diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index 5c16a4e2c4c..4d8a0ba4ec1 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -13,5 +13,5 @@ jobs:
       - id: govulncheck
         uses: golang/govulncheck-action@v1
         with:
-           go-version-input: 1.20.7
+           go-version-input: 1.20.8
            go-package: ./...
diff --git a/.go-version b/.go-version
index 8909929f6e7..95393fc7d4d 100644
--- a/.go-version
+++ b/.go-version
@@ -1 +1 @@
-1.20.7
+1.20.8
diff --git a/.golangci.yml b/.golangci.yml
index 6af8ecba48c..a6f9f5de236 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -116,7 +116,7 @@ linters-settings:
 
   gosimple:
     # Select the Go version to target. The default is '1.13'.
-    go: "1.20.7"
+    go: "1.20.8"
 
   nakedret:
     # make an issue if func has more lines of code than this setting and it has naked returns; default is 30
@@ -136,17 +136,17 @@ linters-settings:
 
   staticcheck:
     # Select the Go version to target. The default is '1.13'.
-    go: "1.20.7"
+    go: "1.20.8"
     checks: ["all"]
 
   stylecheck:
     # Select the Go version to target. The default is '1.13'.
-    go: "1.20.7"
+    go: "1.20.8"
     checks: ["all"]
 
   unused:
     # Select the Go version to target. The default is '1.13'.
-    go: "1.20.7"
+    go: "1.20.8"
 
   gosec:
     excludes:
diff --git a/Dockerfile b/Dockerfile
index 9589d0bcbf5..d0c2edc9f94 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-ARG GO_VERSION=1.20.7
+ARG GO_VERSION=1.20.8
 FROM circleci/golang:${GO_VERSION}
 
 
diff --git a/Dockerfile.skaffold b/Dockerfile.skaffold
index fad68dd0607..ca9300eb4de 100644
--- a/Dockerfile.skaffold
+++ b/Dockerfile.skaffold
@@ -1,4 +1,4 @@
-ARG GO_VERSION=1.20.7
+ARG GO_VERSION=1.20.8
 ARG crossbuild_image="docker.elastic.co/beats-dev/golang-crossbuild"
 ARG AGENT_VERSION=8.9.0-SNAPSHOT
 ARG AGENT_IMAGE="docker.elastic.co/beats/elastic-agent"
diff --git a/changelog/fragments/1694700200-Upgrade-to-Go-1.20.8.yaml b/changelog/fragments/1694700200-Upgrade-to-Go-1.20.8.yaml
new file mode 100644
index 00000000000..211338b03db
--- /dev/null
+++ b/changelog/fragments/1694700200-Upgrade-to-Go-1.20.8.yaml
@@ -0,0 +1,32 @@
+# Kind can be one of:
+# - breaking-change: a change to previously-documented behavior
+# - deprecation: functionality that is being removed in a later release
+# - bug-fix: fixes a problem in a previous version
+# - enhancement: extends functionality but does not break or fix existing behavior
+# - feature: new functionality
+# - known-issue: problems that we are aware of in a given version
+# - security: impacts on the security of a product or a user’s deployment.
+# - upgrade: important information for someone upgrading from a prior version
+# - other: does not fit into any of the other categories
+kind: security
+
+# Change summary; a 80ish characters long description of the change.
+summary: Upgrade to Go 1.20.8.
+
+# Long description; in case the summary is not enough to describe the change
+# this field accommodate a description without length limits.
+# NOTE: This field will be rendered only for breaking-change and known-issue kinds at the moment.
+#description:
+
+# Affected component; usually one of "elastic-agent", "fleet-server", "filebeat", "metricbeat", "auditbeat", "all", etc.
+component: "elastic-agent"
+
+# PR URL; optional; the PR number that added the changeset.
+# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
+# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
+# Please provide it if you are adding a fragment for a different PR.
+pr: https://github.com/elastic/elastic-agent/pull/3393
+
+# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of).
+# If not present is automatically filled by the tooling with the issue linked to the PR number.
+#issue: https://github.com/owner/repo/1234
diff --git a/version/docs/version.asciidoc b/version/docs/version.asciidoc
index 7e516606949..39096065ec9 100644
--- a/version/docs/version.asciidoc
+++ b/version/docs/version.asciidoc
@@ -3,7 +3,7 @@
 // FIXME: once elastic.co docs have been switched over to use `main`, remove
 // the `doc-site-branch` line below as well as any references to it in the code.
 :doc-site-branch: master
-:go-version: 1.20.7
+:go-version: 1.20.8
 :release-state: unreleased
 :python: 3.7
 :docker: 1.12