diff --git a/modules/rosenthal/build-system/go-vendored.scm b/modules/rosenthal/build-system/go-vendored.scm
new file mode 100644
index 0000000..16f7a90
--- /dev/null
+++ b/modules/rosenthal/build-system/go-vendored.scm
@@ -0,0 +1,296 @@
+;;; SPDX-License-Identifier: GPL-3.0-or-later
+;;; Copyright © 2016 Petter <petter@mykolab.ch>
+;;; Copyright © 2017 Leo Famulari <leo@famulari.name>
+;;; Copyright © 2020 Jakub Kądziołka <kuba@kadziolka.net>
+;;; Copyright © 2021-2022 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2021, 2023 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2021 Sarah Morgensen <iskarian@mgsn.dev>
+;;; Copyright © 2024 Christina O'Donnell <cdo@mutix.org>
+;;; Copyright © 2024 Troy Figiel <troy@troyfigiel.com>
+;;; Copyright © 2024 Sharlatan Hellseher <sharlatanus@gmail.com>
+;;; Copyright © 2026 Hilton Chain <hako@ultrarare.space>
+
+(define-module (rosenthal build-system go-vendored)
+  #:use-module (guix utils)
+  #:use-module (guix gexp)
+  #:use-module (guix store)
+  #:use-module (guix monads)
+  #:use-module (guix search-paths)
+  #:use-module (guix build-system)
+  #:use-module (guix build-system gnu)
+  #:use-module (guix packages)
+  #:use-module (rosenthal utils download)
+  #:use-module (ice-9 match)
+  #:use-module (ice-9 regex)
+  #:use-module (srfi srfi-1)
+  #:use-module (srfi srfi-34)
+  #:use-module (srfi srfi-35)
+  #:export (%default-go-vendored-imported-modules
+            %default-go-vendored-modules
+            go-vendored-build-system))
+
+;; Commentary:
+;;
+;; Standard build procedure for packages using the Go build system.  It is
+;; implemented as an extension of 'gnu-build-system'.
+;;
+;; Code:
+
+(define (go-target target)
+  ;; Parse the nix-system equivalent of the target and set the
+  ;; target for compilation accordingly.
+  (match (string-split (gnu-triplet->nix-system target) #\-)
+    ((arch os)
+     (list (match arch
+             ("aarch64" "arm64")
+             ("armhf" "arm")
+             ("powerpc64le" "ppc64le")
+             ("powerpc64" "ppc64")
+             ("i686" "386")
+             ("x86_64" "amd64")
+             ("mips64el" "mips64le")
+             ("loongarch64" "loong64")
+             (_ arch))
+           (match os
+             ((or "mingw32" "cygwin") "windows")
+             ("gnu" "hurd")
+             (_ os))))
+    (_
+     (raise
+      (condition
+       (&unsupported-cross-compilation-target-error
+        (build-system go-vendored-build-system)
+        (target target)))))))
+
+(define %default-go-vendored-imported-modules
+  ;; Build-side modules imported and used by default.
+  `(,@%default-gnu-imported-modules
+    (guix build union)
+    (guix build go-build-system)
+    (rosenthal build go-vendored-build-system)))
+
+(define %default-go-vendored-modules
+  '((guix build union)
+    (guix build utils)
+    (rosenthal build go-vendored-build-system)))
+
+(define (default-go)
+  (@* (gnu packages golang) go))
+
+(define (default-gccgo)
+  (@* (gnu packages gcc) gccgo-15))
+
+(define (make-go-std)
+  (@* (gnu packages golang) make-go-std))
+
+(define* (lower name
+                #:key source inputs native-inputs outputs system target
+                (go (if (supported-package? (default-go))
+                        (default-go)
+                        (default-gccgo)))
+                vendor-hash
+                #:allow-other-keys
+                #:rest arguments)
+  "Return a bag for NAME."
