diff --git a/WORKSPACE b/WORKSPACE
index bdd69c3899e5..ce8e0c8eda3f 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -169,15 +169,15 @@ load(
 go_download_sdk(
     name = "go_sdk",
     sdks = {
-        "darwin_amd64": ("go1.19.1.darwin-amd64.tar.gz", "96a164130f532c0ed65e437aaf9cc66b518f0b887d5830b2dc01ebfee9d58f52"),
-        "darwin_arm64": ("go1.19.1.darwin-arm64.tar.gz", "e46aecce83a9289be16ce4ba9b8478a5b89b8aa0230171d5c6adbc0c66640548"),
-        "freebsd_amd64": ("go1.19.1.freebsd-amd64.tar.gz", "db5b8f232e12c655cc6cde6af1adf4d27d842541807802d747c86161e89efa0a"),
-        "linux_amd64": ("go1.19.1.linux-amd64.tar.gz", "b8c00cd587c49beef8943887d52d77aeda66a30e94effbc1e6d39e1c80f01d37"),
-        "linux_arm64": ("go1.19.1.linux-arm64.tar.gz", "49d7c2badb24de8dd75e6c709d4f26d0b5e9509da2fa8c9d79929952b2607c55"),
-        "windows_amd64": ("go1.19.1.windows-amd64.tar.gz", "a507d42a457175a50695cf5df8efc64309dec5aa2ebf28d8d28bcd8317d6350c"),
+        "darwin_amd64": ("go1.19.4.darwin-amd64.tar.gz", "6fa1e9087b36fba65625869c885ca9c6f1db734306d8e74836b212248c20d55d"),
+        "darwin_arm64": ("go1.19.4.darwin-arm64.tar.gz", "bb3bc5d7655b9637cfe2b5e90055dee93b0ead50e2ffd091df320d1af1ca853f"),
+        "freebsd_amd64": ("go1.19.4.freebsd-amd64.tar.gz", "84489ebb63f1757b79574d7345c647bd40bc6414cecb868c93e24476c2d2b9b6"),
+        "linux_amd64": ("go1.19.4.linux-amd64.tar.gz", "e52774e4d6a0bb5bcc5a0f1d11e337929de826b40c99c408283b8854336d9dc4"),
+        "linux_arm64": ("go1.19.4.linux-arm64.tar.gz", "8bb193126fea46dca70658b7916b458a22fddb8e37d6deb463f14e10d6f06552"),
+        "windows_amd64": ("go1.19.4.windows-amd64.tar.gz", "ced538537d190c03e6e4bffb3b60049794d70f09af7900bd8419b44245b2b5dc"),
     },
-    urls = ["https://storage.googleapis.com/public-bazel-artifacts/go/20220907-175858/{}"],
-    version = "1.19.1",
+    urls = ["https://storage.googleapis.com/public-bazel-artifacts/go/20221219-000617/{}"],
+    version = "1.19.4",
 )
 
 # To point to a local SDK path, use the following instead. We'll call the
@@ -212,6 +212,7 @@ go_register_toolchains(nogo = "@com_github_cockroachdb_cockroach//:crdb_nogo")
 # bazel_skylib handled above.
 # rules_nodejs handled above.
 load("@build_bazel_rules_nodejs//:repositories.bzl", "build_bazel_rules_nodejs_dependencies")
+
 build_bazel_rules_nodejs_dependencies()
 
 # Configure nodeJS.
@@ -244,6 +245,7 @@ yarn_repositories(
 )
 
 load("//build/bazelutil:seed_yarn_cache.bzl", "seed_yarn_cache")
+
 seed_yarn_cache(name = "yarn_cache")
 
 # Install external dependencies for NPM packages in pkg/ui/ as separate bazel
@@ -258,13 +260,13 @@ yarn_install(
         "--ignore-optional",
     ],
     data = [
-      "//pkg/ui:.yarnrc",
-      "@yarn_cache//:.seed",
+        "//pkg/ui:.yarnrc",
+        "@yarn_cache//:.seed",
     ],
     package_json = "//pkg/ui/workspaces/eslint-plugin-crdb:package.json",
     strict_visibility = False,
-    yarn_lock = "//pkg/ui/workspaces/eslint-plugin-crdb:yarn.lock",
     symlink_node_modules = True,
+    yarn_lock = "//pkg/ui/workspaces/eslint-plugin-crdb:yarn.lock",
 )
 
