diff --git a/.drone/drone.jsonnet b/.drone/drone.jsonnet
index 40da881d21f..1341b6c4d79 100644
--- a/.drone/drone.jsonnet
+++ b/.drone/drone.jsonnet
@@ -108,7 +108,7 @@ local image_tag_for_cd() = {
 
 local build_binaries(arch) = {
   name: 'build-tempo-binaries',
-  image: 'golang:1.22-alpine',
+  image: 'golang:1.23-alpine',
   commands: [
     'apk --update --no-cache add make git bash',
   ] + [
@@ -258,7 +258,7 @@ local deploy_to_dev() = {
     steps+: [
               {
                 name: 'build-tempo-serverless',
-                image: 'golang:1.22-alpine',
+                image: 'golang:1.23-alpine',
                 commands: [
                   'apk add make git zip bash',
                   './tools/image-tag | cut -d, -f 1 | tr A-Z a-z > .tags',  // values in .tags are used by the next step when pushing the image
@@ -355,7 +355,7 @@ local deploy_to_dev() = {
       },
       {
         name: 'write-key',
-        image: 'golang:1.22',
+        image: 'golang:1.23',
         commands: ['printf "%s" "$NFPM_SIGNING_KEY" > $NFPM_SIGNING_KEY_FILE'],
         environment: {
           NFPM_SIGNING_KEY: { from_secret: gpg_private_key.name },
@@ -364,7 +364,7 @@ local deploy_to_dev() = {
       },
       {
         name: 'test release',
-        image: 'golang:1.22',
+        image: 'golang:1.23',
         commands: ['make release-snapshot'],
         environment: {
           NFPM_DEFAULT_PASSPHRASE: { from_secret: gpg_passphrase.name },
@@ -397,7 +397,7 @@ local deploy_to_dev() = {
       },
       {
         name: 'release',
-        image: 'golang:1.22',
+        image: 'golang:1.23',
         commands: ['make release'],
         environment: {
           NFPM_DEFAULT_PASSPHRASE: { from_secret: gpg_passphrase.name },
diff --git a/.drone/drone.yml b/.drone/drone.yml
index fc60c62cc93..de908ebfcde 100644
--- a/.drone/drone.yml
+++ b/.drone/drone.yml
@@ -18,7 +18,7 @@ steps:
   - COMPONENT=tempo-vulture GOARCH=amd64 make exe
   - COMPONENT=tempo-query GOARCH=amd64 make exe
   - COMPONENT=tempo-cli GOARCH=amd64 make exe
-  image: golang:1.22-alpine
+  image: golang:1.23-alpine
   name: build-tempo-binaries
 - image: plugins/docker
   name: build-tempo-image
@@ -95,7 +95,7 @@ steps:
   - COMPONENT=tempo-vulture GOARCH=arm64 make exe
   - COMPONENT=tempo-query GOARCH=arm64 make exe
   - COMPONENT=tempo-cli GOARCH=arm64 make exe
-  image: golang:1.22-alpine
+  image: golang:1.23-alpine
   name: build-tempo-binaries
 - image: plugins/docker
   name: build-tempo-image
@@ -379,7 +379,7 @@ steps:
   - cd ./cmd/tempo-serverless
   - make build-docker-gcr-binary
   - make build-lambda-zip
-  image: golang:1.22-alpine
+  image: golang:1.23-alpine
   name: build-tempo-serverless
 - image: plugins/gcr
   name: deploy-tempo-serverless-gcr
@@ -449,7 +449,7 @@ steps:
     NFPM_SIGNING_KEY:
       from_secret: gpg_private_key
     NFPM_SIGNING_KEY_FILE: /drone/src/private-key.key
-  image: golang:1.22
+  image: golang:1.23
   name: write-key
 - commands:
   - make release-snapshot
@@ -457,7 +457,7 @@ steps:
     NFPM_DEFAULT_PASSPHRASE:
       from_secret: gpg_passphrase
     NFPM_SIGNING_KEY_FILE: /drone/src/private-key.key
-  image: golang:1.22
+  image: golang:1.23
   name: test release
 - commands:
   - ./tools/packaging/verify-deb-install.sh
@@ -481,7 +481,7 @@ steps:
     NFPM_DEFAULT_PASSPHRASE:
       from_secret: gpg_passphrase
     NFPM_SIGNING_KEY_FILE: /drone/src/private-key.key
-  image: golang:1.22
+  image: golang:1.23
   name: release
   when:
     event:
@@ -583,6 +583,6 @@ kind: secret
 name: gpg_passphrase
 ---
 kind: signature
-hmac: c46c1f75885fe897a2700bfbe648891f18b5b9820aba1d34e4ae8ce6979af5be
+hmac: 89985402118d8a96c616f0a26c40b8b5e6fda8e904231dbe76f709cbf9603a8a
 
 ...
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6d8226353f1..29c1bcaa96e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,7 +25,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: "0"
-      - name: Set up Go 1.22
+      - name: Set up Go
         uses: actions/setup-go@v5
         with:
           go-version-file: "go.mod"
@@ -55,7 +55,7 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v4
 
-      - name: Set up Go 1.22
+      - name: Set up Go
         uses: actions/setup-go@v5
         with:
           go-version-file: "go.mod"
@@ -79,7 +79,7 @@ jobs:
     steps:
       - name: Check out code
         uses: actions/checkout@v4
-      - name: Set up Go 1.22
+      - name: Set up Go
         uses: actions/setup-go@v5
         with:
           go-version-file: "go.mod"
@@ -93,7 +93,7 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v4
 
