diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index dbff77ac..326472a9 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -114,14 +114,13 @@ test:smoketests:mac:
 
 test:smoketests:linux:
   stage: test
-  # Keep golang version aligned with latest yocto release
-  image: golang:1.17-buster
+  image: debian:bullseye-slim
   needs:
     - job: build:make
       artifacts: true
   before_script:
-    - apt-get update && apt-get install -q -y make liblzma-dev libssl-dev jq
-    # yq no longer has a maintained debian repo & requires golang 19, so we fall back on the GitHub release as the source
+    - apt-get update && apt-get install -q -y make liblzma-dev libssl-dev jq wget
+    # yq no longer has a maintained debian repo so we fall back on the GitHub release as the source
     - wget -q https://github.com/mikefarah/yq/releases/download/v4.44.2/yq_linux_amd64 -O /usr/bin/yq && chmod +x /usr/bin/yq
     - ./tests/test_sign_with_hsm/test_sign_with_hsm.sh --setup
     - export TEST_MENDER_ARTIFACT_PATH=./mender-artifact-linux
@@ -140,11 +139,10 @@ test:smoketests:linux:
     - ./tests/test_compressions/test_supported_compressions.sh
     # QA-507: lock mender-artifact to OpenSSL 1.1
     - ldd ./mender-artifact-linux | grep libssl.so.1.1
-    - make build
 
 test:coverage:linux:
   stage: test
-  image: debian:buster-slim
+  image: debian:bullseye-slim
   needs:
     - job: build:coverage
       artifacts: true
@@ -170,8 +168,7 @@ test:coverage:linux:
 
 .test:unit:
   stage: test
-  # Keep golang version aligned with latest yocto release
-  image: golang:1.17-alpine3.16
+  image: golang:1.23-bullseye
   needs: []
   script:
     - make coverage
@@ -187,7 +184,8 @@ test:unit:linux:
   variables:
     COVERAGE_FILE: coverage-linux.txt
   before_script:
-    - apk update && apk add git make bash dosfstools e2fsprogs e2fsprogs-extra gcc libc6-compat mtools musl-dev parted perl-utils xz-dev libressl-dev openssl-dev
+    - apt-get update && apt-get install --quiet --assume-yes
+      git make bash dosfstools e2fsprogs gcc mtools musl-dev parted xz-utils libssl-dev
 
 test:unit:mac:
   extends: .test:unit
@@ -199,9 +197,18 @@ test:unit:mac:
   tags:
     - mac-runner
 
+# Test that we can build with the golang version of the oldest supported yocto LTS release
+test:backwards-compatibility:
+  image: golang:1.17.13-bullseye
+  needs: []
+  before_script:
+    - apt-get update && apt-get install --quiet --assume-yes libssl-dev
+  script:
+    - go build
+
 publish:tests:
   stage: publish
-  image: golang:1.20
+  image: golang:1.23
   needs:
     - job: test:unit:linux
       artifacts: true
@@ -242,7 +249,7 @@ publish:tests:
 
 publish:s3:
   stage: publish
-  image: debian:buster-slim
+  image: debian:bookworm-slim
   needs:
     - job: build:make
       artifacts: true
diff --git a/Dockerfile b/Dockerfile
index 6e27bc65..54611f3f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
-# Keep golang version aligned with latest yocto release
-FROM golang:1.17.13-bullseye as builder
+# Keep using Debian Bullseye OS for OpenSSL 1.1 compatibility. See QA-507
+FROM golang:1.23.1-bullseye as builder
 RUN mkdir -p /go/src/github.com/mendersoftware/mender-artifact
 WORKDIR /go/src/github.com/mendersoftware/mender-artifact
 ADD ./ .
diff --git a/Dockerfile.binaries b/Dockerfile.binaries
index 4072a994..f7d13f82 100644
--- a/Dockerfile.binaries
+++ b/Dockerfile.binaries
@@ -1,5 +1,5 @@
-# Keep golang version aligned with latest yocto release
-FROM golang:1.17.13-bullseye as builder
+# Keep using Debian Bullseye OS for OpenSSL 1.1 compatibility. See QA-507
+FROM golang:1.23.1-bullseye as builder
 RUN apt-get update && \
     apt-get install -y \
     gcc gcc-mingw-w64 gcc-multilib \