diff --git a/docker/toolbox/latest/Dockerfile b/docker/toolbox/latest/Dockerfile
index 530b6bf56..efca5079a 100644
--- a/docker/toolbox/latest/Dockerfile
+++ b/docker/toolbox/latest/Dockerfile
@@ -29,8 +29,12 @@ RUN apk add --no-cache \
         # Baselayout scripts
         && wget -O /tmp/baselayout-install.sh https://raw.githubusercontent.com/webdevops/Docker-Image-Baselayout/master/install.sh \
         && sh /tmp/baselayout-install.sh /baselayout \
-        ## Install go-replace
-    && wget -O "/baselayout/usr/local/bin/go-replace" "https://github.com/webdevops/go-replace/releases/download/22.10.0/go-replace.linux.$TARGETARCH" \
+        ## Install go-replace (build from source to ensure up-to-date Go stdlib, fixing CVEs in pre-built binaries)
+    && apk add --no-cache --virtual .build-deps-go go \
+    && GOPATH=/tmp/go-build GOCACHE=/tmp/go-cache GOARCH=$TARGETARCH GOOS=linux CGO_ENABLED=0 go install "github.com/webdevops/go-replace@22.10.0" \
+    && (mv "/tmp/go-build/bin/linux_${TARGETARCH}/go-replace" "/baselayout/usr/local/bin/go-replace" 2>/dev/null || mv /tmp/go-build/bin/go-replace "/baselayout/usr/local/bin/go-replace") \
+    && apk del .build-deps-go \
+    && rm -rf /tmp/go-build /tmp/go-cache \
     && chmod +x "/baselayout/usr/local/bin/go-replace" \
     && "/baselayout/usr/local/bin/go-replace" --version \
         && ln -s /baselayout/usr/local/bin/go-replace /usr/local/bin/ \
diff --git a/template/Dockerfile/tools.jinja2 b/template/Dockerfile/tools.jinja2
index b15ac5b8b..8828759ee 100644
--- a/template/Dockerfile/tools.jinja2
+++ b/template/Dockerfile/tools.jinja2
@@ -1,6 +1,10 @@
 {% macro goreplace(path="/usr/local/bin", version="22.10.0") -%}
-    ## Install go-replace
-    && wget -O "{{ path }}/go-replace" "https://github.com/webdevops/go-replace/releases/download/{{ version }}/go-replace.linux.$TARGETARCH" \
+    ## Install go-replace (build from source to ensure up-to-date Go stdlib, fixing CVEs in pre-built binaries)
+    && apk add --no-cache --virtual .build-deps-go go \
+    && GOPATH=/tmp/go-build GOCACHE=/tmp/go-cache GOARCH=$TARGETARCH GOOS=linux CGO_ENABLED=0 go install "github.com/webdevops/go-replace@{{ version }}" \
+    && (mv "/tmp/go-build/bin/linux_${TARGETARCH}/go-replace" "{{ path }}/go-replace" 2>/dev/null || mv /tmp/go-build/bin/go-replace "{{ path }}/go-replace") \
+    && apk del .build-deps-go \
+    && rm -rf /tmp/go-build /tmp/go-cache \
     && chmod +x "{{ path }}/go-replace" \
     && "{{ path }}/go-replace" --version
 {%- endmacro %}