diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 9d7b263b0a..cf70ec82b2 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -17,11 +17,7 @@ updates:
     - 1.10.0
   - dependency-name: google.golang.org/protobuf
     versions:
-    - 1.26.0
-  - dependency-name: github.com/golang/protobuf
-    versions:
-    - 1.5.1
-    - 1.5.2
+    - 1.28.0
   - dependency-name: github.com/golang/mock
     versions:
     - 1.5.0
diff --git a/client/configpb/multilog.pb.go b/client/configpb/multilog.pb.go
index 6390f42799..826b7253ea 100644
--- a/client/configpb/multilog.pb.go
+++ b/client/configpb/multilog.pb.go
@@ -14,16 +14,16 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
-// 	protoc        v3.12.4
+// 	protoc-gen-go v1.28.0
+// 	protoc        v3.20.1
 // source: client/configpb/multilog.proto
 
 package configpb
 
 import (
-	timestamp "github.com/golang/protobuf/ptypes/timestamp"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
 )
@@ -97,11 +97,11 @@ type LogShardConfig struct {
 	// not_after_start defines the start of the range of acceptable NotAfter
 	// values, inclusive.
 	// Leaving this unset implies no lower bound to the range.
-	NotAfterStart *timestamp.Timestamp `protobuf:"bytes,3,opt,name=not_after_start,json=notAfterStart,proto3" json:"not_after_start,omitempty"`
+	NotAfterStart *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=not_after_start,json=notAfterStart,proto3" json:"not_after_start,omitempty"`
 	// not_after_limit defines the end of the range of acceptable NotAfter values,
 	// exclusive.
 	// Leaving this unset implies no upper bound to the range.
-	NotAfterLimit *timestamp.Timestamp `protobuf:"bytes,4,opt,name=not_after_limit,json=notAfterLimit,proto3" json:"not_after_limit,omitempty"`
+	NotAfterLimit *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=not_after_limit,json=notAfterLimit,proto3" json:"not_after_limit,omitempty"`
 }
 
 func (x *LogShardConfig) Reset() {
@@ -150,14 +150,14 @@ func (x *LogShardConfig) GetPublicKeyDer() []byte {
 	return nil
 }
 
-func (x *LogShardConfig) GetNotAfterStart() *timestamp.Timestamp {
+func (x *LogShardConfig) GetNotAfterStart() *timestamppb.Timestamp {
 	if x != nil {
 		return x.NotAfterStart
 	}
 	return nil
 }
 
-func (x *LogShardConfig) GetNotAfterLimit() *timestamp.Timestamp {
+func (x *LogShardConfig) GetNotAfterLimit() *timestamppb.Timestamp {
 	if x != nil {
 		return x.NotAfterLimit
 	}
@@ -211,9 +211,9 @@ func file_client_configpb_multilog_proto_rawDescGZIP() []byte {
 
 var file_client_configpb_multilog_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
 var file_client_configpb_multilog_proto_goTypes = []interface{}{
-	(*TemporalLogConfig)(nil),   // 0: configpb.TemporalLogConfig
-	(*LogShardConfig)(nil),      // 1: configpb.LogShardConfig
-	(*timestamp.Timestamp)(nil), // 2: google.protobuf.Timestamp
+	(*TemporalLogConfig)(nil),     // 0: configpb.TemporalLogConfig
+	(*LogShardConfig)(nil),        // 1: configpb.LogShardConfig
+	(*timestamppb.Timestamp)(nil), // 2: google.protobuf.Timestamp
 }
 var file_client_configpb_multilog_proto_depIdxs = []int32{
 	1, // 0: configpb.TemporalLogConfig.shard:type_name -> configpb.LogShardConfig
diff --git a/go.mod b/go.mod
index 960898b80a..d7fb2f988c 100644
--- a/go.mod
+++ b/go.mod
@@ -7,7 +7,6 @@ require (
 	github.com/fullstorydev/grpcurl v1.8.6
 	github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b
 	github.com/golang/mock v1.6.0
-	github.com/golang/protobuf v1.5.2
 	github.com/google/go-cmp v0.5.8
 	github.com/google/trillian v1.4.1-0.20220503161811-32257c5c3ca0
 	github.com/gorilla/mux v1.8.0
diff --git a/integration/Dockerfile b/integration/Dockerfile
index 9bd008197f..8ddf49b54f 100644
--- a/integration/Dockerfile
+++ b/integration/Dockerfile
@@ -14,7 +14,7 @@ RUN cd /usr/bin && curl -L -O https://github.com/stedolan/jq/releases/download/j
 RUN curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $(go env GOPATH)/bin v1.18.0
 RUN mkdir protoc && \
     (cd protoc && \
-    PROTOC_VERSION=3.12.4 && \
+    PROTOC_VERSION=3.20.1 && \
     PROTOC_ZIP="protoc-${PROTOC_VERSION}-linux-x86_64.zip" && \
     wget "https://github.com/google/protobuf/releases/download/v${PROTOC_VERSION}/${PROTOC_ZIP}" && \
     unzip -o ${PROTOC_ZIP} -d /usr/local bin/protoc && \
diff --git a/trillian/ctfe/configpb/config.pb.go b/trillian/ctfe/configpb/config.pb.go
index ef47f3fb18..76044ec934 100644
--- a/trillian/ctfe/configpb/config.pb.go
+++ b/trillian/ctfe/configpb/config.pb.go
@@ -14,18 +14,18 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
-// 	protoc        v3.12.4
+// 	protoc-gen-go v1.28.0
+// 	protoc        v3.20.1
 // source: trillian/ctfe/configpb/config.proto
 
