diff --git a/.go-version b/.go-version
index 3661bc037..19fb7bd9d 100644
--- a/.go-version
+++ b/.go-version
@@ -1 +1 @@
-1.17.7
+1.17.9
diff --git a/scripts/update_golang_version.sh b/scripts/update_golang_version.sh
index bd44a8075..d9b1e445c 100755
--- a/scripts/update_golang_version.sh
+++ b/scripts/update_golang_version.sh
@@ -1,24 +1,31 @@
-#!/bin/sh
+#!/usr/bin/env bash
+
+set -euo pipefail
 
 if [ -z "$1" ]; then
     echo "usage: $0 GO_VERSION"
-    echo ""
+    echo "(run in project directory)"
     echo "For example: $0 1.15.5"
     exit 1
 fi
 
 golang_version="$1"
 
-current_version=$(grep -o -E -e '/golang:[.0-9]+' .circleci/config.yml | head -n1 | cut -d: -f2)
+# read current version from canonical .go-version file
+current_version=$(cat .go-version)
 if [ -z "${current_version}" ]; then
     echo "unable to find current go version"
     exit 1
 fi
 echo "--> Replacing Go ${current_version} with Go ${golang_version} ..."
 
+# force the canonical .go-version file
+echo "${golang_version}" > .go-version
+
 # To support both GNU and BSD sed, the regex is looser than it needs to be.
 # Specifically, we use "* instead of "?, which relies on GNU extension without much loss of
 # correctness in practice.
+
 sed -i'' -e "s|/golang:[.0-9]*|/golang:${golang_version}|g" .circleci/config.yml
 sed -i'' -e "s|GOLANG_VERSION:[ \"]*[.0-9]*\"*|GOLANG_VERSION: ${golang_version}|g" \
 	.circleci/config.yml