diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 14b788c0f4..c464227239 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,7 +11,7 @@ jobs:
     # Whenever the Go version is updated here, .promu.yml
     # should also be updated.
     container:
-      image: quay.io/prometheus/golang-builder:1.20-base
+      image: quay.io/prometheus/golang-builder:1.21-base
     steps:
       - uses: actions/checkout@v3
       - uses: prometheus/promci@v0.1.0
@@ -32,7 +32,7 @@ jobs:
     # Whenever the Go version is updated here, .promu.yml
     # should also be updated.
     container:
-      image: quay.io/prometheus/golang-builder:1.20-base
+      image: quay.io/prometheus/golang-builder:1.21-base
 
     steps:
       - uses: actions/checkout@v3
@@ -55,7 +55,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-go@v4
         with:
-          go-version: '>=1.20 <1.21'
+          go-version: '>=1.21 <1.22'
       - run: |
           $TestTargets = go list ./... | Where-Object { $_ -NotMatch "(github.com/prometheus/prometheus/discovery.*|github.com/prometheus/prometheus/config|github.com/prometheus/prometheus/web)"}
           go test $TestTargets -vet=off -v
@@ -66,7 +66,7 @@ jobs:
     runs-on: ubuntu-latest
     # The go verson in this image should be N-1 wrt test_go.
     container:
-      image: quay.io/prometheus/golang-builder:1.19-base
+      image: quay.io/prometheus/golang-builder:1.20-base
     steps:
       - uses: actions/checkout@v3
       - run: make build
@@ -79,7 +79,7 @@ jobs:
     # Whenever the Go version is updated here, .promu.yml
     # should also be updated.
     container:
-      image: quay.io/prometheus/golang-builder:1.19-base
+      image: quay.io/prometheus/golang-builder:1.20-base
     steps:
       - uses: actions/checkout@v3
       - run: go install ./cmd/promtool/.
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 762e920163..ec8d993fb5 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -27,7 +27,7 @@ jobs:
         uses: actions/checkout@v3
       - uses: actions/setup-go@v4
         with:
-          go-version: '>=1.20 <1.21'
+          go-version: '>=1.21 <1.22'
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v2
diff --git a/.promu.yml b/.promu.yml
index f724dc34f3..9f59485236 100644
--- a/.promu.yml
+++ b/.promu.yml
@@ -1,7 +1,7 @@
 go:
     # Whenever the Go version is updated here,
     # .circle/config.yml should also be updated.
-    version: 1.20
+    version: 1.21
 repository:
     path: github.com/prometheus/prometheus
 build:
diff --git a/go.mod b/go.mod
index 3e97cdda0d..b84a4623d7 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/prometheus/prometheus
 
-go 1.19
+go 1.20
 
 require (
 	github.com/Azure/azure-sdk-for-go v65.0.0+incompatible
diff --git a/tsdb/wlog/reader_test.go b/tsdb/wlog/reader_test.go
index 2c4dd622c0..309bee755e 100644
--- a/tsdb/wlog/reader_test.go
+++ b/tsdb/wlog/reader_test.go
@@ -16,11 +16,12 @@ package wlog
 
 import (
 	"bytes"
+	"crypto/rand"
 	"encoding/binary"
 	"fmt"
 	"hash/crc32"
 	"io"
-	"math/rand"
+	"math/big"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -252,8 +253,11 @@ func generateRandomEntries(w *WL, records chan []byte) error {
 		default:
 			sz = pageSize * 8
 		}
-
-		rec := make([]byte, rand.Int63n(sz))
+		n, err := rand.Int(rand.Reader, big.NewInt(sz))
+		if err != nil {
+			return err
+		}
+		rec := make([]byte, n.Int64())
 		if _, err := rand.Read(rec); err != nil {
 			return err
 		}
@@ -262,7 +266,11 @@ func generateRandomEntries(w *WL, records chan []byte) error {
 
 		// Randomly batch up records.
 		recs = append(recs, rec)
-		if rand.Intn(4) < 3 {
+		n, err = rand.Int(rand.Reader, big.NewInt(int64(4)))
+		if err != nil {
+			return err
+		}
+		if int(n.Int64()) < 3 {
 			if err := w.Log(recs...); err != nil {
 				return err
 			}
diff --git a/tsdb/wlog/wlog_test.go b/tsdb/wlog/wlog_test.go
index f9ce225b37..5602a3ee07 100644
--- a/tsdb/wlog/wlog_test.go
+++ b/tsdb/wlog/wlog_test.go
@@ -16,9 +16,9 @@ package wlog
 
 import (
 	"bytes"
+	"crypto/rand"
 	"fmt"
 	"io"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"testing"