 package configpb
 
 import (
-	any "github.com/golang/protobuf/ptypes/any"
-	timestamp "github.com/golang/protobuf/ptypes/timestamp"
 	keyspb "github.com/google/trillian/crypto/keyspb"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	anypb "google.golang.org/protobuf/types/known/anypb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
 )
@@ -224,7 +224,7 @@ type LogConfig struct {
 	// log. The certs are served through get-roots endpoint. Optional in mirrors.
 	RootsPemFile []string `protobuf:"bytes,3,rep,name=roots_pem_file,json=rootsPemFile,proto3" json:"roots_pem_file,omitempty"`
 	// The private key used for signing STHs etc. Not required for mirrors.
-	PrivateKey *any.Any `protobuf:"bytes,4,opt,name=private_key,json=privateKey,proto3" json:"private_key,omitempty"`
+	PrivateKey *anypb.Any `protobuf:"bytes,4,opt,name=private_key,json=privateKey,proto3" json:"private_key,omitempty"`
 	// The public key matching the above private key (if both are present). It is
 	// used only by mirror logs for verifying the source log's signatures, but can
 	// be specified for regular logs as well for the convenience of test tools.
@@ -243,11 +243,11 @@ type LogConfig struct {
 	// not_after_start defines the start of the range of acceptable NotAfter
 	// values, inclusive.
 	// Leaving this unset implies no lower bound to the range.
-	NotAfterStart *timestamp.Timestamp `protobuf:"bytes,8,opt,name=not_after_start,json=notAfterStart,proto3" json:"not_after_start,omitempty"`
+	NotAfterStart *timestamppb.Timestamp `protobuf:"bytes,8,opt,name=not_after_start,json=notAfterStart,proto3" json:"not_after_start,omitempty"`
 	// not_after_limit defines the end of the range of acceptable NotAfter values,
 	// exclusive.
 	// Leaving this unset implies no upper bound to the range.
-	NotAfterLimit *timestamp.Timestamp `protobuf:"bytes,9,opt,name=not_after_limit,json=notAfterLimit,proto3" json:"not_after_limit,omitempty"`
+	NotAfterLimit *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=not_after_limit,json=notAfterLimit,proto3" json:"not_after_limit,omitempty"`
 	// accept_only_ca controls whether or not *only* certificates with the CA bit
 	// set will be accepted.
 	AcceptOnlyCa bool `protobuf:"varint,10,opt,name=accept_only_ca,json=acceptOnlyCa,proto3" json:"accept_only_ca,omitempty"`
@@ -342,7 +342,7 @@ func (x *LogConfig) GetRootsPemFile() []string {
 	return nil
 }
 
-func (x *LogConfig) GetPrivateKey() *any.Any {
+func (x *LogConfig) GetPrivateKey() *anypb.Any {
 	if x != nil {
 		return x.PrivateKey
 	}
@@ -377,14 +377,14 @@ func (x *LogConfig) GetExtKeyUsages() []string {
 	return nil
 }
 
-func (x *LogConfig) GetNotAfterStart() *timestamp.Timestamp {
+func (x *LogConfig) GetNotAfterStart() *timestamppb.Timestamp {
 	if x != nil {
 		return x.NotAfterStart
 	}
 	return nil
 }
 
-func (x *LogConfig) GetNotAfterLimit() *timestamp.Timestamp {
+func (x *LogConfig) GetNotAfterLimit() *timestamppb.Timestamp {
 	if x != nil {
 		return x.NotAfterLimit
 	}
@@ -691,15 +691,15 @@ func file_trillian_ctfe_configpb_config_proto_rawDescGZIP() []byte {
 
 var file_trillian_ctfe_configpb_config_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
 var file_trillian_ctfe_configpb_config_proto_goTypes = []interface{}{
-	(*LogBackend)(nil),          // 0: configpb.LogBackend
-	(*LogBackendSet)(nil),       // 1: configpb.LogBackendSet
-	(*LogConfigSet)(nil),        // 2: configpb.LogConfigSet
-	(*LogConfig)(nil),           // 3: configpb.LogConfig
-	(*LogMultiConfig)(nil),      // 4: configpb.LogMultiConfig
-	(*SignedTreeHead)(nil),      // 5: configpb.SignedTreeHead
-	(*any.Any)(nil),             // 6: google.protobuf.Any
-	(*keyspb.PublicKey)(nil),    // 7: keyspb.PublicKey
-	(*timestamp.Timestamp)(nil), // 8: google.protobuf.Timestamp
+	(*LogBackend)(nil),            // 0: configpb.LogBackend
+	(*LogBackendSet)(nil),         // 1: configpb.LogBackendSet
+	(*LogConfigSet)(nil),          // 2: configpb.LogConfigSet
+	(*LogConfig)(nil),             // 3: configpb.LogConfig
+	(*LogMultiConfig)(nil),        // 4: configpb.LogMultiConfig
+	(*SignedTreeHead)(nil),        // 5: configpb.SignedTreeHead
+	(*anypb.Any)(nil),             // 6: google.protobuf.Any
+	(*keyspb.PublicKey)(nil),      // 7: keyspb.PublicKey
+	(*timestamppb.Timestamp)(nil), // 8: google.protobuf.Timestamp
 }
 var file_trillian_ctfe_configpb_config_proto_depIdxs = []int32{
 	0, // 0: configpb.LogBackendSet.backend:type_name -> configpb.LogBackend
diff --git a/trillian/migrillian/configpb/config.pb.go b/trillian/migrillian/configpb/config.pb.go
index c164aea479..26fab75d5a 100644
--- a/trillian/migrillian/configpb/config.pb.go
+++ b/trillian/migrillian/configpb/config.pb.go
@@ -14,8 +14,8 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
-// 	protoc        v3.12.4
+// 	protoc-gen-go v1.28.0
+// 	protoc        v3.20.1
 // source: trillian/migrillian/configpb/config.proto
 
 package configpb