diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1e135d1cdc5..ff36b802a1e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -58,6 +58,12 @@ jobs:
         with:
           cache: false
           go-version: 1.23.0
+      - name: Set common go env vars
+        run: |-
+          go env -w GOTOOLCHAIN=local
+
+          # Dump env for good measure
+          go env
       - name: Setup qemu
         uses: docker/setup-qemu-action@v3
       - name: Set up Docker Buildx
diff --git a/.github/workflows/trybot.yml b/.github/workflows/trybot.yml
index e6881ae642d..3f73a35f460 100644
--- a/.github/workflows/trybot.yml
+++ b/.github/workflows/trybot.yml
@@ -71,6 +71,12 @@ jobs:
         with:
           cache: false
           go-version: ${{ matrix.go-version }}
+      - name: Set common go env vars
+        run: |-
+          go env -w GOTOOLCHAIN=local
+
+          # Dump env for good measure
+          go env
       - name: Get go mod cache directory
         id: go-mod-cache-dir
         run: echo "dir=$(go env GOMODCACHE)" >> ${GITHUB_OUTPUT}
diff --git a/internal/ci/base/github.cue b/internal/ci/base/github.cue
index d9f081a2ad9..2b078e75388 100644
--- a/internal/ci/base/github.cue
+++ b/internal/ci/base/github.cue
@@ -15,14 +15,51 @@ bashWorkflow: json.#Workflow & {
 	jobs: [string]: defaults: run: shell: "bash"
 }
 
-installGo: json.#step & {
-	name: "Install Go"
-	uses: "actions/setup-go@v5"
-	with: {
-		// We do our own caching in setupGoActionsCaches.
-		cache:        false
-		"go-version": string
+installGo: {
+	#setupGo: json.#step & {
+		name: "Install Go"
+		uses: "actions/setup-go@v5"
+		with: {
+			// We do our own caching in setupGoActionsCaches.
+			cache:        false
+			"go-version": string
+		}
 	}
+
+	// Why set GOTOOLCHAIN here? As opposed to an environment variable
+	// elsewhere? No perfect answer to this question but here is the thinking:
+	//
+	// Setting the variable here localises it with the installation of Go. Doing
+	// it elsewhere creates distance between the two steps which are
+	// intrinsically related. And it's also hard to do: "when we use this step,
+	// also ensure that we establish an environment variable in the job for
+	// GOTOOLCHAIN".
+	//
+	// Environment variables can only be set at a workflow, job or step level.
+	// Given we currently use a matrix strategy which varies the Go version,
+	// that rules out using an environment variable based approach, because the
+	// Go version is only available at runtime via GitHub actions provided
+	// context. Whether we should instead be templating multiple workflows (i.e.
+	// exploding the matrix ourselves) is a different question, but one that
+	// has performance implications.
+	//
+	// So as clumsy as it is to use a step "template" that includes more than
+	// one step, it's the best option available to us for now.
+	[
+		#setupGo,
+
+		{
+			json.#step & {
+				name: "Set common go env vars"
+				run: """
+					go env -w GOTOOLCHAIN=local
+
+					# Dump env for good measure
+					go env
+					"""
+			}
+		},
+	]
 }
 
 checkoutCode: {
@@ -100,7 +137,7 @@ checkoutCode: {
 
 earlyChecks: json.#step & {
 	name: "Early git and code sanity checks"
-	run: "go run ./internal/ci/checks"
+	run:  "go run ./internal/ci/checks"
 }
 
 curlGitHubAPI: {
diff --git a/internal/ci/github/release.cue b/internal/ci/github/release.cue
index f4d701bd8ca..927d1b9e242 100644
--- a/internal/ci/github/release.cue
+++ b/internal/ci/github/release.cue
@@ -42,11 +42,14 @@ workflows: release: _repo.bashWorkflow & {
 	jobs: goreleaser: {
 		"runs-on": _repo.linuxMachine
 		if:        "${{github.repository == '\(_repo.githubRepositoryPath)'}}"
+
+		let installGo = _repo.installGo & {
+			#setupGo: with: "go-version": _repo.pinnedReleaseGo
+			_
+		}
 		steps: [
 			for v in _repo.checkoutCode {v},
-			_repo.installGo & {
-				with: "go-version": _repo.pinnedReleaseGo
-			},
+			for v in installGo {v},
 			json.#step & {
 				name: "Setup qemu"
 				uses: "docker/setup-qemu-action@v3"
diff --git a/internal/ci/github/trybot.cue b/internal/ci/github/trybot.cue
index 4f9ce1c8a72..cf51a63bf1e 100644
--- a/internal/ci/github/trybot.cue
+++ b/internal/ci/github/trybot.cue
@@ -43,6 +43,11 @@ workflows: trybot: _repo.bashWorkflow & {
 				_
 			}
 
+			let installGo = _repo.installGo & {
+				#setupGo: with: "go-version": goVersionVal
+				_
+			}
+
 			// Only run the trybot workflow if we have the trybot trailer, or
 			// if we have no special trailers. Note this condition applies
 			// after and in addition to the "on" condition above.
@@ -51,9 +56,7 @@ workflows: trybot: _repo.bashWorkflow & {
 			steps: [
 				for v in _repo.checkoutCode {v},
 
-				_repo.installGo & {
-					with: "go-version": goVersionVal
-				},
+				for v in installGo {v},
 
 				// cachePre must come after installing Node and Go, because the cache locations
 				// are established by running each tool.