diff --git a/BUILD.bazel b/BUILD.bazel
index e073e04ef..c425e5609 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -39,8 +39,8 @@ gazelle_binary(
 )
 
 go_cross_binary(
-    name = "gazelle_local_go1.20",
-    sdk_version = "1.20",
+    name = "gazelle_local_go1.21",
+    sdk_version = "1.21",
     target = ":gazelle_local",
 )
 
diff --git a/MODULE.bazel b/MODULE.bazel
index 69b40c315..dd1d17055 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -63,7 +63,7 @@ go_sdk_dev = use_extension("@io_bazel_rules_go//go:extensions.bzl", "go_sdk", de
 go_sdk_dev.download(version = "1.23.3")
 
 # Used by compatibility tests, keep as low as possible.
-go_sdk_dev.download(version = "1.20.14")
+go_sdk_dev.download(version = "1.21.13")
 
 # Known to exist since it is instantiated by rules_go itself.
 use_repo(
diff --git a/WORKSPACE b/WORKSPACE
index 01aee392a..aa91aa08f 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -49,11 +49,13 @@ go_register_nogo(
     nogo = "@bazel_gazelle//:nogo",
 )
 
+# Go 1.21 is needed to support the toolchain directive in go.mod, which is non-hermetically read
+# by GoToolchainBinaryBuild on Windows.
 # Go 1.20 is needed so support nogo's use of token.File.FileStart.
 # Go 1.19 is needed for recent versions of golang.org/x/tools.
 go_download_sdk(
     name = "go_compat_sdk",
-    version = "1.20.14",
+    version = "1.21.13",
 )
 
 load("//:deps.bzl", "gazelle_dependencies")
diff --git a/cmd/fetch_repo/BUILD.bazel b/cmd/fetch_repo/BUILD.bazel
index 62aea7afb..58fa1fecc 100644
--- a/cmd/fetch_repo/BUILD.bazel
+++ b/cmd/fetch_repo/BUILD.bazel
@@ -26,10 +26,10 @@ go_binary(
     visibility = ["//visibility:public"],
 )
 
-# Verify that fetch_repo builds with Go 1.20.
+# Verify that fetch_repo builds with Go 1.21.
 go_cross_binary(
-    name = "fetch_repo_go1.20",
-    sdk_version = "1.20",
+    name = "fetch_repo_go1.21",
+    sdk_version = "1.21",
     target = ":fetch_repo",
 )