diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index ff25c7cf7..81a5c472f 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -13,7 +13,7 @@ env:
   GO_VER: '1.21.x'
   PGG_VER: 'v1.31.0'
   PROTOC_VER: '24.3'
-  PYTHON_VER: '3.8'
+  PYTHON_VER: '3.9'
   TEST_TAG: protoc-gen-validate:${{ github.sha }}
 
 jobs:
diff --git a/Dockerfile b/Dockerfile
index 0f09f8cf8..6f73e3839 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,13 +12,12 @@ ENV INSTALL_DEPS \
   wget \
   maven \
   patch \
-  python3 \
-  python3-distutils \
-  python3-setuptools \
+  python3.9 \
+  python3-pip \
   apt-transport-https \
   curl \
   openjdk-8-jdk \
-  gnupg 
+  gnupg
 
 RUN apt update \
   && apt install -y -q --no-install-recommends ${INSTALL_DEPS} \
@@ -63,14 +62,13 @@ RUN go install github.com/bazelbuild/buildtools/buildozer@${BDR_VER} \
 
 # python must be on PATH for the execution of py_binary bazel targets, but
 # the distribution we installed doesn't provide this alias
-RUN ln -s /usr/bin/python3.8 /usr/bin/python
+RUN ln -s /usr/bin/python3.9 /usr/bin/python
 
 WORKDIR ${GOPATH}/src/github.com/envoyproxy/protoc-gen-validate
 
 # python tooling for linting and uploading to PyPI
 COPY requirements.txt .
-RUN python3.8 -m easy_install pip \
-  && python3.8 -m pip install -r requirements.txt
+RUN pip3 install -r requirements.txt
 
 COPY . .
 
diff --git a/Makefile b/Makefile
index b130e602f..42973913a 100644
--- a/Makefile
+++ b/Makefile
@@ -143,14 +143,14 @@ prepare-python-release:
 .PHONY: python-release
 python-release: prepare-python-release
 	rm -rf python/dist
-	python3.8 -m build --no-isolation --sdist python
-	# the below command should be identical to `python3.8 -m build --wheel`
+	python3.9 -m build --no-isolation --sdist python
+	# the below command should be identical to `python3.9 -m build --wheel`
 	# however that returns mysterious `error: could not create 'build': File exists`.
 	# setuptools copies source and data files to a temporary build directory,
 	# but why there's a collision or why setuptools stopped respecting the `build_lib` flag is unclear.
 	# As a workaround, we build a source distribution and then separately build a wheel from it.
-	python3.8 -m pip wheel --wheel-dir python/dist --no-deps python/dist/*
-	python3.8 -m twine upload --verbose --skip-existing --repository ${PYPI_REPO} --username "__token__" --password ${PGV_PYPI_TOKEN} python/dist/*
+	python3.9 -m pip wheel --wheel-dir python/dist --no-deps python/dist/*
+	python3.9 -m twine upload --verbose --skip-existing --repository ${PYPI_REPO} --username "__token__" --password ${PGV_PYPI_TOKEN} python/dist/*
 
 .PHONY: check-generated
 check-generated: ## run during CI; this checks that the checked-in generated code matches the generated version.
diff --git a/python/setup.cfg b/python/setup.cfg
index a35a464d4..314aa1abf 100644
--- a/python/setup.cfg
+++ b/python/setup.cfg
@@ -11,9 +11,6 @@ license_files = LICENSE
 classifiers =
     Programming Language :: Python :: 3
     Programming Language :: Python :: 3 :: Only
-    Programming Language :: Python :: 3.6
-    Programming Language :: Python :: 3.7
-    Programming Language :: Python :: 3.8
     Programming Language :: Python :: 3.9
     Programming Language :: Python :: 3.10
     Programming Language :: Python :: 3.11
@@ -27,7 +24,7 @@ install_requires =
     Jinja2>=2.11.1
     protobuf>=5.27.0
     astunparse>=1.6.3; python_version<"3.10"
-python_requires = >=3.6
+python_requires = >=3.9
 
 [options.data_files]
 data = validate.proto