+  (define private-keywords
+    '(#:target #:go #:vendor-hash #:inputs #:native-inputs))
+
+  (define inputs-with-cache
+    ;; XXX: Avoid a circular dependency.  This should be rewritten with
+    ;; 'package-mapping' or similar.
+    (let ((go-std-name (string-append (package-name go) "-std")))
+      (if (string-prefix? go-std-name name)
+          inputs
+          (cons `(,go-std-name ,((make-go-std) go)) inputs))))
+
+  (bag
+    (name name)
+    (system system)
+    (target target)
+    (build-inputs `(,@(if source
+                          `(("source" ,source))
+                          '())
+                    ,@(if (and source vendor-hash)
+                          `(("vendored-go-dependencies"
+                             ,(origin
+                                (method (go-mod-vendor #:go go))
+                                (uri source)
+                                (sha256 vendor-hash))))
+                          '())
+                    ,@native-inputs
+                    ,@`(("go" ,go))
+                    ,@(if target '() inputs-with-cache)
+                    ,@(if target
+                          ;; Use the standard cross inputs of
+                          ;; 'gnu-build-system'.
+                          (standard-cross-packages target 'host)
+                          '())
+                    ;; Keep the standard inputs of 'gnu-build-system'.
+                    ,@(standard-packages)))
+    (host-inputs (if target inputs-with-cache '()))
+
+    ;; The cross-libc is really a target package, but for bootstrapping
+    ;; reasons, we can't put it in 'host-inputs'.  Namely, 'cross-gcc' is a
+    ;; native package, so it would end up using a "native" variant of
+    ;; 'cross-libc' (built with 'gnu-build'), whereas all the other packages
+    ;; would use a target variant (built with 'gnu-cross-build'.)
+    (target-inputs (if target
+                       (standard-cross-packages target 'target)
+                       '()))
+
+    (outputs outputs)
+    (build (if target go-vendored-cross-build go-vendored-build))
+    (arguments (strip-keyword-arguments private-keywords arguments))))
+
+(define* (go-vendored-build name inputs
+                            #:key
+                            source
+                            (phases '%standard-phases)
+                            (outputs '("out"))
+                            (search-paths '())
+                            (install-source? #t)
+                            (embed-files ''())
+                            (import-path ".")
+                            (unpack-path "")
+                            (build-flags ''())
+                            (skip-build? #f)
+                            (tests? #t)
+                            (test-flags ''())
+                            (test-subdirs ''("..."))
+                            (parallel-build? #t)
+                            (parallel-tests? #t)
+                            (allow-go-reference? #f)
+                            (system (%current-system))
+                            (goarch #f)
+                            (goos #f)
+                            (guile #f)
+                            (imported-modules %default-go-vendored-imported-modules)
+                            (modules %default-go-vendored-modules)
+                            (substitutable? #t))
+  (define builder
+    (with-imported-modules imported-modules
+      #~(begin
+          (use-modules #$@modules)
+          (go-vendored-build #:name #$name
+                             #:source #+source
+                             #:system #$system
+                             #:phases #$phases
+                             #:outputs #$(outputs->gexp outputs)
+                             #:goarch #$goarch
+                             #:goos #$goos
+                             #:embed-files #$embed-files
+                             #:search-paths '#$(sexp->gexp
+                                                (map search-path-specification->sexp
+                                                     search-paths))
+                             #:install-source? #$install-source?
+                             #:import-path #$import-path
+                             #:unpack-path #$unpack-path
+                             #:build-flags #$build-flags
+                             #:skip-build? #$skip-build?
+                             #:tests? #$tests?
+                             #:test-flags #$test-flags
+                             #:test-subdirs #$test-subdirs
+                             #:parallel-build? #$parallel-build?
+                             #:parallel-tests? #$parallel-tests?
+                             #:allow-go-reference? #$allow-go-reference?
+                             #:inputs #$(input-tuples->gexp inputs)))))
+
+  (mlet %store-monad ((guile (package->derivation (or guile (default-guile))
+                                                  system #:graft? #f)))
+    (gexp->derivation name builder
+                      #:system system
+                      #:graft? #f
+                      #:substitutable? substitutable?
