diff --git a/build/build-image/cross/VERSION b/build/build-image/cross/VERSION
index b0ae55d054e2..90bc8da35827 100644
--- a/build/build-image/cross/VERSION
+++ b/build/build-image/cross/VERSION
@@ -1 +1 @@
-v1.16.5-1
+v1.16.6-1
diff --git a/build/common.sh b/build/common.sh
index ac4913083036..a8cbc79348e9 100755
--- a/build/common.sh
+++ b/build/common.sh
@@ -87,7 +87,7 @@ readonly KUBE_CONTAINER_RSYNC_PORT=8730
 
 # These are the default versions (image tags) for their respective base images.
 readonly __default_debian_iptables_version=buster-v1.6.2
-readonly __default_go_runner_version=v2.3.1-go1.16.5-buster.0
+readonly __default_go_runner_version=v2.3.1-go1.16.6-buster.0
 readonly __default_setcap_version=buster-v2.0.1
 
 # These are the base images for the Docker-wrapped binaries.
diff --git a/build/dependencies.yaml b/build/dependencies.yaml
index 45cbedd9ceb9..0822c1abef8f 100644
--- a/build/dependencies.yaml
+++ b/build/dependencies.yaml
@@ -101,7 +101,7 @@ dependencies:
 
   # Golang
   - name: "golang: upstream version"
-    version: 1.16.5
+    version: 1.16.6
     refPaths:
     - path: build/build-image/cross/VERSION
     - path: cluster/addons/fluentd-elasticsearch/es-image/Dockerfile
@@ -124,7 +124,7 @@ dependencies:
       match: minimum_go_version=go([0-9]+\.[0-9]+)
 
   - name: "k8s.gcr.io/kube-cross: dependents"
-    version: v1.16.5-1
+    version: v1.16.6-1
     refPaths:
     - path: build/build-image/cross/VERSION
     - path: test/images/sample-apiserver/Makefile
@@ -154,7 +154,7 @@ dependencies:
       match: configs\[DebianIptables\] = Config{buildImageRegistry, "debian-iptables", "[a-zA-Z]+\-v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)"}
 
   - name: "k8s.gcr.io/go-runner: dependents"
-    version: v2.3.1-go1.16.5-buster.0
+    version: v2.3.1-go1.16.6-buster.0
     refPaths:
     - path: build/common.sh
       match: __default_go_runner_version=
diff --git a/cluster/addons/fluentd-elasticsearch/es-image/Dockerfile b/cluster/addons/fluentd-elasticsearch/es-image/Dockerfile
index 5e18184203a9..33cbd58f5e7e 100644
--- a/cluster/addons/fluentd-elasticsearch/es-image/Dockerfile
+++ b/cluster/addons/fluentd-elasticsearch/es-image/Dockerfile
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.16.5 AS builder
+FROM golang:1.16.6 AS builder
 COPY elasticsearch_logging_discovery.go go.mod go.sum /
 RUN CGO_ENABLED=0 GOOS=linux GO111MODULE=on go build -a -ldflags "-w" -o /elasticsearch_logging_discovery /elasticsearch_logging_discovery.go
 
diff --git a/staging/publishing/rules.yaml b/staging/publishing/rules.yaml
index 7afa2dddb867..b292d1ed87f7 100644
--- a/staging/publishing/rules.yaml
+++ b/staging/publishing/rules.yaml
@@ -7,7 +7,7 @@ recursive-delete-patterns:
 - BUILD.bazel
 - "*/BUILD.bazel"
 - Gopkg.toml
-default-go-version: 1.16.5
+default-go-version: 1.16.6
 rules:
 - destination: code-generator
   branches:
diff --git a/test/images/Makefile b/test/images/Makefile
index 54862dba9d1e..e35d76a1ce92 100644
--- a/test/images/Makefile
+++ b/test/images/Makefile
@@ -16,7 +16,7 @@ REGISTRY ?= gcr.io/kubernetes-e2e-test-images
 GOARM ?= 7
 DOCKER_CERT_BASE_PATH ?=
 QEMUVERSION=v5.1.0-2
-GOLANG_VERSION=1.16.5
+GOLANG_VERSION=1.16.6
 export
 
 ifndef WHAT
diff --git a/test/images/sample-apiserver/Makefile b/test/images/sample-apiserver/Makefile
index 984b9501377e..62b44a18b823 100644
--- a/test/images/sample-apiserver/Makefile
+++ b/test/images/sample-apiserver/Makefile
@@ -24,7 +24,7 @@ export
 # Get without building to populate module cache
 # Then, get with OS/ARCH-specific env to build
 bin:
-	docker run --rm -i -v "${TARGET}:${TARGET}:Z" k8s.gcr.io/build-image/kube-cross:v1.16.5-1 \
+	docker run --rm -i -v "${TARGET}:${TARGET}:Z" k8s.gcr.io/build-image/kube-cross:v1.16.6-1 \
 		/bin/bash -c "\
 			mkdir -p /go/src /go/bin && \
 			GO111MODULE=on go get -d k8s.io/sample-apiserver@v0.17.0 && \