: code-generator
   branches:
@@ -26,7 +26,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/code-generator
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
   - source:
       branch: release-1.20
       dir: staging/src/k8s.io/code-generator
@@ -53,7 +53,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/apimachinery
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
   - source:
       branch: release-1.20
       dir: staging/src/k8s.io/apimachinery
@@ -89,7 +89,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/api
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
     dependencies:
       - repository: apimachinery
         branch: release-1.19
@@ -137,7 +137,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/client-go
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
     dependencies:
       - repository: apimachinery
         branch: release-1.19
@@ -199,7 +199,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/component-base
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
     dependencies:
     - repository: apimachinery
       branch: release-1.19
@@ -293,7 +293,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/apiserver
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
     dependencies:
     - repository: apimachinery
       branch: release-1.19
@@ -376,7 +376,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/kube-aggregator
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
     dependencies:
     - repository: apimachinery
       branch: release-1.19
@@ -473,7 +473,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/sample-apiserver
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
     dependencies:
     - repository: apimachinery
       branch: release-1.19
@@ -565,7 +565,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/sample-controller
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
     dependencies:
     - repository: apimachinery
       branch: release-1.19
@@ -661,7 +661,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/apiextensions-apiserver
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
     dependencies:
     - repository: apimachinery
       branch: release-1.19
@@ -745,7 +745,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/metrics
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
     dependencies:
     - repository: apimachinery
       branch: release-1.19
@@ -811,7 +811,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/cli-runtime
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
     dependencies:
     - repository: api
       branch: release-1.19
@@ -879,7 +879,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/sample-cli-plugin
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
     dependencies:
     - repository: api
       branch: release-1.19
@@ -951,7 +951,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/kube-proxy
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
     dependencies:
     - repository: apimachinery
       branch: release-1.19
@@ -1015,7 +1015,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/kubelet
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
     dependencies:
     - repository: apimachinery
       branch: release-1.19
@@ -1087,7 +1087,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/kube-scheduler
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
     dependencies:
     - repository: apimachinery
       branch: release-1.19
@@ -1133,7 +1133,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/controller-manager
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
   - source:
       branch: release-1.20
       dir: staging/src/k8s.io/controller-manager
@@ -1198,7 +1198,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/cloud-provider
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
     dependencies:
     - repository: api
       branch: release-1.19
@@ -1280,7 +1280,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/kube-controller-manager
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
     dependencies:
     - repository: apimachinery
       branch: release-1.19
@@ -1346,7 +1346,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/cluster-bootstrap
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
     dependencies:
     - repository: apimachinery
       branch: release-1.19
@@ -1406,7 +1406,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/csi-translation-lib
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
     dependencies:
     - repository: api
       branch: release-1.19
@@ -1496,7 +1496,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/legacy-cloud-providers
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
     dependencies:
     - repository: api
       branch: release-1.19
@@ -1573,7 +1573,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/cri-api
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
   - source:
       branch: release-1.20
       dir: staging/src/k8s.io/cri-api
@@ -1647,7 +1647,7 @@ rules:
       branch: release-1.19
       dir: staging/src/k8s.io/kubectl
     name: release-1.19
-    go: 1.15.7
+    go: 1.15.8
     dependencies:
     - repository: api
       branch: release-1.19
diff --git a/test/images/Makefile b/test/images/Makefile
index 8d6579e1a2a..460c51da2b5 100644
--- a/test/images/Makefile
+++ b/test/images/Makefile
@@ -16,7 +16,7 @@ REGISTRY ?= gcr.io/kubernetes-e2e-test-images
 GOARM ?= 7
 DOCKER_CERT_BASE_PATH ?=
 QEMUVERSION=v5.1.0-2
-GOLANG_VERSION=1.15.7
+GOLANG_VERSION=1.15.8
 export
 
 ifndef WHAT
diff --git a/test/images/sample-apiserver/Makefile b/test/images/sample-apiserver/Makefile
index 2fde7e4b2fb..eca56d22f62 100644
--- a/test/images/sample-apiserver/Makefile
+++ b/test/images/sample-apiserver/Makefile
@@ -24,7 +24,7 @@ export
 # Get without building to populate module cache
 # Then, get with OS/ARCH-specific env to build
 bin:
-	docker run --rm -i -v "${TARGET}:${TARGET}:Z" k8s.gcr.io/build-image/kube-cross:v1.15.7-2 \
+	docker run --rm -i -v "${TARGET}:${TARGET}:Z" k8s.gcr.io/build-image/kube-cross:v1.15.8-1 \
 		/bin/bash -c "\
 			mkdir -p /go/src /go/bin && \
 			GO111MODULE=on go get -d k8s.io/sample-apiserver@v0.17.0 && \