+                      #:guile-for-build guile)))
+
+(define* (go-vendored-cross-build name
+                                  #:key
+                                  source target
+                                  build-inputs target-inputs host-inputs
+                                  (phases '%standard-phases)
+                                  (outputs '("out"))
+                                  (search-paths '())
+                                  (native-search-paths '())
+                                  (install-source? #t)
+                                  (import-path ".")
+                                  (unpack-path "")
+                                  (build-flags ''())
+                                  (skip-build? #f)
+                                  (tests? #f)              ; nothing can be done
+                                  (test-flags ''())
+                                  (test-subdirs ''("..."))
+                                  (parallel-build? #t)
+                                  (parallel-tests? #t)
+                                  (allow-go-reference? #f)
+                                  (system (%current-system))
+                                  (goarch (first (go-target target)))
+                                  (goos (last (go-target target)))
+                                  (embed-files ''())
+                                  (guile #f)
+                                  (imported-modules %default-go-vendored-imported-modules)
+                                  (modules %default-go-vendored-modules)
+                                  (substitutable? #t))
+  "Cross-build NAME using GO, where TARGET is a GNU triplet and with INPUTS."
+  (define builder
+    (with-imported-modules imported-modules
+      #~(begin
+          (use-modules #$@(sexp->gexp modules))
+
+          (define %build-host-inputs
+            #+(input-tuples->gexp build-inputs))
+
+          (define %build-target-inputs
+            (append #$(input-tuples->gexp host-inputs)
+              #+(input-tuples->gexp target-inputs)))
+
+          (define %build-inputs
+            (append %build-host-inputs %build-target-inputs))
+
+          (define %outputs
+            #$(outputs->gexp outputs))
+
+          (go-vendored-build #:name #$name
+                             #:source #+source
+                             #:system #$system
+                             #:phases #$phases
+                             #:outputs %outputs
+                             #:target #$target
+                             #:goarch #$goarch
+                             #:goos #$goos
+                             #:embed-files #$embed-files
+                             #:inputs %build-target-inputs
+                             #:native-inputs %build-host-inputs
+                             #:search-paths '#$(map search-path-specification->sexp
+                                                    search-paths)
+                             #:native-search-paths '#$(map
+                                                       search-path-specification->sexp
+                                                       native-search-paths)
+                             #:install-source? #$install-source?
+                             #:import-path #$import-path
+                             #:unpack-path #$unpack-path
+                             #:build-flags #$build-flags
+                             #:skip-build? #$skip-build?
+                             #:tests? #$tests?
+                             #:test-flags #$test-flags
+                             #:test-subdirs #$test-subdirs
+                             #:parallel-build? #$parallel-build?
+                             #:parallel-tests? #$parallel-tests?
+                             #:make-dynamic-linker-cache? #f ;cross-compiling
+                             #:allow-go-reference? #$allow-go-reference?
+                             #:inputs %build-inputs))))
+
+  (mlet %store-monad ((guile (package->derivation (or guile (default-guile))
+                                                  system #:graft? #f)))
+    (gexp->derivation name builder
+                      #:system system
+                      #:target target
+                      #:graft? #f
+                      #:substitutable? substitutable?
