diff --git a/.github/workflows/go-lint.yaml b/.github/workflows/go-lint.yaml
index cad0ed4a4..f674407cd 100644
--- a/.github/workflows/go-lint.yaml
+++ b/.github/workflows/go-lint.yaml
@@ -23,7 +23,6 @@ permissions:
   # pull-requests: read
 
 env:
-  GO_VERSION: 1.23
   GOLANGCI_LINT_VERSION: v2.1.2
 
 jobs:
@@ -42,11 +41,6 @@ jobs:
           echo "apps=${app_array}"
           printf "apps=%s\n" "${app_array}" >> "$GITHUB_OUTPUT"
         shell: bash
-
-      # Set up Go environment
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
-        with:
-          go-version: ${{ env.GO_VERSION }}
     outputs:
       apps: ${{ steps.list_dirs.outputs.apps }}
 
@@ -61,6 +55,12 @@ jobs:
         with:
           fetch-depth: 1
 
+      # Each module declares its own Go version, so honour go.mod rather than
+      # pinning one version for every module.
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        with:
+          go-version-file: go/${{ matrix.app }}/go.mod
+
       - name: golangci-lint ${{ matrix.app }}
         uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9
         with:
diff --git a/go/understackctl/Makefile b/go/understackctl/Makefile
index fe8923d29..984bd3b50 100644
--- a/go/understackctl/Makefile
+++ b/go/understackctl/Makefile
@@ -43,7 +43,7 @@ build-all:
 			OUTFILE=$$DIR/$(BINARY_NAME)$$EXT; \
 			mkdir -p $$DIR; \
 			echo "Building $$OUTFILE..."; \
-			CGO_ENABLED=0 GOOS=$$GOOS GOARCH=$$GOARCH go build $() -o $$OUTFILE . || echo "Failed to build $$GOOS/$$GOARCH"; \
+			CGO_ENABLED=0 GOOS=$$GOOS GOARCH=$$GOARCH go build $(LDFLAGS) -o $$OUTFILE . || echo "Failed to build $$GOOS/$$GOARCH"; \
 		done \
 	done
 
diff --git a/go/understackctl/cmd/root/root.go b/go/understackctl/cmd/root/root.go
index 18b5848d0..a1fdc5c37 100644
--- a/go/understackctl/cmd/root/root.go
+++ b/go/understackctl/cmd/root/root.go
@@ -43,6 +43,11 @@ func init() {
 	rootCmd.AddCommand(other.NewCmdOtherSecrets())
 }
 
+// SetVersion sets the version reported by `understackctl --version`.
+func SetVersion(version, commit string) {
+	rootCmd.Version = fmt.Sprintf("%s (%s)", version, commit)
+}
+
 // Execute will execute the root command
 func Execute() error {
 	return rootCmd.Execute()
diff --git a/go/understackctl/main.go b/go/understackctl/main.go
index 1cc9f23eb..0bbdfd98f 100644
--- a/go/understackctl/main.go
+++ b/go/understackctl/main.go
@@ -6,7 +6,15 @@ import (
 	"github.com/rackerlabs/understack/go/understackctl/cmd/root"
 )
 
+// Populated at build time by the -X linker flags set in the Makefile.
+var (
+	version = "dev"
+	commit  = "unknown"
+)
+
 func main() {
+	root.SetVersion(version, commit)
+
 	err := root.Execute()
 	if err != nil {
 		os.Exit(1)