-      - name: Set up Go 1.22
+      - name: Set up Go
         uses: actions/setup-go@v5
         with:
           go-version-file: "go.mod"
@@ -117,7 +117,7 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v4
 
-      - name: Set up Go 1.22
+      - name: Set up Go
         uses: actions/setup-go@v5
         with:
           go-version-file: "go.mod"
@@ -132,7 +132,7 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v4
 
-      - name: Set up Go 1.22
+      - name: Set up Go
         uses: actions/setup-go@v5
         with:
           go-version-file: "go.mod"
@@ -150,7 +150,7 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v4
 
-      - name: Set up Go 1.22
+      - name: Set up Go
         uses: actions/setup-go@v5
         with:
           go-version-file: "go.mod"
diff --git a/.github/workflows/dependabot_serverless_gomod.yml b/.github/workflows/dependabot_serverless_gomod.yml
index b09a0068374..011a95172bd 100644
--- a/.github/workflows/dependabot_serverless_gomod.yml
+++ b/.github/workflows/dependabot_serverless_gomod.yml
@@ -20,7 +20,7 @@ jobs:
       - name: Set up Go 1.22
         uses: actions/setup-go@v5
         with:
-          go-version: 1.22.4
+          go-version: 1.23.1
 
       - name: Get app token
         uses: actions/create-github-app-token@v1
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6bdc7397fd6..72ee3303da3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,7 @@
 * [CHANGE] **BREAKING CHANGE** Migrate from OpenTracing to OpenTelemetry instrumentation. Removed the `use_otel_tracer` configuration option. Use the OpenTelemetry environment variables to configure the span exporter [#3646](https://github.com/grafana/tempo/pull/3646) (@andreasgerstmayr)
   To continue using the Jaeger exporter, use the following environment variable: `OTEL_TRACES_EXPORTER=jaeger`.
 * [CHANGE] No longer send the final diff in GRPC streaming. Instead we rely on the streamed intermediate results. [#4062](https://github.com/grafana/tempo/pull/4062) (@joe-elliott)
+* [CHANGE] Update Go to 1.23.1 [#4146](https://github.com/grafana/tempo/pull/4146) [#4147](https://github.com/grafana/tempo/pull/4147) (@javiermolinar)
 * [FEATURE] Discarded span logging `log_discarded_spans` [#3957](https://github.com/grafana/tempo/issues/3957) (@dastrobu)
 * [FEATURE] TraceQL support for instrumentation scope [#3967](https://github.com/grafana/tempo/pull/3967) (@ie-pham)
 * [ENHANCEMENT] TraceQL: Attribute iterators collect matched array values [#3867](https://github.com/grafana/tempo/pull/3867) (@electron0zero, @stoewer)
@@ -29,7 +30,7 @@
 * [ENHANCEMENT] Replace Grafana Agent example by Grafana Alloy[#4030](https://github.com/grafana/tempo/pull/4030) (@javiermolinar)
 * [ENHANCEMENT] Support exporting internal Tempo traces via OTLP exporter when `use_otel_tracer` is enabled. Use the OpenTelemetry SDK environment variables to configure the span exporter. [#4028](https://github.com/grafana/tempo/pull/4028) (@andreasgerstmayr)
 * [ENHANCEMENT] TraceQL metrics queries: add min_over_time  [#3975](https://github.com/grafana/tempo/pull/3975) (@javiermolinar)
-* [ENHANCEMENT] TraceQL metrics queries: add max_over_time  [#3975](https://github.com/grafana/tempo/pull/4065) (@javiermolinar)
+
 
 # v2.6.0
 
diff --git a/build/tools.mk b/build/tools.mk
index 40b613edbbe..ab4e178aca1 100644
--- a/build/tools.mk
+++ b/build/tools.mk
@@ -12,7 +12,7 @@ TOOL_DIR     ?= tools
 TOOL_CONFIG  ?= $(TOOL_DIR)/tools.go
 
 TOOLS_IMAGE ?= grafana/tempo-ci-tools
-TOOLS_IMAGE_TAG ?= main-5e4eafd
+TOOLS_IMAGE_TAG ?= main-a46ac6d
 
 GOTOOLS ?= $(shell cd $(TOOL_DIR) && go list -e -f '{{ .Imports }}' -tags tools |tr -d '[]')
 
diff --git a/cmd/tempo-serverless/cloud-run/go.mod b/cmd/tempo-serverless/cloud-run/go.mod
index deae21791eb..3e50d743b73 100644
--- a/cmd/tempo-serverless/cloud-run/go.mod
+++ b/cmd/tempo-serverless/cloud-run/go.mod
@@ -1,6 +1,6 @@
 module github.com/grafana/tempo/cmd/tempo-serverless/cloud-run
 
-go 1.22.4
+go 1.23.1
 
 require (
 	github.com/gogo/protobuf v1.3.2
diff --git a/cmd/tempo-serverless/lambda/go.mod b/cmd/tempo-serverless/lambda/go.mod
index c7826a910e0..fa45d5c6fcd 100644
--- a/cmd/tempo-serverless/lambda/go.mod
+++ b/cmd/tempo-serverless/lambda/go.mod
@@ -1,6 +1,6 @@
 module github.com/grafana/tempo/cmd/tempo-serverless/lambda
 
-go 1.22.4
+go 1.23.1
 
 require (
 	github.com/aws/aws-lambda-go v1.28.0
diff --git a/go.mod b/go.mod
index e4a6f63d1e3..aab658ab609 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/grafana/tempo
 
-go 1.22.4
+go 1.23.1
 
 require (
 	cloud.google.com/go/storage v1.41.0