diff --git a/.cirrus.yml b/.cirrus.yml
index e63ef51cf..65c70cd9a 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -77,7 +77,7 @@ task:
   env:
     HOME: /root
     CIRRUS_WORKING_DIR: /home/runc
-    GO_VERSION: "1.23"
+    GO_VER_PREFIX: "1.24."
     BATS_VERSION: "v1.9.0"
     RPMS: gcc git iptables jq glibc-static libseccomp-devel make criu fuse-sshfs container-selinux
     # yamllint disable rule:key-duplicates
@@ -117,10 +117,10 @@ task:
     [ $? -eq 0 ] # fail if yum failed
 
     # Install Go.
-    PREFIX="https://go.dev/dl/"
+    URL_PREFIX="https://go.dev/dl/"
     # Find out the latest minor release URL.
-    filename=$(curl -fsSL "${PREFIX}?mode=json&include=all" | jq -r --arg Ver "go$GO_VERSION." '. | map(select(.version | contains($Ver))) | first | .files[] | select(.os == "linux" and .arch == "amd64" and .kind == "archive") | .filename')
-    curl -fsSL "$PREFIX$filename" | tar Cxz /usr/local
+    filename=$(curl -fsSL "${URL_PREFIX}?mode=json&include=all" | jq -r --arg Ver "go$GO_VER_PREFIX" '. | map(select(.version | contains($Ver))) | first | .files[] | select(.os == "linux" and .arch == "amd64" and .kind == "archive") | .filename')
+    curl -fsSL "$URL_PREFIX$filename" | tar Cxz /usr/local
     # install bats
     cd /tmp
     git clone https://github.com/bats-core/bats-core
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 7f4c5b0fc..620c77f2f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -24,7 +24,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-20.04, ubuntu-24.04, actuated-arm64-6cpu-8gb]
-        go-version: [1.22.x, 1.23.x]
+        go-version: [1.23.x, 1.24.x]
         rootless: ["rootless", ""]
         race: ["-race", ""]
         criu: ["", "criu-dev"]
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index dad27d5b5..a5c8fbad6 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -8,7 +8,7 @@ on:
       - release-*
   pull_request:
 env:
-  GO_VERSION: 1.23.x
+  GO_VERSION: 1.24
 permissions:
   contents: read
 
@@ -40,7 +40,7 @@ jobs:
           sudo apt -qy install libseccomp-dev
       - uses: golangci/golangci-lint-action@v6
         with:
-          version: v1.62
+          version: v1.64
       # Extra linters, only checking new code from a pull request.
       - name: lint-extra
         if: github.event_name == 'pull_request'
diff --git a/go.mod b/go.mod
index 28ee71313..f42a08e55 100644
--- a/go.mod
+++ b/go.mod
@@ -1,11 +1,6 @@
 module github.com/opencontainers/runc
 
-go 1.22
-
-// Suggest toolchain 1.22.4 due to a fix in golang for libcontainer/nsenter/.
-// For more info, see: #4233
-// Note that toolchain does not impose a requirement on other modules using runc.
-toolchain go1.22.4
+go 1.23.0
 
 require (
 	github.com/checkpoint-restore/go-criu/v6 v6.3.0
diff --git a/libcontainer/system/rlimit_linux_go122.go b/libcontainer/system/rlimit_linux_go122.go
deleted file mode 100644
index 865d18022..000000000
--- a/libcontainer/system/rlimit_linux_go122.go
+++ /dev/null
@@ -1,27 +0,0 @@
-//go:build !go1.23
-
-// TODO: remove this file once go 1.22 is no longer supported.
-
-package system
-
-import (
-	"sync/atomic"
-	"syscall"
-	_ "unsafe" // Needed for go:linkname to work.
-)
-
-//go:linkname syscallOrigRlimitNofile syscall.origRlimitNofile
-var syscallOrigRlimitNofile atomic.Pointer[syscall.Rlimit]
-
-// ClearRlimitNofileCache clears go runtime's nofile rlimit cache.
-// The argument is process RLIMIT_NOFILE values.
-func ClearRlimitNofileCache(_ *syscall.Rlimit) {
-	// As reported in issue #4195, the new version of go runtime(since 1.19)
-	// will cache rlimit-nofile. Before executing execve, the rlimit-nofile
-	// of the process will be restored with the cache. In runc, this will
-	// cause the rlimit-nofile setting by the parent process for the container
-	// to become invalid. It can be solved by clearing this cache. But
-	// unfortunately, go stdlib doesn't provide such function, so we need to
-	// link to the private var `origRlimitNofile` in package syscall to hack.
-	syscallOrigRlimitNofile.Store(nil)
-}