diff --git a/3rdparty/bazel/org_golang/BUILD.bazel b/3rdparty/bazel/org_golang/BUILD.bazel
new file mode 100644
index 000000000..dc940d416
--- /dev/null
+++ b/3rdparty/bazel/org_golang/BUILD.bazel
@@ -0,0 +1 @@
+exports_files(["go_tls_max_handshake_size.patch"])
diff --git a/3rdparty/bazel/org_golang/go_tls_max_handshake_size.patch b/3rdparty/bazel/org_golang/go_tls_max_handshake_size.patch
new file mode 100644
index 000000000..ac2da752f
--- /dev/null
+++ b/3rdparty/bazel/org_golang/go_tls_max_handshake_size.patch
@@ -0,0 +1,11 @@
+--- src/crypto/tls/common.go
++++ src/crypto/tls/common.go
+@@ -62,7 +62,7 @@
+ 	maxCiphertext      = 16384 + 2048 // maximum ciphertext payload length
+ 	maxCiphertextTLS13 = 16384 + 256  // maximum ciphertext length in TLS 1.3
+ 	recordHeaderLen    = 5            // record header length
+-	maxHandshake       = 65536        // maximum handshake we support (protocol max is 16 MB)
++	maxHandshake       = 262144       // maximum handshake we support (protocol max is 16 MB)
+ 	maxUselessRecords  = 16           // maximum number of consecutive non-advancing records
+ )
+ 
diff --git a/WORKSPACE.bazel b/WORKSPACE.bazel
index e65cf4f10..21c6e1982 100644
--- a/WORKSPACE.bazel
+++ b/WORKSPACE.bazel
@@ -165,11 +165,17 @@ load("//bazel/toolchains:go_module_deps.bzl", "go_dependencies")
 # gazelle:repository_macro bazel/toolchains/go_module_deps.bzl%go_dependencies
 go_dependencies()
 
-load("@io_bazel_rules_go//go:deps.bzl", "go_register_toolchains", "go_rules_dependencies")
+load("@io_bazel_rules_go//go:deps.bzl", "go_download_sdk", "go_register_toolchains", "go_rules_dependencies")
+
+go_download_sdk(
+    name = "go_sdk",
+    patches = ["//3rdparty/bazel/org_golang:go_tls_max_handshake_size.patch"],
+    version = "1.22.1",
+)
 
 go_rules_dependencies()
 
-go_register_toolchains(version = "1.22.1")
+go_register_toolchains()
 
 load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies")