diff --git a/.github/renovate.json b/.github/renovate.json
index ae22a4e8c..8e917397c 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -28,6 +28,11 @@
       "groupName": "Argo Workflows",
       "commitMessageTopic": "Argo Workflows"
     },
+    {
+      "description": "go mod tidy can raise the go directive to match a dependency, which breaks the container builds pinned to an older golang image; require a human to review Go module updates",
+      "matchManagers": ["gomod"],
+      "automerge": false
+    },
     {
       "matchPackageNames": ["go", "golang"],
       "matchManagers": ["asdf", "gomod"],
diff --git a/go/nautobotop/go.mod b/go/nautobotop/go.mod
index 075c44138..8946cecd1 100644
--- a/go/nautobotop/go.mod
+++ b/go/nautobotop/go.mod
@@ -1,6 +1,6 @@
 module github.com/rackerlabs/understack/go/nautobotop
 
-go 1.26
+go 1.25
 
 require (
 	github.com/charmbracelet/log v0.4.2
@@ -14,7 +14,7 @@ require (
 	k8s.io/api v0.33.0
 	k8s.io/apimachinery v0.33.0
 	k8s.io/client-go v0.33.0
-	k8s.io/utils v0.0.0-20261023123148-ca04ba58ecab
+	k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3
 	sigs.k8s.io/controller-runtime v0.21.0
 )
 
diff --git a/go/nautobotop/go.sum b/go/nautobotop/go.sum
index 8af4e82aa..492146c8b 100644
--- a/go/nautobotop/go.sum
+++ b/go/nautobotop/go.sum
@@ -304,8 +304,6 @@ k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6J
 k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 h1:jVkFFVfXdXP74B/zbO3hM3hpSFD0xvhQ5U686DPurkE=
 k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3/go.mod h1:M2s5JB1lIYP3jzZdorPLHXIPJzt9vv2muW5a6L9DtNM=
-k8s.io/utils v0.0.0-20261023123148-ca04ba58ecab h1:pjQrNLaF//ytZtWwCAHtW+pqwSKjtWDqzA8+TCX37RI=
-k8s.io/utils v0.0.0-20261023123148-ca04ba58ecab/go.mod h1:DdQ0BJxlQtuMlKDqdg7X5IMMQCXIk2b3d1/4M9OhUYo=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 h1:jpcvIRr3GLoUoEKRkHKSmGjxb6lWwrBlJsXc+eUYQHM=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
 sigs.k8s.io/controller-runtime v0.21.0 h1:CYfjpEuicjUecRk+KAeyYh+ouUBn4llGyDYytIGcJS8=