diff --git a/.github/workflows/gh-test-external-registry.yml b/.github/workflows/gh-test-external-registry.yml
index 8b51d099..f69b125d 100644
--- a/.github/workflows/gh-test-external-registry.yml
+++ b/.github/workflows/gh-test-external-registry.yml
@@ -26,7 +26,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v3
       with:
-        go-version: '1.21.1'
+        go-version: '1.21.3'
     - name: Check out code into the Go module directory
       uses: actions/checkout@v2
       with:
@@ -63,7 +63,7 @@ jobs:
       - name: Set up Go 1.x
         uses: actions/setup-go@v3
         with:
-          go-version: '1.21.1'
+          go-version: '1.21.3'
       - name: Check out code into the Go module directory
         uses: actions/checkout@v2
         with:
diff --git a/.github/workflows/gh-test.yml b/.github/workflows/gh-test.yml
index f0cc61ac..2d199b7d 100644
--- a/.github/workflows/gh-test.yml
+++ b/.github/workflows/gh-test.yml
@@ -14,7 +14,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v3
       with:
-        go-version: "1.21.1"
+        go-version: "1.21.3"
     - name: Check out code into the Go module directory
       uses: actions/checkout@v2
       with:
@@ -37,7 +37,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v3
       with:
-        go-version: "1.21.1"
+        go-version: "1.21.3"
     - name: Check out code into the Go module directory
       uses: actions/checkout@v2
       with:
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index fe88e6c5..c9f1756a 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -15,7 +15,7 @@ jobs:
       - name: Set up Go 1.x
         uses: actions/setup-go@v3
         with:
-          go-version: "1.21.1"
+          go-version: "1.21.3"
       - uses: actions/checkout@v2
         with:
           fetch-depth: '0'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c80bc2b2..3107374d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,7 +18,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version: 1.21.1
+          go-version: 1.21.3
 
       - name: Retrieve version
         run: |
diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml
index 3755b71f..f324c4d1 100644
--- a/.github/workflows/trivy-scan.yml
+++ b/.github/workflows/trivy-scan.yml
@@ -10,7 +10,7 @@ jobs:
     with:
       repo: carvel-dev/imgpkg
       tool: imgpkg
-      goVersion: 1.21.1
+      goVersion: 1.21.3
     secrets:
       githubToken: ${{ secrets.GITHUB_TOKEN }}
       slackWebhookURL: ${{ secrets.SLACK_WEBHOOK_URL }}
diff --git a/pkg/imgpkg/bundle/bundlefakes/fake_images_lock_reader.go b/pkg/imgpkg/bundle/bundlefakes/fake_images_lock_reader.go
index 8e15d9a2..97883b62 100644
--- a/pkg/imgpkg/bundle/bundlefakes/fake_images_lock_reader.go
+++ b/pkg/imgpkg/bundle/bundlefakes/fake_images_lock_reader.go
@@ -4,9 +4,9 @@ package bundlefakes
 import (
 	"sync"
 
-	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"carvel.dev/imgpkg/pkg/imgpkg/bundle"
 	"carvel.dev/imgpkg/pkg/imgpkg/lockconfig"
+	v1 "github.com/google/go-containerregistry/pkg/v1"
 )
 
 type FakeImagesLockReader struct {
diff --git a/pkg/imgpkg/bundle/bundlefakes/fake_images_metadata_writer.go b/pkg/imgpkg/bundle/bundlefakes/fake_images_metadata_writer.go
index b9cc2e5c..b9b85916 100644
--- a/pkg/imgpkg/bundle/bundlefakes/fake_images_metadata_writer.go
+++ b/pkg/imgpkg/bundle/bundlefakes/fake_images_metadata_writer.go
@@ -4,12 +4,12 @@ package bundlefakes
 import (
 	"sync"
 
-	"github.com/google/go-containerregistry/pkg/name"
-	v1 "github.com/google/go-containerregistry/pkg/v1"
-	"github.com/google/go-containerregistry/pkg/v1/remote"
 	"carvel.dev/imgpkg/pkg/imgpkg/bundle"
 	"carvel.dev/imgpkg/pkg/imgpkg/internal/util"
 	"carvel.dev/imgpkg/pkg/imgpkg/registry"
+	"github.com/google/go-containerregistry/pkg/name"
+	v1 "github.com/google/go-containerregistry/pkg/v1"
+	"github.com/google/go-containerregistry/pkg/v1/remote"
 )
 
 type FakeImagesMetadataWriter struct {
diff --git a/pkg/imgpkg/registry/registryfakes/fake_images_reader.go b/pkg/imgpkg/registry/registryfakes/fake_images_reader.go
index 1af18b79..6f735d34 100644
--- a/pkg/imgpkg/registry/registryfakes/fake_images_reader.go
+++ b/pkg/imgpkg/registry/registryfakes/fake_images_reader.go
@@ -4,10 +4,10 @@ package registryfakes
 import (
 	"sync"
 
+	"carvel.dev/imgpkg/pkg/imgpkg/registry"
 	"github.com/google/go-containerregistry/pkg/name"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
-	"carvel.dev/imgpkg/pkg/imgpkg/registry"
 )
 
 type FakeImagesReader struct {
diff --git a/pkg/imgpkg/registry/registryfakes/fake_images_reader_writer.go b/pkg/imgpkg/registry/registryfakes/fake_images_reader_writer.go
index 5bf5d098..67e599cb 100644
--- a/pkg/imgpkg/registry/registryfakes/fake_images_reader_writer.go
+++ b/pkg/imgpkg/registry/registryfakes/fake_images_reader_writer.go
@@ -4,11 +4,11 @@ package registryfakes
 import (
 	"sync"
 
+	"carvel.dev/imgpkg/pkg/imgpkg/internal/util"
+	"carvel.dev/imgpkg/pkg/imgpkg/registry"
 	"github.com/google/go-containerregistry/pkg/name"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
-	"carvel.dev/imgpkg/pkg/imgpkg/internal/util"
-	"carvel.dev/imgpkg/pkg/imgpkg/registry"
 )
 
 type FakeImagesReaderWriter struct {
diff --git a/pkg/imgpkg/signature/signaturefakes/fake_finder.go b/pkg/imgpkg/signature/signaturefakes/fake_finder.go
index 4c13ccfb..9452e660 100644
--- a/pkg/imgpkg/signature/signaturefakes/fake_finder.go
+++ b/pkg/imgpkg/signature/signaturefakes/fake_finder.go
@@ -4,9 +4,9 @@ package signaturefakes
 import (
 	"sync"
 
-	"github.com/google/go-containerregistry/pkg/name"
 	"carvel.dev/imgpkg/pkg/imgpkg/imageset"
 	"carvel.dev/imgpkg/pkg/imgpkg/signature"
+	"github.com/google/go-containerregistry/pkg/name"
 )
 
 type FakeFinder struct {