diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index bede5814..d967624c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -26,8 +26,8 @@ jobs:
       fail-fast: false
       matrix:
         go:
-          - 1.18
-          - 1.19.10
+          - 1.20.7
+          - 1.21.0
     steps:
       -
         name: Checkout
diff --git a/Dockerfile b/Dockerfile
index 13c2ec29..2ec7b5ec 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.19.10
+ARG GO_VERSION=1.20.7
 ARG ALPINE_VERSION=3.18
 ARG XX_VERSION=1.2.1
 
diff --git a/dockerfiles/git.Dockerfile b/dockerfiles/git.Dockerfile
index 47cab54e..09d9116b 100644
--- a/dockerfiles/git.Dockerfile
+++ b/dockerfiles/git.Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.19.10
+ARG GO_VERSION=1.20.7
 ARG ALPINE_VERSION=3.18
 
 FROM alpine:${ALPINE_VERSION} AS base
diff --git a/dockerfiles/lint.Dockerfile b/dockerfiles/lint.Dockerfile
index f69ad37f..54656e69 100644
--- a/dockerfiles/lint.Dockerfile
+++ b/dockerfiles/lint.Dockerfile
@@ -1,8 +1,8 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.19.10
+ARG GO_VERSION=1.20.7
 ARG ALPINE_VERSION=3.18
-ARG GOLANGCI_LINT_VERSION=v1.52
+ARG GOLANGCI_LINT_VERSION=v1.54.2
 ARG BUILDTAGS="include_gcs"
 
 FROM golangci/golangci-lint:${GOLANGCI_LINT_VERSION}-alpine AS golangci-lint
diff --git a/dockerfiles/vendor.Dockerfile b/dockerfiles/vendor.Dockerfile
index 3377e897..aff25160 100644
--- a/dockerfiles/vendor.Dockerfile
+++ b/dockerfiles/vendor.Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.19.10
+ARG GO_VERSION=1.20.7
 ARG ALPINE_VERSION=3.18
 ARG MODOUTDATED_VERSION=v0.8.0
 
diff --git a/go.mod b/go.mod
index c61f2a9e..45092e6a 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/distribution/distribution/v3
 
-go 1.18
+go 1.20
 
 require (
 	cloud.google.com/go/storage v1.30.1
diff --git a/registry/api/v2/routes_test.go b/registry/api/v2/routes_test.go
index bdd0ef48..b2a0c830 100644
--- a/registry/api/v2/routes_test.go
+++ b/registry/api/v2/routes_test.go
@@ -9,7 +9,6 @@ import (
 	"reflect"
 	"strings"
 	"testing"
-	"time"
 
 	"github.com/gorilla/mux"
 )
@@ -221,7 +220,6 @@ func TestRouterWithBadCharacters(t *testing.T) {
 		// with random UTF8 characters not in the 128 bit ASCII range.
 		// These are not valid characters for the router and we expect
 		// 404s on every test.
-		rand.Seed(time.Now().UTC().UnixNano())
 		tests := make([]routeTestCase, 1000)
 		for idx := range tests {
 			tests[idx] = routeTestCase{
diff --git a/registry/proxy/proxyblobstore_test.go b/registry/proxy/proxyblobstore_test.go
index 1531ba38..d90d2384 100644
--- a/registry/proxy/proxyblobstore_test.go
+++ b/registry/proxy/proxyblobstore_test.go
@@ -21,6 +21,7 @@ import (
 )
 
 var sbsMu sync.Mutex
+var randSource rand.Rand
 
 type statsBlobStore struct {
 	stats map[string]int
@@ -189,13 +190,13 @@ func makeTestEnv(t *testing.T, name string) *testEnv {
 func makeBlob(size int) []byte {
 	blob := make([]byte, size)
 	for i := 0; i < size; i++ {
-		blob[i] = byte('A' + rand.Int()%48)
+		blob[i] = byte('A' + randSource.Int()%48)
 	}
 	return blob
 }
 
 func init() {
-	rand.Seed(42)
+	randSource = *rand.New(rand.NewSource(42))
 }
 
 func populate(t *testing.T, te *testEnv, blobCount, size, numUnique int) {
diff --git a/registry/storage/driver/s3-aws/s3_test.go b/registry/storage/driver/s3-aws/s3_test.go
index 0330eafc..060ed2d8 100644
--- a/registry/storage/driver/s3-aws/s3_test.go
+++ b/registry/storage/driver/s3-aws/s3_test.go
@@ -2,9 +2,9 @@ package s3
 
 import (
 	"bytes"
+	"crypto/rand"
 	"errors"
 	"fmt"
-	"math/rand"
 	"os"
 	"path"
 	"reflect"
diff --git a/registry/storage/driver/testsuites/testsuites.go b/registry/storage/driver/testsuites/testsuites.go
index 8e54be32..2ee46f5d 100644
--- a/registry/storage/driver/testsuites/testsuites.go
+++ b/registry/storage/driver/testsuites/testsuites.go
@@ -3,6 +3,7 @@ package testsuites
 import (
 	"bytes"
 	"context"
+	crand "crypto/rand"
 	"crypto/sha256"
 	"io"
 	"math/rand"
@@ -1232,7 +1233,7 @@ func randomFilename(length int64) string {
 var randomBytes = make([]byte, 128<<20)
 
 func init() {
-	_, _ = rand.Read(randomBytes) // always returns len(randomBytes) and nil error
+	_, _ = crand.Read(randomBytes) // always returns len(randomBytes) and nil error
 }
 
 func randomContents(length int64) []byte {
diff --git a/registry/storage/filereader_test.go b/registry/storage/filereader_test.go
index 51c88c36..3f05582e 100644
--- a/registry/storage/filereader_test.go
+++ b/registry/storage/filereader_test.go
@@ -2,6 +2,7 @@ package storage
 
 import (
 	"bytes"
+	crand "crypto/rand"
 	"io"
 	mrand "math/rand"
 	"testing"
@@ -14,7 +15,7 @@ import (
 func TestSimpleRead(t *testing.T) {
 	ctx := context.Background()
 	content := make([]byte, 1<<20)
-	n, err := mrand.Read(content)
+	n, err := crand.Read(content)
 	if err != nil {
 		t.Fatalf("unexpected error building random data: %v", err)
 	}
diff --git a/testutil/tarfile.go b/testutil/tarfile.go
index e0782b73..2b30a24d 100644
--- a/testutil/tarfile.go
+++ b/testutil/tarfile.go
@@ -3,6 +3,7 @@ package testutil
 import (
 	"archive/tar"
 	"bytes"
+	crand "crypto/rand"
 	"fmt"
 	"io"
 	mrand "math/rand"
@@ -45,7 +46,7 @@ func CreateRandomTarFile() (rs io.ReadSeeker, dgst digest.Digest, err error) {
 		randomData := make([]byte, fileSize)
 
 		// Fill up the buffer with some random data.
-		n, err := mrand.Read(randomData)
+		n, err := crand.Read(randomData)
 
 		if n != len(randomData) {
 			return nil, "", fmt.Errorf("short read creating random reader: %v bytes != %v bytes", n, len(randomData))