+                      #:guile-for-build guile)))
+
+(define go-vendored-build-system
+  (build-system
+    (name 'go)
+    (description
+     "Build system for Go programs")
+    (lower lower)))
diff --git a/modules/rosenthal/build/go-vendored-build-system.scm b/modules/rosenthal/build/go-vendored-build-system.scm
new file mode 100644
index 0000000..42e659a
--- /dev/null
+++ b/modules/rosenthal/build/go-vendored-build-system.scm
@@ -0,0 +1,28 @@
+;;; SPDX-License-Identifier: GPL-3.0-or-later
+;;; Copyright © 2026 Hilton Chain <hako@ultrarare.space>
+
+(define-module (rosenthal build go-vendored-build-system)
+  #:use-module (guix build utils)
+  #:use-module ((guix build gnu-build-system) #:prefix gnu:)
+  #:use-module ((guix build go-build-system) #:prefix go:)
+  #:export (%standard-phases
+            go-vendored-build))
+
+(define* (unpack-vendored-dependencies #:key native-inputs inputs #:allow-other-keys)
+  (let ((vendored-dependencies
+         (assoc-ref (or native-inputs inputs) "vendored-go-dependencies")))
+    (unsetenv "GO111MODULE")
+    (when vendored-dependencies
+      (copy-recursively vendored-dependencies "vendor"))))
+
+(define %standard-phases
+  (modify-phases go:%standard-phases
+    (add-after 'unpack 'unpack-vendored-dependencies unpack-vendored-dependencies)
+    (replace 'unpack
+      (assoc-ref gnu:%standard-phases 'unpack))
+    (replace 'install-license-files
+      (assoc-ref gnu:%standard-phases 'install-license-files))))
+
+(define* (go-vendored-build #:key inputs (phases %standard-phases)
+                            #:allow-other-keys #:rest args)
+  (apply gnu:gnu-build #:inputs inputs #:phases phases args))
diff --git a/modules/rosenthal/packages/networking.scm b/modules/rosenthal/packages/networking.scm
index 9950e4b..9c2afb0 100644
--- a/modules/rosenthal/packages/networking.scm
+++ b/modules/rosenthal/packages/networking.scm
@@ -12,6 +12,7 @@
   #:use-module (rosenthal utils download)
   ;; Guix build systems
   #:use-module (guix build-system go)
+  #:use-module (rosenthal build-system go-vendored)
   ;; Guix packages
   #:use-module (gnu packages base)
   #:use-module (gnu packages dns)
@@ -36,12 +37,11 @@
               (sha256
                (base32
                 "092745jrmq6cqgad0cbkq9jiybq9s9by22y7fbr5y2rj7gw01cyy"))))
-    (build-system go-build-system)
+    (build-system go-vendored-build-system)
     (arguments
      (list #:go go-1.26
            #:install-source? #f
-           #:import-path "github.com/cloudflare/cloudflared/cmd/cloudflared"
-           #:unpack-path "github.com/cloudflare/cloudflared"
+           #:import-path "./cmd/cloudflared"
            #:build-flags
            #~(list (string-append
                     "-ldflags="
@@ -49,12 +49,9 @@
                     " -X github.com/cloudflare/cloudflared/cmd/cloudflared/updater.BuiltForPackageManager=Guix"))
            #:phases
            #~(modify-phases %standard-phases
-               (add-before 'build 'disable-cgo
-                 (lambda _
-                   (setenv "CGO_ENABLED" "0")))
                (add-after 'install 'install-documentation
                  (lambda _
-                   (let ((src "src/github.com/cloudflare/cloudflared/cloudflared_man_template")
+                   (let ((src "cloudflared_man_template")
                          (dst (string-append #$output "/share/man/man1/cloudflared.1")))
                      (substitute* src
                        (("\\$\\{VERSION\\}") #$(package-version this-package)))
@@ -84,35 +81,21 @@ origin can remain as closed as possible.")
               (sha256
                (base32
                 "16vhaq2h67al39k1757vvfgzav8bdkhsa5m5z6km3cw7h6l0rk82"))))
-    (build-system go-build-system)
+    (build-system go-vendored-build-system)
     (arguments
      (list
-      #:tests? (not (%current-target-system)) ;TODO: Run test suite.
       #:go go-1.26
+      #:vendor-hash (base32 "0kz38byz4q18234z8i9gbc6728dch8lfzw54spng736x3wql2an9")
+      #:tests? (not (%current-target-system)) ;TODO: Run test suite.
       #:install-source? #f
-      #:import-path "."
       #:build-flags
       #~(list "-tags" "with_gvisor"
               (string-append
                "-ldflags="
                " -X github.com/metacubex/mihomo/constant.Version="
                #$(package-version this-package)))
-      #:modules
-      '((ice-9 match)
-        ((guix build gnu-build-system) #:prefix gnu:)
-        (guix build go-build-system)
-        (guix build utils))
       #:phases
       #~(modify-phases %standard-phases
-          (replace 'unpack
-            (lambda args
-              (unsetenv "GO111MODULE")
-              (apply (assoc-ref gnu:%standard-phases 'unpack) args)
-              (copy-recursively
-               #+(this-package-native-input "vendored-go-dependencies")
-               "vendor")))
-          (replace 'install-license-files
-            (assoc-ref gnu:%standard-phases 'install-license-files))
           (delete 'check)
           (add-after 'install 'check
             (lambda* (#:key tests? #:allow-other-keys)
@@ -121,17 +104,9 @@ origin can remain as closed as possible.")
                   (invoke mihomo "--help")
                   (invoke mihomo "-v"))))))))
     (native-inputs
-     (append
-      (list (origin
-              (method (go-mod-vendor #:go go-1.26))
-              (uri (package-source this-package))
-              (file-name "vendored-go-dependencies")
-              (sha256
-               (base32
-                "0kz38byz4q18234z8i9gbc6728dch8lfzw54spng736x3wql2an9"))))
-      (if (%current-target-system)
-          (list this-package)
-          '())))
+     (if (%current-target-system)
+         (list this-package)
+         '()))
     (home-page "https://wiki.metacubex.one/")
     (synopsis "Rule-based proxy")
     (description
@@ -154,10 +129,11 @@ bypass network restrictions." )
               (sha256
                (base32
                 "0b5hp696dsh0sl1640726wg36cssdllpc903k7v3sn0q6p9zysq0"))))
-    (build-system go-build-system)
+    (build-system go-vendored-build-system)
     (arguments
      (list
       #:go go-1.26
+      #:vendor-hash (base32 "0gzjdjq94vkbsyr2m37wjpd37m4whksgsp4kcmh6j293vfwc83ll")
       #:install-source? #f
       #:import-path "./cmd/sing-box"
       #:build-flags
@@ -175,22 +151,11 @@ bypass network restrictions." )
                " -X github.com/sagernet/sing-box/constant.Version="
                #$(package-version this-package)))
       #:modules
-      '((ice-9 match)
-        ((guix build gnu-build-system) #:prefix gnu:)
-        (guix build go-build-system)
-        (guix build utils))
+      (cons '(ice-9 match)
+            %default-go-vendored-modules)
       #:phases
       #~(modify-phases %standard-phases
-          (replace 'unpack
-            (lambda args
-              (unsetenv "GO111MODULE")
-              (apply (assoc-ref gnu:%standard-phases 'unpack) args)
-              (copy-recursively
-               #+(this-package-native-input "vendored-go-dependencies")
-               "vendor")))
-          (replace 'install-license-files
-            (assoc-ref gnu:%standard-phases 'install-license-files))
-          (add-after 'unpack 'set-tailscale-default-wireguard-port
+          (add-after 'unpack-vendored-dependencies 'set-tailscale-default-wireguard-port
             (lambda _
               ;; See also: https://tailscale.com/kb/1082/firewall-ports
               ;; https://github.com/tailscale/tailscale/blob/51c11a864b1241d1cf1a736fbc94b0f8c76da563/cmd/tailscaled/tailscaled.go#L102
@@ -213,17 +178,9 @@ bypass network restrictions." )
                    ("fish" . "share/fish/vendor_completions.d/sing-box.fish")
                    ("zsh"  . "share/zsh/site-functions/_sing-box")))))))))
     (native-inputs
-     (append
-      (list (origin
-              (method (go-mod-vendor #:go go-1.26))
-              (uri (package-source this-package))
-              (file-name "vendored-go-dependencies")
-              (sha256
-               (base32
-                "0gzjdjq94vkbsyr2m37wjpd37m4whksgsp4kcmh6j293vfwc83ll"))))
-      (if (%current-target-system)
-          (list this-package)
-          '())))
+     (if (%current-target-system)
+         (list this-package)
+         '()))
     (home-page "https://sing-box.sagernet.org/")
     (synopsis "Universal proxy platform")
     (description
@@ -280,13 +237,13 @@ a SOCKS5 proxy.")
                   (delete-file-recursively "tool")
                   (substitute* "net/tstun/tun_linux.go"
                     (("/sbin/(modprobe)" _ cmd) cmd))))))
-    (build-system go-build-system)
+    (build-system go-vendored-build-system)
     (arguments
      (list
-      #:tests? (not (%current-target-system)) ;TODO: Run test suite.
       #:go go-1.26
+      #:vendor-hash (base32 "1ffhpdb5lyfgdb1n7sps8zxs85g725ijx7sir6q0h1lk3mflpg4r")
+      #:tests? (not (%current-target-system)) ;TODO: Run test suite.
       #:install-source? #f
-      #:import-path "."
       #:build-flags
       #~(list "-tags" "ts_include_cli"
               (string-append
@@ -296,21 +253,10 @@ a SOCKS5 proxy.")
                " -X tailscale.com/version.shortStamp="
                #$(package-version this-package)))
       #:modules
-      '((ice-9 match)
-        ((guix build gnu-build-system) #:prefix gnu:)
-        (guix build go-build-system)
-        (guix build utils))
+      (cons '(ice-9 match)
+            %default-go-vendored-modules)
       #:phases
       #~(modify-phases %standard-phases
-          (replace 'unpack
-            (lambda args
-              (unsetenv "GO111MODULE")
-              (apply (assoc-ref gnu:%standard-phases 'unpack) args)
-              (copy-recursively
-               #+(this-package-native-input "vendored-go-dependencies")
-               "vendor")))
-          (replace 'install-license-files
-            (assoc-ref gnu:%standard-phases 'install-license-files))
           (add-after 'unpack 'patch-references
             (lambda* (#:key inputs #:allow-other-keys)
               (substitute* "client/systray/startup-creator.go"
@@ -373,17 +319,9 @@ a SOCKS5 proxy.")
                    "tailscaled"
                    "tsidp"))))))))
     (native-inputs
-     (append
-      (list (origin
-              (method (go-mod-vendor #:go go-1.26))
-              (uri (package-source this-package))
-              (file-name "vendored-go-dependencies")
-              (sha256
-               (base32
-                "1ffhpdb5lyfgdb1n7sps8zxs85g725ijx7sir6q0h1lk3mflpg4r"))))
-      (if (%current-target-system)
-          (list this-package)
-          '())))
+     (if (%current-target-system)
+         (list this-package)
+         '()))
     (inputs
      (list desktop-file-utils
            findutils
diff --git a/modules/rosenthal/packages/web.scm b/modules/rosenthal/packages/web.scm
index 323a7b8..05ec6bd 100644
--- a/modules/rosenthal/packages/web.scm
+++ b/modules/rosenthal/packages/web.scm
@@ -16,6 +16,7 @@
   #:use-module (guix build-system cargo)
   #:use-module (guix build-system copy)
   #:use-module (guix build-system go)
+  #:use-module (rosenthal build-system go-vendored)
   ;; Guix packages
   #:use-module (gnu packages golang)
   #:use-module (gnu packages image)
@@ -66,7 +67,7 @@ website owners block unwanted AI crawlers from accessing their sites.")
               (sha256
                (base32
                 "0kqp5j0739lpdw55gx4bnnda1b90qlavcdlp8vh9bp014xx84yqj"))))
-    (build-system go-build-system)
+    (build-system go-vendored-build-system)
     (arguments
      (list #:tests? (not (%current-target-system)) ;FIXME
            #:go go-1.26
@@ -77,18 +78,8 @@ website owners block unwanted AI crawlers from accessing their sites.")
                     "-ldflags="
                     " -X github.com/TecharoHQ/anubis.Version="
                     #$(package-version this-package)))
-           #:modules
-           '(((guix build gnu-build-system) #:prefix gnu:)
-             (guix build go-build-system)
-             (guix build utils))
            #:phases
            #~(modify-phases %standard-phases
-               (replace 'unpack
-                 (lambda args
-                   (unsetenv "GO111MODULE")
-                   (apply (assoc-ref gnu:%standard-phases 'unpack) args)))
-               (replace 'install-license-files
-                 (assoc-ref gnu:%standard-phases 'install-license-files))
                (delete 'check)
                (add-after 'install 'check
                  (lambda* (#:key tests? #:allow-other-keys)
@@ -117,9 +108,10 @@ order to protect upstream resources from web crawlers.")
               (sha256
                (base32
                 "1a0w7i99p277kwbxfd5zf8d55n24z27i377njzqdc3jxp6ijcy7c"))))
-    (build-system go-build-system)
+    (build-system go-vendored-build-system)
     (arguments
      (list #:go go-1.26
+           #:vendor-hash (base32 "1vnqildhrrmicq9zazk8c2b3d7jqj197r4wxczg4j58qig2mj9j2")
            #:tests? (not (%current-target-system)) ;TODO: Run test suite.
            #:install-source? #f
            #:import-path
@@ -133,21 +125,10 @@ order to protect upstream resources from web crawlers.")
                     " -X github.com/caddyserver/caddy/v2.CustomVersion="
                     #$(package-version this-package)))
            #:modules
-           '((ice-9 match)
-             ((guix build gnu-build-system) #:prefix gnu:)
-             (guix build go-build-system)
-             (guix build utils))
+           (cons '(ice-9 match)
+                 %default-go-vendored-modules)
            #:phases
            #~(modify-phases %standard-phases
-               (replace 'unpack
-                 (lambda args
-                   (unsetenv "GO111MODULE")
-                   (apply (assoc-ref gnu:%standard-phases 'unpack) args)
-                   (copy-recursively
-                    #+(this-package-native-input "vendored-go-dependencies")
-                    "vendor")))
-               (replace 'install-license-files
-                 (assoc-ref gnu:%standard-phases 'install-license-files))
                (add-after 'install 'install-extras
                  (lambda _
                    (let ((caddy
@@ -173,14 +154,6 @@ order to protect upstream resources from web crawlers.")
                      (let ((caddy (in-vicinity #$output "bin/caddy")))
                        (invoke caddy "help")
                        (invoke caddy "version"))))))))
-    (native-inputs
-     (list (origin
-             (method (go-mod-vendor #:go go-1.26))
-             (uri (package-source this-package))
-             (file-name "vendored-go-dependencies")
-             (sha256
-              (base32
-               "1vnqildhrrmicq9zazk8c2b3d7jqj197r4wxczg4j58qig2mj9j2")))))
     (home-page "https://caddyserver.com/")
     (synopsis "Extensible HTTP web server with automatic HTTPS")
     (description
@@ -205,16 +178,10 @@ from serving static websites to running dynamic web applications.")
               (sha256
                (base32
                 "1b8606rbg57ylxz2q88335s04q8yvg6b33qkq3hk9895vwd74mq0"))))
-    (native-inputs
-     (modify-inputs native-inputs
-       (replace "vendored-go-dependencies"
-         (origin
-           (method (go-mod-vendor #:go go-1.26))
-           (uri (package-source this-package))
-           (file-name "vendored-go-dependencies")
-           (sha256
-            (base32
-             "0bwpayz2yf18cycffy02iiq88cl0smljimsf0yrdzrn1l3flg37s"))))))
+    (arguments
+     (substitute-keyword-arguments arguments
+       ((#:vendor-hash _ #f)
+        (base32 "0bwpayz2yf18cycffy02iiq88cl0smljimsf0yrdzrn1l3flg37s"))))
     (home-page "https://git.guix.moe/hako/caddy")
     (properties '((disable-updater? . #t)))))
 
@@ -231,12 +198,11 @@ from serving static websites to running dynamic web applications.")