 yarn_install(
@@ -273,13 +275,9 @@ yarn_install(
         "--offline",
     ],
     data = [
-      "//pkg/ui:.yarnrc",
-      "@yarn_cache//:.seed",
+        "//pkg/ui:.yarnrc",
+        "@yarn_cache//:.seed",
     ],
-    package_json = "//pkg/ui/workspaces/e2e-tests:package.json",
-    strict_visibility = False,
-    yarn_lock = "//pkg/ui/workspaces/e2e-tests:yarn.lock",
-    symlink_node_modules = True,
     environment = {
         # Don't automatically install the native Cypress binary, since not all
         # platforms that build CRDB have Cypress binaries to install:
@@ -290,7 +288,11 @@ yarn_install(
         # point, UI end-to-end tests aren't part of the core build or test
         # flows and are intended for regression testing by CRDB developers.
         "CYPRESS_INSTALL_BINARY": "0",
-    }
+    },
+    package_json = "//pkg/ui/workspaces/e2e-tests:package.json",
+    strict_visibility = False,
+    symlink_node_modules = True,
+    yarn_lock = "//pkg/ui/workspaces/e2e-tests:yarn.lock",
 )
 
 yarn_install(
@@ -300,11 +302,11 @@ yarn_install(
         "--ignore-optional",
     ],
     data = [
-      "//pkg/ui:.yarnrc",
-      "@yarn_cache//:.seed",
+        "//pkg/ui:.yarnrc",
+        "@yarn_cache//:.seed",
     ],
-    package_path = "/",
     package_json = "//pkg/ui/workspaces/db-console/src/js:package.json",
+    package_path = "/",
     strict_visibility = False,
     yarn_lock = "//pkg/ui/workspaces/db-console/src/js:yarn.lock",
 )
@@ -316,13 +318,13 @@ yarn_install(
         "--ignore-optional",
     ],
     data = [
-      "//pkg/ui:.yarnrc",
-      "@yarn_cache//:.seed",
+        "//pkg/ui:.yarnrc",
+        "@yarn_cache//:.seed",
     ],
     package_json = "//pkg/ui/workspaces/db-console:package.json",
-    yarn_lock = "//pkg/ui/workspaces/db-console:yarn.lock",
     strict_visibility = False,
     symlink_node_modules = True,
+    yarn_lock = "//pkg/ui/workspaces/db-console:yarn.lock",
 )
 
 yarn_install(
@@ -333,13 +335,13 @@ yarn_install(
         "--ignore-optional",
     ],
     data = [
-      "//pkg/ui:.yarnrc",
-      "@yarn_cache//:.seed",
+        "//pkg/ui:.yarnrc",
+        "@yarn_cache//:.seed",
     ],
     package_json = "//pkg/ui/workspaces/cluster-ui:package.json",
     strict_visibility = False,
-    yarn_lock = "//pkg/ui/workspaces/cluster-ui:yarn.lock",
     symlink_node_modules = True,
+    yarn_lock = "//pkg/ui/workspaces/cluster-ui:yarn.lock",
 )
 
 #################################
@@ -557,29 +559,33 @@ rules_foreign_cc_dependencies(
 ################################
 
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
 http_archive(
     name = "rules_pkg",
+    sha256 = "8a298e832762eda1830597d64fe7db58178aa84cd5926d76d5b744d6558941c2",
     urls = [
         "https://storage.googleapis.com/public-bazel-artifacts/bazel/rules_pkg-0.7.0.tar.gz",
     ],
-    sha256 = "8a298e832762eda1830597d64fe7db58178aa84cd5926d76d5b744d6558941c2",
 )
 # Ref: https://github.com/bazelbuild/rules_pkg/blob/main/pkg/deps.bzl
 
 # bazel_skylib handled above.
 http_archive(
     name = "rules_python",
-    urls = ["https://storage.googleapis.com/public-bazel-artifacts/bazel/rules_python-0.1.0.tar.gz"],
     sha256 = "b6d46438523a3ec0f3cead544190ee13223a52f6a6765a29eae7b7cc24cc83a0",
+    urls = ["https://storage.googleapis.com/public-bazel-artifacts/bazel/rules_python-0.1.0.tar.gz"],
 )
+
 http_archive(
     name = "rules_license",
+    sha256 = "4865059254da674e3d18ab242e21c17f7e3e8c6b1f1421fffa4c5070f82e98b5",
     urls = [
         "https://storage.googleapis.com/public-bazel-artifacts/bazel/rules_license-0.0.1.tar.gz",
     ],
-    sha256 = "4865059254da674e3d18ab242e21c17f7e3e8c6b1f1421fffa4c5070f82e98b5",
 )
+
 load("@rules_pkg//pkg:deps.bzl", "rules_pkg_dependencies")
+
 rules_pkg_dependencies()
 
