diff --git a/.github/workflows/build-dependency-image.yml b/.github/workflows/build-dependency-image.yml
new file mode 100644
index 0000000..471a15a
--- /dev/null
+++ b/.github/workflows/build-dependency-image.yml
@@ -0,0 +1,52 @@
+name: Build linux-bench-dependency image
+
+# Publishes the `linux-bench-dependency` image consumed by secure-backend's
+# compliance-benchmark-runner (pinned there via LINUX_BENCH_TAG).
+#
+# Runs AFTER the tag is created: when a Sysdig dependency tag is pushed, this
+# workflow triggers the `secure/compliance/compliance-linux-bench` Jenkins job
+# with TAG=<the tag>. The job checks out that tag, builds the dependency image,
+# and pushes linux-bench-dependency:<tag> to GAR — so the published registry
+# tag matches the git tag 1:1.
+#
+# Registry tags are immutable, so each newly pushed dependency tag is a fresh
+# release by construction; this workflow never re-publishes an existing tag.
+#
+# Tag scheme: the Sysdig dependency versions are 4-part numeric
+# MAJOR.MINOR.PATCH.BUILD (e.g. 1.1.0.14, and future 1.1.1.0 / 2.0.0.0). The
+# glob below matches any 4-part numeric tag, which is distinct from the
+# upstream release tags (`v*` prefix, and short 2-3 part tags) handled by
+# release.yml / publish.yml.
+on:
+  push:
+    tags:
+      # Any 4-part numeric dependency tag (e.g. 1.1.0.15, 1.1.1.0, 2.0.0.0).
+      - "[0-9]+.[0-9]+.[0-9]+.[0-9]+"
+  # Manual fallback: publish a specific existing tag from the Actions UI.
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "linux-bench-dependency tag to build (e.g. 1.1.0.15)"
+        required: true
+
+jobs:
+  build-dependency-image:
+    name: Trigger compliance-linux-bench Jenkins job
+    runs-on: tools-runner
+    steps:
+      - name: Resolve tag
+        id: tag
+        run: echo "value=${{ github.event.inputs.tag || github.ref_name }}" >> "$GITHUB_OUTPUT"
+
+      - name: Trigger compliance-linux-bench Jenkins job
+        uses: draios/jenkins-job-trigger-action@1.1.0
+        with:
+          jenkins_url: ${{ secrets.JENKINS_INTERNAL_URL }}
+          jenkins_user: ${{ secrets.JENKINS_QA_API_USER }}
+          jenkins_token: ${{ secrets.JENKINS_QA_API_TOKEN }}
+          job_name: "secure/job/compliance/job/compliance-linux-bench"
+          job_params: |
+            {
+              "TAG": "${{ steps.tag.outputs.value }}"
+            }
+          job_timeout: 3600
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e4a5f1f..345a86f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -20,7 +20,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5.3.0
         with:
-          go-version: 1.25.9
+          go-version: 1.25.11
       - name: Checkout code
         uses: actions/checkout@v4.2.2
       - name: Run unit tests
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 059c835..2547009 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,7 +11,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v1
         with:
-          go-version: 1.25.9
+          go-version: 1.25.11
       - name: Checkout code
         uses: actions/checkout@v2
       - name: Run unit tests
diff --git a/Dockerfile b/Dockerfile
index 4529d9b..f385c1e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.10 AS builder
+FROM golang:1.25.11 AS builder
 
 ENV OUTPUT_DIR=/out
 
diff --git a/Dockerfile_linux_arm64 b/Dockerfile_linux_arm64
index 8ed26fc..5537b47 100644
--- a/Dockerfile_linux_arm64
+++ b/Dockerfile_linux_arm64
@@ -1,4 +1,4 @@
-FROM golang:1.25.9 AS builder
+FROM golang:1.25.11 AS builder
 
 ENV OUTPUT_DIR=/out
 
diff --git a/Dockerfile_linux_s390x b/Dockerfile_linux_s390x
index f05cc3d..b7b026f 100644
--- a/Dockerfile_linux_s390x
+++ b/Dockerfile_linux_s390x
@@ -1,4 +1,4 @@
-FROM golang:1.25.9 AS builder
+FROM golang:1.25.11 AS builder
 
 ENV OUTPUT_DIR=/out
 
diff --git a/go.mod b/go.mod
index 627b96d..10744f6 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/aquasecurity/linux-bench
 
-go 1.25.9
+go 1.25.11
 
 require (
 	github.com/aquasecurity/bench-common v0.4.8