diff --git a/.go-version b/.go-version
index 8909929f6e..d2ab029d32 100644
--- a/.go-version
+++ b/.go-version
@@ -1 +1 @@
-1.20.7
+1.21
diff --git a/internal/prometheus/prometheus_test.go b/internal/prometheus/prometheus_test.go
index 75636b454c..0d871d176e 100644
--- a/internal/prometheus/prometheus_test.go
+++ b/internal/prometheus/prometheus_test.go
@@ -85,6 +85,13 @@ func TestJSONSerialization(t *testing.T) {
 			"go_sched_goroutines_goroutines",
 			"go_sched_gomaxprocs_threads",
 			"go_threads",
+			"go_gc_gomemlimit_bytes", // BEGIN added in 1.21
+			"go_gc_heap_live_bytes",
+			"go_gc_gogc_percent",
+			"go_gc_scan_globals_bytes",
+			"go_gc_scan_heap_bytes",
+			"go_gc_scan_stack_bytes",
+			"go_gc_scan_total_bytes",
 		},
 		"COUNTER": {
 			"go_gc_cycles_automatic_gc_cycles_total",
@@ -112,6 +119,23 @@ func TestJSONSerialization(t *testing.T) {
 			"go_cpu_classes_gc_total_cpu_seconds_total",
 			"go_sync_mutex_wait_total_seconds_total",
 			"go_cpu_classes_gc_pause_cpu_seconds_total",
+			"go_godebug_non_default_behavior_execerrdot_events_total", // BEGIN added in 1.21
+			"go_godebug_non_default_behavior_gocachehash_events_total",
+			"go_godebug_non_default_behavior_gocachetest_events_total",
+			"go_godebug_non_default_behavior_gocacheverify_events_total",
+			"go_godebug_non_default_behavior_http2client_events_total",
+			"go_godebug_non_default_behavior_http2server_events_total",
+			"go_godebug_non_default_behavior_installgoroot_events_total",
+			"go_godebug_non_default_behavior_jstmpllitinterp_events_total",
+			"go_godebug_non_default_behavior_panicnil_events_total",
+			"go_godebug_non_default_behavior_randautoseed_events_total",
+			"go_godebug_non_default_behavior_tarinsecurepath_events_total",
+			"go_godebug_non_default_behavior_multipartmaxheaders_events_total",
+			"go_godebug_non_default_behavior_multipartmaxparts_events_total",
+			"go_godebug_non_default_behavior_multipathtcp_events_total",
+			"go_godebug_non_default_behavior_x509sha1_events_total",
+			"go_godebug_non_default_behavior_x509usefallbackroots_events_total",
+			"go_godebug_non_default_behavior_zipinsecurepath_events_total",
 		},
 		"SUMMARY": {
 			"go_gc_duration_seconds",
diff --git a/plugins/rest/rest_test.go b/plugins/rest/rest_test.go
index 96de1bfc07..a6c5f96a8b 100644
--- a/plugins/rest/rest_test.go
+++ b/plugins/rest/rest_test.go
@@ -1274,9 +1274,17 @@ func TestClientCert(t *testing.T) {
 		// Ensure the keys don't work anymore, make a new client as the url will have changed
 		client = newTestClient(t, &ts, certPath, keyPath)
 		_, err := client.Do(ctx, "GET", "test")
-		expectedErrMsg := "tls: bad certificate"
-		if err == nil || !strings.Contains(err.Error(), expectedErrMsg) {
-			t.Fatalf("Expected '%s' error but request succeeded", expectedErrMsg)
+		expectedErrMsg := func(s string) bool {
+			switch {
+			case strings.Contains(s, "tls: unknown certificate authority"):
+			case strings.Contains(s, "tls: bad certificate"):
+			default:
+				return false
+			}
+			return true
+		}
+		if err == nil || !expectedErrMsg(err.Error()) {
+			t.Fatalf("Unexpected error %v", err)
 		}
 
 		// Update the key files and try again..
diff --git a/topdown/tokens_test.go b/topdown/tokens_test.go
index 5f8031b43c..975a78461c 100644
--- a/topdown/tokens_test.go
+++ b/topdown/tokens_test.go
@@ -471,9 +471,11 @@ func TestTopdownJWTEncodeSignECWithSeedReturnsSameSignature(t *testing.T) {
 	   "y":"x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0",
 	   "d":"jpsQnnGQmL-YBIffH1136cspYG6-0iY7X1fCE9-E9LI"
 	  }, x)`
-	encodedSigned := "eyJhbGciOiAiRVMyNTYifQ.eyJwYXkiOiAibG9hZCJ9.05wmHY3NomU1jr7yvusBvKwhthRklPuJhUPOkoeIn5e5n_GXvE25EfRs9AJK2wOy6NoY2ljhj07M9BMtV0dfyA"
-	if strings.HasPrefix(runtime.Version(), "go1.20") {
-		encodedSigned = "eyJhbGciOiAiRVMyNTYifQ.eyJwYXkiOiAibG9hZCJ9.GRp6wIqDZuYnvQH50hnIy559LdrjUux76v1ynxX6lH0XtlgwreyR16x2JMnuElo79X3zUbqlWrZITICv86arew"
+
+	// go1.20 and beyond
+	encodedSigned := "eyJhbGciOiAiRVMyNTYifQ.eyJwYXkiOiAibG9hZCJ9.GRp6wIqDZuYnvQH50hnIy559LdrjUux76v1ynxX6lH0XtlgwreyR16x2JMnuElo79X3zUbqlWrZITICv86arew"
+	if strings.HasPrefix(runtime.Version(), "go1.19") { // we don't use go1.18 anymore
+		encodedSigned = "eyJhbGciOiAiRVMyNTYifQ.eyJwYXkiOiAibG9hZCJ9.05wmHY3NomU1jr7yvusBvKwhthRklPuJhUPOkoeIn5e5n_GXvE25EfRs9AJK2wOy6NoY2ljhj07M9BMtV0dfyA"
 	}
 
 	for i := 0; i < 10; i++ {