 ##############################
@@ -641,11 +647,12 @@ http_archive(
 )
 
 load("//build/bazelutil:repositories.bzl", "distdir_repositories")
+
 distdir_repositories()
 
 # This is used only by rules_nodejs to find the local version of node.
 new_local_repository(
     name = "nodejs_freebsd_amd64",
-    path = "/usr/local",
     build_file_content = """exports_files[("bin/node")]""",
+    path = "/usr/local",
 )
diff --git a/build/bazelutil/distdir_files.bzl b/build/bazelutil/distdir_files.bzl
index 11f49609de58..59f26a7d06cb 100644
--- a/build/bazelutil/distdir_files.bzl
+++ b/build/bazelutil/distdir_files.bzl
@@ -1024,12 +1024,12 @@ DISTDIR_FILES = {
     "https://storage.googleapis.com/public-bazel-artifacts/c-deps/20220708-170245/libproj_foreign.macos.20220708-170245.tar.gz": "fd342ce3e99d9df6de8fcdf09ff9735887d7025d88ba9814b4c73cff24691b26",
     "https://storage.googleapis.com/public-bazel-artifacts/c-deps/20220708-170245/libproj_foreign.macosarm.20220708-170245.tar.gz": "6394f40dbc799909ee239e42c25d08b5b2af0ad0c8aa30f37553e936f1c1dc4e",
     "https://storage.googleapis.com/public-bazel-artifacts/c-deps/20220708-170245/libproj_foreign.windows.20220708-170245.tar.gz": "233c6cecef5e826bd1aea7c7c603fb86fc78299d2016c4d3afcb0c1509eff001",
-    "https://storage.googleapis.com/public-bazel-artifacts/go/20220907-175858/go1.19.1.darwin-amd64.tar.gz": "96a164130f532c0ed65e437aaf9cc66b518f0b887d5830b2dc01ebfee9d58f52",
-    "https://storage.googleapis.com/public-bazel-artifacts/go/20220907-175858/go1.19.1.darwin-arm64.tar.gz": "e46aecce83a9289be16ce4ba9b8478a5b89b8aa0230171d5c6adbc0c66640548",
-    "https://storage.googleapis.com/public-bazel-artifacts/go/20220907-175858/go1.19.1.freebsd-amd64.tar.gz": "db5b8f232e12c655cc6cde6af1adf4d27d842541807802d747c86161e89efa0a",
-    "https://storage.googleapis.com/public-bazel-artifacts/go/20220907-175858/go1.19.1.linux-amd64.tar.gz": "b8c00cd587c49beef8943887d52d77aeda66a30e94effbc1e6d39e1c80f01d37",
-    "https://storage.googleapis.com/public-bazel-artifacts/go/20220907-175858/go1.19.1.linux-arm64.tar.gz": "49d7c2badb24de8dd75e6c709d4f26d0b5e9509da2fa8c9d79929952b2607c55",
-    "https://storage.googleapis.com/public-bazel-artifacts/go/20220907-175858/go1.19.1.windows-amd64.tar.gz": "a507d42a457175a50695cf5df8efc64309dec5aa2ebf28d8d28bcd8317d6350c",
+    "https://storage.googleapis.com/public-bazel-artifacts/go/20221219-000617/go1.19.4.darwin-amd64.tar.gz": "6fa1e9087b36fba65625869c885ca9c6f1db734306d8e74836b212248c20d55d",
+    "https://storage.googleapis.com/public-bazel-artifacts/go/20221219-000617/go1.19.4.darwin-arm64.tar.gz": "bb3bc5d7655b9637cfe2b5e90055dee93b0ead50e2ffd091df320d1af1ca853f",
+    "https://storage.googleapis.com/public-bazel-artifacts/go/20221219-000617/go1.19.4.freebsd-amd64.tar.gz": "84489ebb63f1757b79574d7345c647bd40bc6414cecb868c93e24476c2d2b9b6",
+    "https://storage.googleapis.com/public-bazel-artifacts/go/20221219-000617/go1.19.4.linux-amd64.tar.gz": "e52774e4d6a0bb5bcc5a0f1d11e337929de826b40c99c408283b8854336d9dc4",
+    "https://storage.googleapis.com/public-bazel-artifacts/go/20221219-000617/go1.19.4.linux-arm64.tar.gz": "8bb193126fea46dca70658b7916b458a22fddb8e37d6deb463f14e10d6f06552",
+    "https://storage.googleapis.com/public-bazel-artifacts/go/20221219-000617/go1.19.4.windows-amd64.tar.gz": "ced538537d190c03e6e4bffb3b60049794d70f09af7900bd8419b44245b2b5dc",
     "https://storage.googleapis.com/public-bazel-artifacts/gomod/github.com/bazelbuild/buildtools/v0.0.0-20200718160251-b1667ff58f71/buildtools-v0.0.0-20200718160251-b1667ff58f71.tar.gz": "a9ef5103739dfb5ed2a5b47ab1654842a89695812e4af09e57d7015a5caf97e0",
     "https://storage.googleapis.com/public-bazel-artifacts/java/railroad/rr-1.63-java8.zip": "d2791cd7a44ea5be862f33f5a9b3d40aaad9858455828ebade7007ad7113fb41",
     "https://storage.googleapis.com/public-bazel-artifacts/js/node/v16.13.0/node-v16.13.0-darwin-arm64.tar.gz": "46d83fc0bd971db5050ef1b15afc44a6665dee40bd6c1cbaec23e1b40fa49e6d",
diff --git a/build/bootstrap/bootstrap-debian.sh b/build/bootstrap/bootstrap-debian.sh
index af5b2cb86fa8..0469424d6266 100755
--- a/build/bootstrap/bootstrap-debian.sh
+++ b/build/bootstrap/bootstrap-debian.sh
@@ -46,9 +46,9 @@ sudo tar -C /usr --strip-components=1 -zxf /tmp/cmake.tgz && rm /tmp/cmake.tgz
 
