diff --git a/.forgejo/workflows-composite/setup-env/action.yaml b/.forgejo/workflows-composite/setup-env/action.yaml
index 4fac0c0f46..83cce157bd 100644
--- a/.forgejo/workflows-composite/setup-env/action.yaml
+++ b/.forgejo/workflows-composite/setup-env/action.yaml
@@ -13,3 +13,13 @@ runs:
     - uses: https://codeberg.org/fnetx/setup-cache-go@4b50dd28b1068fa06d433c5fabed3f6f4d4ccddf
       with:
         username: forgejo
+
+    - name: validate go version
+      run: |
+        set -ex
+        toolchain=$(grep -oP '(?<=toolchain ).+' go.mod)
+        version=$(go version | cut -d' ' -f3)
+        if [ "$toolchain" != "$version" ]; then
+          echo "go version mismatch: $toolchain <> $version"
+          exit 1
+        fi
diff --git a/Makefile b/Makefile
index 8cf06a20e8..1f350dc256 100644
--- a/Makefile
+++ b/Makefile
@@ -18,7 +18,7 @@ DIST := dist
 DIST_DIRS := $(DIST)/binaries $(DIST)/release
 IMPORT := code.gitea.io/gitea
 
-GO ?= go
+GO ?= $(shell go env GOROOT)/bin/go
 SHASUM ?= shasum -a 256
 HAS_GO := $(shell hash $(GO) > /dev/null 2>&1 && echo yes)
 COMMA := ,
@@ -620,7 +620,7 @@ tidy-check: tidy
 go-licenses: $(GO_LICENSE_FILE)
 
 $(GO_LICENSE_FILE): go.mod go.sum
-	-$(shell $(GO) env GOROOT)/bin/go run $(GO_LICENSES_PACKAGE) save . --force --ignore code.gitea.io/gitea --save_path=$(GO_LICENSE_TMP_DIR) 2>/dev/null
+	-$(GO) run $(GO_LICENSES_PACKAGE) save . --force --ignore code.gitea.io/gitea --save_path=$(GO_LICENSE_TMP_DIR) 2>/dev/null
 	$(GO) run build/generate-go-licenses.go $(GO_LICENSE_TMP_DIR) $(GO_LICENSE_FILE)
 	@rm -rf $(GO_LICENSE_TMP_DIR)
 
diff --git a/go.mod b/go.mod
index f70c7096af..a9200df998 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,8 @@
 module code.gitea.io/gitea
 
-go 1.23.3
+go 1.23.1
+
+toolchain go1.23.3
 
 require (
 	code.forgejo.org/f3/gof3/v3 v3.7.0