diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 87acfe44..fca27557 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -16,8 +16,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v5
       with:
-        go-version: 1.22.7
-        check-latest: true
+        go-version: 1.23.0
       id: go
     - name: Check out code
       uses: actions/checkout@v4
@@ -34,7 +33,7 @@ jobs:
       - name: "Set up Go"
         uses: actions/setup-go@v5
         with:
-          go-version: 1.22.7
+          go-version: 1.23.0
         id: go
       - name: Check out code
         uses: actions/checkout@v4
@@ -54,8 +53,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v5
       with:
-        go-version: 1.22.7
-        check-latest: true
+        go-version: 1.23.0
       id: go
     - name: Check out code
       uses: actions/checkout@v4
@@ -70,7 +68,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        go-version: [1.22.7, 1.23.1]
+        go-version: 1.23.0
     steps:
     - name: Set up Go ${{ matrix.go-version }}
       uses: actions/setup-go@v5
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index acd9ede5..51855bfe 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,8 +20,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.22.7
-          check-latest: true
+          go-version: 1.22.0
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v1
       - name: Set up Docker Buildx
diff --git a/go.mod b/go.mod
index 427047ed..f095d74d 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,8 @@ module github.com/minio/kes
 
 go 1.21
 
+toolchain go1.23.5
+
 require (
 	aead.dev/mem v0.2.0
 	aead.dev/minisign v0.2.1
diff --git a/internal/keystore/vault/client.go b/internal/keystore/vault/client.go
index 9df392da..6034117a 100644
--- a/internal/keystore/vault/client.go
+++ b/internal/keystore/vault/client.go
@@ -7,6 +7,7 @@ package vault
 import (
 	"context"
 	"errors"
+	"net/http"
 	"os"
 	"path"
 	"strings"
@@ -195,8 +196,10 @@ func (c *client) RenewToken(ctx context.Context, authenticate authFunc, secret *
 			continue
 		}
 
-		renewIn := 80 * (ttl / 100) // Renew token after 80% of its TTL has passed
-		ttl = 0                     // Set TTL to zero to trigger an immediate re-authentication in case of auth failure
+		renewIn := 80 * (ttl / 100)          // Renew token after 80% of its TTL has passed
+		delay := min((ttl-renewIn)/2, Delay) // Delay usage of renewed token but not beyond expiry
+		ttl = 0
+
 		select {
 		case <-ctx.Done():
 			return
@@ -210,6 +213,9 @@ func (c *client) RenewToken(ctx context.Context, authenticate authFunc, secret *
 					if err == nil {
 						break
 					}
+					if resp, ok := err.(*vaultapi.ResponseError); ok && http.StatusBadRequest <= resp.StatusCode && resp.StatusCode < http.StatusInternalServerError {
+						break // Don't retry on 4xx responses
+					}
 				}
 				if s == nil {
 					s, _ = authenticate(ctx)
@@ -225,10 +231,12 @@ func (c *client) RenewToken(ctx context.Context, authenticate authFunc, secret *
 				// Wait before we use the new auth. token. This accounts
 				// for replication lag between the Vault nodes and allows
 				// them to sync the token across the entire cluster.
+				// However, we must not wait longer than the remaining lifetime
+				// of the currently used token.
 				select {
 				case <-ctx.Done():
 					return
-				case <-time.After(Delay):
+				case <-time.After(delay):
 				}
 				c.SetToken(token) // SetToken is safe to call from different go routines
 			}