 # Install Go.
 trap 'rm -f /tmp/go.tgz' EXIT
-curl -fsSL https://dl.google.com/go/go1.19.1.linux-amd64.tar.gz > /tmp/go.tgz
+curl -fsSL https://dl.google.com/go/go1.19.4.linux-amd64.tar.gz > /tmp/go.tgz
 sha256sum -c - <<EOF
-acc512fbab4f716a8f97a8b3fbaa9ddd39606a28be6c2515ef7c6c6311acffde  /tmp/go.tgz
+3ca65ff0606054b076c009d3bb3b8aba0032b75ac690de716be5c44ce57da052  /tmp/go.tgz
 EOF
 sudo tar -C /usr/local -zxf /tmp/go.tgz && rm /tmp/go.tgz
 
diff --git a/build/builder.sh b/build/builder.sh
index 63125074999b..f81788f969de 100755
--- a/build/builder.sh
+++ b/build/builder.sh
@@ -3,7 +3,7 @@
 set -euo pipefail
 
 image=cockroachdb/builder
-version=20220907-174613
+version=20221219-170552
 
 function init() {
   docker build --tag="${image}" "$(dirname "${0}")/builder"
diff --git a/build/builder/Dockerfile b/build/builder/Dockerfile
index 462347f0d0d8..d45a75e4aa70 100644
--- a/build/builder/Dockerfile
+++ b/build/builder/Dockerfile
@@ -114,8 +114,8 @@ RUN curl -fsSL https://github.com/Kitware/CMake/releases/download/v3.20.3/cmake-
 # releases of Go will no longer be run in CI once it is changed. Consider
 # bumping the minimum allowed version of Go in /build/go-version-check.sh.
 RUN DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends golang \
- && curl -fsSL https://storage.googleapis.com/golang/go1.19.1.src.tar.gz -o golang.tar.gz \
- && echo '27871baa490f3401414ad793fba49086f6c855b1c584385ed7771e1204c7e179  golang.tar.gz' | sha256sum -c - \
+ && curl -fsSL https://storage.googleapis.com/golang/go1.19.4.src.tar.gz -o golang.tar.gz \
+ && echo 'eda74db4ac494800a3e66ee784e495bfbb9b8e535df924a8b01b1a8028b7f368  golang.tar.gz' | sha256sum -c - \
  && tar -C /usr/local -xzf golang.tar.gz \
  && rm golang.tar.gz \
  && cd /usr/local/go/src \
diff --git a/build/packer/teamcity-agent.sh b/build/packer/teamcity-agent.sh
index 68841c210b75..1671e5a7aa41 100644
--- a/build/packer/teamcity-agent.sh
+++ b/build/packer/teamcity-agent.sh
@@ -67,9 +67,9 @@ tar --strip-components=1 -C /usr -xzf /tmp/cmake.tar.gz
 rm -f /tmp/cmake.tar.gz
 
