diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1e135d1cd..ff36b802a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -58,6 +58,12 @@ jobs:
         with:
           cache: false
           go-version: 1.23.0
+      - name: Set common go env vars
+        run: |-
+          go env -w GOTOOLCHAIN=local
+
+          # Dump env for good measure
+          go env
       - name: Setup qemu
         uses: docker/setup-qemu-action@v3
       - name: Set up Docker Buildx
diff --git a/.github/workflows/trybot.yml b/.github/workflows/trybot.yml
index e6881ae64..3f73a35f4 100644
--- a/.github/workflows/trybot.yml
+++ b/.github/workflows/trybot.yml
@@ -71,6 +71,12 @@ jobs:
         with:
           cache: false
           go-version: ${{ matrix.go-version }}
+      - name: Set common go env vars
+        run: |-
+          go env -w GOTOOLCHAIN=local
+
+          # Dump env for good measure
+          go env
       - name: Get go mod cache directory
         id: go-mod-cache-dir
         run: echo "dir=$(go env GOMODCACHE)" >> ${GITHUB_OUTPUT}
diff --git a/internal/ci/base/github.cue b/internal/ci/base/github.cue
index d9f081a2a..f57d5f3c8 100644
--- a/internal/ci/base/github.cue
+++ b/internal/ci/base/github.cue
@@ -15,14 +15,32 @@ bashWorkflow: json.#Workflow & {
 	jobs: [string]: defaults: run: shell: "bash"
 }
 
-installGo: json.#step & {
-	name: "Install Go"
-	uses: "actions/setup-go@v5"
-	with: {
-		// We do our own caching in setupGoActionsCaches.
-		cache:        false
-		"go-version": string
+installGo: {
+	#setupGo: json.#step & {
+		name: "Install Go"
+		uses: "actions/setup-go@v5"
+		with: {
+			// We do our own caching in setupGoActionsCaches.
+			cache:        false
+			"go-version": string
+		}
 	}
+
+	[
+		#setupGo,
+
+		{
+			json.#step & {
+				name: "Set common go env vars"
+				run: """
+					go env -w GOTOOLCHAIN=local
+
+					# Dump env for good measure
+					go env
+					"""
+			}
+		},
+	]
 }
 
 checkoutCode: {
@@ -100,7 +118,7 @@ checkoutCode: {
 
 earlyChecks: json.#step & {
 	name: "Early git and code sanity checks"
-	run: "go run ./internal/ci/checks"
+	run:  "go run ./internal/ci/checks"
 }
 
 curlGitHubAPI: {
diff --git a/internal/ci/github/release.cue b/internal/ci/github/release.cue
index f4d701bd8..927d1b9e2 100644
--- a/internal/ci/github/release.cue
+++ b/internal/ci/github/release.cue
@@ -42,11 +42,14 @@ workflows: release: _repo.bashWorkflow & {
 	jobs: goreleaser: {
 		"runs-on": _repo.linuxMachine
 		if:        "${{github.repository == '\(_repo.githubRepositoryPath)'}}"
+
+		let installGo = _repo.installGo & {
+			#setupGo: with: "go-version": _repo.pinnedReleaseGo
+			_
+		}
 		steps: [
 			for v in _repo.checkoutCode {v},
-			_repo.installGo & {
-				with: "go-version": _repo.pinnedReleaseGo
-			},
+			for v in installGo {v},
 			json.#step & {
 				name: "Setup qemu"
 				uses: "docker/setup-qemu-action@v3"
diff --git a/internal/ci/github/trybot.cue b/internal/ci/github/trybot.cue
index 4f9ce1c8a..cf51a63bf 100644
--- a/internal/ci/github/trybot.cue
+++ b/internal/ci/github/trybot.cue
@@ -43,6 +43,11 @@ workflows: trybot: _repo.bashWorkflow & {
 				_
 			}
 
+			let installGo = _repo.installGo & {
+				#setupGo: with: "go-version": goVersionVal
+				_
+			}
+
 			// Only run the trybot workflow if we have the trybot trailer, or
 			// if we have no special trailers. Note this condition applies
 			// after and in addition to the "on" condition above.
@@ -51,9 +56,7 @@ workflows: trybot: _repo.bashWorkflow & {
 			steps: [
 				for v in _repo.checkoutCode {v},
 
-				_repo.installGo & {
-					with: "go-version": goVersionVal
-				},
+				for v in installGo {v},
 
 				// cachePre must come after installing Node and Go, because the cache locations
 				// are established by running each tool.