diff --git a/flake.nix b/flake.nix
index cf8578a59..5efddb618 100644
--- a/flake.nix
+++ b/flake.nix
@@ -97,24 +97,25 @@
     supportedSystems = ["x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin"];
     forAllSystems = nixpkgs.lib.genAttrs supportedSystems;
     # go 1.26.10 refuses chains through the leaked emudhra intermediates, and nixpkgs
-    # doesn't ship it yet. the version check keeps this from downgrading a newer go
-    goOverlay = final: prev: {
-      go_1_26 =
-        if nixpkgs.lib.versionOlder prev.go_1_26.version "1.26.10"
-        then
-          prev.go_1_26.overrideAttrs (_: rec {
-            version = "1.26.10";
-            src = final.fetchurl {
-              url = "https://go.dev/dl/go${version}.src.tar.gz";
-              hash = "sha256-/WPog7ovK/ypPBZGsx6+9j4rHk0rMXyXidl2po2B828=";
-            };
-          })
-        else prev.go_1_26;
-    };
+    # doesn't ship it yet. only our own builds get it, because swapping go for all of
+    # nixpkgs rebuilds the world (libcap builds with go)
+    goFor = pkgs: let
+      go = pkgs.go_1_26;
+    in
+      if nixpkgs.lib.versionOlder go.version "1.26.10"
+      then
+        go.overrideAttrs (_: rec {
+          version = "1.26.10";
+          src = pkgs.fetchurl {
+            url = "https://go.dev/dl/go${version}.src.tar.gz";
+            hash = "sha256-/WPog7ovK/ypPBZGsx6+9j4rHk0rMXyXidl2po2B828=";
+          };
+        })
+      else go;
     nixpkgsFor = forAllSystems (system:
       import nixpkgs {
         inherit system;
-        overlays = [fetch-tangled.overlays.default goOverlay];
+        overlays = [fetch-tangled.overlays.default];
       });
 
     mkPackageSet = pkgs:
@@ -144,10 +145,12 @@
                 ./knot2
               ]);
           };
-        buildGoApplication =
+        go = goFor pkgs.buildPackages;
+        buildGoModule = pkgs.buildGoModule.override {inherit (self) go;};
+        buildGoApplication = args:
           (self.callPackage "${gomod2nix}/builder" {
             gomod2nix = gomod2nix.legacyPackages.${pkgs.stdenv.hostPlatform.system}.gomod2nix;
-          }).buildGoApplication;
+          }).buildGoApplication ({inherit (self) go;} // args);
         rustPlatform = pkgs.makeRustPlatform {
           inherit (fenix.packages.${pkgs.stdenv.hostPlatform.system}.stable) rustc cargo;
         };
@@ -212,8 +215,7 @@
         modules = [self.nixosModules.spindle-nixos];
       };
   in {
-    # hosts build with their own nixpkgs, so they need the go fix too
-    overlays.default = nixpkgs.lib.composeExtensions goOverlay (final: prev: {
+    overlays.default = final: prev: {
       inherit
         (mkPackageSet final)
         lexgen
@@ -235,7 +237,7 @@
         zoekt-webserver
         zoekt-tngl-indexserver
         ;
-    });
+    };
 
     packages = forAllSystems (system: let
       pkgs = nixpkgsFor.${system};