 if [ $ARCH = x86_64 ]; then
-    curl -fsSL https://dl.google.com/go/go1.19.1.linux-amd64.tar.gz > /tmp/go.tgz
+    curl -fsSL https://dl.google.com/go/go1.19.4.linux-amd64.tar.gz > /tmp/go.tgz
     sha256sum -c - <<EOF
-acc512fbab4f716a8f97a8b3fbaa9ddd39606a28be6c2515ef7c6c6311acffde  /tmp/go.tgz
+3ca65ff0606054b076c009d3bb3b8aba0032b75ac690de716be5c44ce57da052  /tmp/go.tgz
 EOF
     tar -C /usr/local -zxf /tmp/go.tgz && rm /tmp/go.tgz
 
diff --git a/build/teamcity/internal/release/build-and-publish-patched-go/impl.sh b/build/teamcity/internal/release/build-and-publish-patched-go/impl.sh
index f69f9467f646..a31fbaeafaea 100755
--- a/build/teamcity/internal/release/build-and-publish-patched-go/impl.sh
+++ b/build/teamcity/internal/release/build-and-publish-patched-go/impl.sh
@@ -3,15 +3,15 @@
 set -xeuo pipefail
 
 # When updating to a new Go version, update all of these variables.
-GOVERS=1.19.1
+GOVERS=1.19.4
 GOLINK=https://go.dev/dl/go$GOVERS.src.tar.gz
-SRCSHASUM=27871baa490f3401414ad793fba49086f6c855b1c584385ed7771e1204c7e179
+SRCSHASUM=eda74db4ac494800a3e66ee784e495bfbb9b8e535df924a8b01b1a8028b7f368
 # We mirror the upstream freebsd because we don't have a cross-compiler targeting it.
 GOFREEBSDLINK=https://go.dev/dl/go$GOVERS.freebsd-amd64.tar.gz
-FREEBSDSHASUM=db5b8f232e12c655cc6cde6af1adf4d27d842541807802d747c86161e89efa0a
+FREEBSDSHASUM=84489ebb63f1757b79574d7345c647bd40bc6414cecb868c93e24476c2d2b9b6
 # We mirror the upstream darwin/arm64 binary because we don't have code-signing yet.
 GODARWINARMLINK=https://go.dev/dl/go$GOVERS.darwin-arm64.tar.gz
-DARWINARMSHASUM=e46aecce83a9289be16ce4ba9b8478a5b89b8aa0230171d5c6adbc0c66640548
+DARWINARMSHASUM=bb3bc5d7655b9637cfe2b5e90055dee93b0ead50e2ffd091df320d1af1ca853f
 
 apt-get update
 DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
diff --git a/pkg/cmd/roachtest/tests/go_helpers.go b/pkg/cmd/roachtest/tests/go_helpers.go
index f45b2a85c8fa..f4cae8851339 100644
--- a/pkg/cmd/roachtest/tests/go_helpers.go
+++ b/pkg/cmd/roachtest/tests/go_helpers.go
@@ -43,13 +43,13 @@ func installGolang(
 	}
 
 	if err := repeatRunE(
-		ctx, t, c, node, "download go", `curl -fsSL https://dl.google.com/go/go1.19.1.linux-amd64.tar.gz > /tmp/go.tgz`,
+		ctx, t, c, node, "download go", `curl -fsSL https://dl.google.com/go/go1.19.4.linux-amd64.tar.gz > /tmp/go.tgz`,
 	); err != nil {
 		t.Fatal(err)
 	}
 	if err := repeatRunE(
 		ctx, t, c, node, "verify tarball", `sha256sum -c - <<EOF
-acc512fbab4f716a8f97a8b3fbaa9ddd39606a28be6c2515ef7c6c6311acffde /tmp/go.tgz
+3ca65ff0606054b076c009d3bb3b8aba0032b75ac690de716be5c44ce57da052 /tmp/go.tgz
 EOF`,
 	); err != nil {
 		t.Fatal(err)