diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 45fbc410a46f..4da1b1591478 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,7 +26,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@v2
         with:
-          go-version: '1.16.12'
+          go-version: '1.16.14'
 
       - name: Set env
         shell: bash
@@ -82,7 +82,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v2
         with:
-          go-version: '1.16.12'
+          go-version: '1.16.14'
 
       - name: Set env
         shell: bash
@@ -128,7 +128,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v2
         with:
-          go-version: '1.16.12'
+          go-version: '1.16.14'
 
       - name: Set env
         shell: bash
@@ -166,7 +166,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v2
         with:
-          go-version: '1.16.12'
+          go-version: '1.16.14'
 
       - name: Set env
         shell: bash
@@ -199,7 +199,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v2
         with:
-          go-version: '1.16.12'
+          go-version: '1.16.14'
 
       - name: Set env
         shell: bash
@@ -285,7 +285,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v2
         with:
-          go-version: '1.16.12'
+          go-version: '1.16.14'
 
       - name: Set env
         shell: bash
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index b5763c66adf7..b425ebf8f3ee 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -14,7 +14,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v2
         with:
-          go-version: '1.16.12'
+          go-version: '1.16.14'
 
       - name: Checkout
         uses: actions/checkout@v1
@@ -138,7 +138,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v2
         with:
-          go-version: '1.16.12'
+          go-version: '1.16.14'
 
       - name: Checkout
         uses: actions/checkout@v1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 90491e7e1d2f..0eb6c0090d84 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -62,7 +62,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@v2
         with:
-          go-version: '1.16.12'
+          go-version: '1.16.14'
 
       - name: Set env
         shell: bash
diff --git a/.travis.yml b/.travis.yml
index 8af6b229d654..99ea6010997e 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -15,7 +15,7 @@ os:
 - linux
 
 go:
-  - "1.16.12"
+  - "1.16.14"
 
 env:
   - TRAVIS_GOOS=linux TEST_RUNTIME=io.containerd.runc.v1 TRAVIS_CGO_ENABLED=1 TRAVIS_DISTRO=bionic GOPROXY=direct
diff --git a/.zuul/playbooks/containerd-build/run.yaml b/.zuul/playbooks/containerd-build/run.yaml
index 83dc865097a7..f67132bd7792 100644
--- a/.zuul/playbooks/containerd-build/run.yaml
+++ b/.zuul/playbooks/containerd-build/run.yaml
@@ -2,7 +2,7 @@
   become: yes
   roles:
   - role: config-golang
-    go_version: '1.16.12'
+    go_version: '1.16.14'
     arch: arm64
   tasks:
   - name: Build containerd
diff --git a/Vagrantfile b/Vagrantfile
index da256e04e33a..93b3c667372a 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -77,7 +77,7 @@ Vagrant.configure("2") do |config|
   config.vm.provision "install-golang", type: "shell", run: "once" do |sh|
     sh.upload_path = "/tmp/vagrant-install-golang"
     sh.env = {
-        'GO_VERSION': ENV['GO_VERSION'] || "1.16.12",
+        'GO_VERSION': ENV['GO_VERSION'] || "1.16.14",
     }
     sh.inline = <<~SHELL
         #!/usr/bin/env bash
diff --git a/contrib/Dockerfile.test b/contrib/Dockerfile.test
index 8237735f4a2b..f1f4662bd6bf 100644
--- a/contrib/Dockerfile.test
+++ b/contrib/Dockerfile.test
@@ -10,7 +10,7 @@
 #
 # docker build -t containerd-test --build-arg RUNC_VERSION=v1.0.0-rc93 -f Dockerfile.test ../
 
-ARG GOLANG_VERSION=1.16.12
+ARG GOLANG_VERSION=1.16.14
 
 FROM golang:${GOLANG_VERSION} AS golang-base
 RUN mkdir -p /go/src/github.com/containerd/containerd
diff --git a/script/setup/install-critools b/script/setup/install-critools
index b6a35adf9224..d42a52d65f7f 100755
--- a/script/setup/install-critools
+++ b/script/setup/install-critools
@@ -20,7 +20,8 @@
 #
 set -eu -o pipefail
 
-go get -u github.com/onsi/ginkgo/ginkgo
+GO111MODULE=on go install github.com/onsi/ginkgo/ginkgo@v1.16.5
+
 CRITEST_COMMIT=53ad8bb7f97e1b1d1c0c0634e43a3c2b8b07b718
 git clone https://github.com/kubernetes-sigs/cri-tools.git "$GOPATH"/src/github.com/kubernetes-sigs/cri-tools
 cd "$GOPATH"/src/github.com/kubernetes-sigs/cri-tools
diff --git a/script/setup/install-dev-tools b/script/setup/install-dev-tools
index b790594aaf29..281c0f8acff9 100755
--- a/script/setup/install-dev-tools
+++ b/script/setup/install-dev-tools
@@ -20,15 +20,13 @@
 #
 set -eu -o pipefail
 
-# install the `protobuild` binary in $GOPATH/bin; requires module-aware install
-# to pin dependencies
-GO111MODULE=on go get github.com/stevvooe/protobuild
+# install `protobuild` and other commands
+GO111MODULE=on go install github.com/stevvooe/protobuild@v0.1.0
+GO111MODULE=on go install github.com/cpuguy83/go-md2man/v2@v2.0.0
+GO111MODULE=on go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.23.8
 
 # the following packages need to exist in $GOPATH so we can't use
 # go modules-aware mode of `go get` for these includes used during
 # proto building
 GO111MODULE=off go get -d github.com/gogo/googleapis || true
 GO111MODULE=off go get -d github.com/gogo/protobuf || true
-
-GO111MODULE=on go get github.com/cpuguy83/go-md2man/v2@v2.0.0
-GO111MODULE=on go get github.com/golangci/golangci-lint/cmd/golangci-lint@v1.23.8