diff --git a/modules/route-proxy/cmd/route-proxy/Dockerfile b/modules/route-proxy/cmd/route-proxy/Dockerfile
index c807c3d..1c03627 100644
--- a/modules/route-proxy/cmd/route-proxy/Dockerfile
+++ b/modules/route-proxy/cmd/route-proxy/Dockerfile
@@ -2,7 +2,10 @@
 #
 # Static and FROM scratch like the control plane's image, and for the same reason: it is fetched
 # by digest and run on a machine, so everything in it is something a person would have to audit.
-FROM golang:1.25-alpine AS build
+# The Go it builds with is the one the manifest pins (build.on GO_BASE), passed by the Makefile and the
+# build machine alike; the default only serves a hand build, and matches go.mod.
+ARG GO_BASE=golang:1.26-alpine
+FROM ${GO_BASE} AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download