               (sha256
                (base32
                 "0mjmns7yqhhkqc3jcg8bffs64zj4b52hy2v1lvr14pq162r6wcil"))))
-    (build-system go-build-system)
+    (build-system go-vendored-build-system)
     (arguments
      (list #:tests? (not (%current-target-system)) ;TODO: Run test suite.
            #:go go-1.26
            #:install-source? #f
-           #:import-path "."
            #:build-flags
            #~(list (string-append
                     "-ldflags="
@@ -246,19 +212,8 @@ from serving static websites to running dynamic web applications.")
                     " -X forgejo.org/modules/setting.AppWorkPath=/var/lib/forgejo"
                     " -X forgejo.org/modules/setting.CustomPath=" #$output "/etc/forgejo"
                     " -X forgejo.org/modules/setting.CustomConf=/etc/forgejo/app.ini"))
-           #:modules
-           '(((guix build gnu-build-system) #:prefix gnu:)
-             (guix build go-build-system)
-             (guix build union)
-             (guix build utils))
            #:phases
            #~(modify-phases %standard-phases
-               (replace 'unpack
-                 (lambda args
-                   (unsetenv "GO111MODULE")
-                   (apply (assoc-ref gnu:%standard-phases 'unpack) args)))
-               (replace 'install-license-files
-                 (assoc-ref gnu:%standard-phases 'install-license-files))
                (add-after 'install 'rename-binary
                  (lambda _
                    (rename-file (in-vicinity #$output "bin/forgejo.org")
diff --git a/modules/rosenthal/utils/download.scm b/modules/rosenthal/utils/download.scm
index 5d5d61c..9672675 100644
--- a/modules/rosenthal/utils/download.scm
+++ b/modules/rosenthal/utils/download.scm
@@ -15,6 +15,11 @@
 
 (define* (go-mod-vendor #:key go)
   (lambda* (src hash-algo hash #:optional name #:key (system (%current-system)))
+    "Return a fixed-output derivation to run \"go mod vendor\" against SRC and
+use the produced \"vendor\" directory as the result.  The derivation is expected
+to have HASH of type HASH-ALGO (a symbol).  File name of the derivation defaults
+to \"vendored-go-dependencies\" and can be specified by NAME."
+
     (define nss-certs
       (module-ref (resolve-interface '(gnu packages nss)) 'nss-certs))
 
@@ -26,7 +31,9 @@
                         (guix build utils))
            ;; Support Unicode in file name.
            (setlocale LC_ALL "C.UTF-8")
-           ;; For HTTPS support.
+           ;; Use our bundled Go toolchain.
+           (setenv "GOTOOLCHAIN" "local")
+           ;; HTTPS support.
            (setenv "SSL_CERT_DIR" #+(file-append nss-certs "/etc/ssl/certs"))
 
            ((assoc-ref %standard-phases 'unpack) #:source #+src)
@@ -37,11 +44,12 @@
      #:hash hash
      ;; Is a directory.
      #:recursive? #t
-     #:env-vars '(("GOCACHE" . "/tmp/go-cache")
-                  ("GOPATH" . "/tmp/go"))
+     #:env-vars
+     '(("GOCACHE" . "/tmp/go-cache")
+       ("GOPATH" . "/tmp/go"))
      ;; Honor the user's proxy and locale settings.
-     #:leaked-env-vars '("GOPROXY"
-                         "http_proxy" "https_proxy"
-                         "LC_ALL" "LC_MESSAGES" "LANG"
-                         "COLUMNS")
-     #:local-build? #t)))
+     #:leaked-env-vars
+     '("GOPROXY"
+       "http_proxy" "https_proxy"
+       "LC_ALL" "LC_MESSAGES" "LANG"
+       "COLUMNS"))))