diff --git a/.github/actions/setup_bazel_nix/action.yml b/.github/actions/setup_bazel_nix/action.yml
index 38f1c607d..38be76c2c 100644
--- a/.github/actions/setup_bazel_nix/action.yml
+++ b/.github/actions/setup_bazel_nix/action.yml
@@ -65,10 +65,20 @@ runs:
       if: steps.check_inputs.outputs.nixPreinstalled == 'false'
       uses: cachix/install-nix-action@6ed004b9ccb68dbc28e7c85bee15fa93dbd214ac # v22
 
-    # - uses: cachix/cachix-action@6a9a34cdd93d0ae4b4b59fd678660efb08109f2f # v12
-    #   with:
-    #     name: katexochen
-    #     extraPullNames: nix-community
+    - name: Set $USER if not set
+      shell: bash
+      run: |
+        echo "::group::Set \$USER if not set"
+        if [[ -z "$USER" ]]; then
+          echo "USER=$(id -un)" | tee -a "$GITHUB_ENV"
+        fi
+        echo "::endgroup::"
+
+
+    - uses: cachix/cachix-action@6a9a34cdd93d0ae4b4b59fd678660efb08109f2f # v12
+      with:
+        name: katexochen
+        extraPullNames: nix-community
 
     - name: Install Bazelisk
       if: steps.check_inputs.outputs.bazelPreinstalled == 'false' && steps.check_inputs.outputs.nixOS == 'false'
diff --git a/.github/workflows/build-ccm-gcp.yml b/.github/workflows/build-ccm-gcp.yml
index 08736edf4..56d4a1919 100644
--- a/.github/workflows/build-ccm-gcp.yml
+++ b/.github/workflows/build-ccm-gcp.yml
@@ -31,7 +31,7 @@ jobs:
       - name: Setup Go environment
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: "1.21.1"
+          go-version: "1.21.3"
           cache: false
 
       - name: Install Crane
diff --git a/.github/workflows/build-os-image-scheduled.yml b/.github/workflows/build-os-image-scheduled.yml
index 4e297e38c..fb682fdb3 100644
--- a/.github/workflows/build-os-image-scheduled.yml
+++ b/.github/workflows/build-os-image-scheduled.yml
@@ -69,7 +69,7 @@ jobs:
       - name: Setup Go environment
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: "1.21.1"
+          go-version: "1.21.3"
           cache: false
 
       - name: Determine version
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index c1ca495cb..9faddf1cd 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -40,7 +40,7 @@ jobs:
         if: matrix.language == 'go'
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: "1.21.1"
+          go-version: "1.21.3"
           cache: false
 
       - name: Initialize CodeQL
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 99be7ff04..f6c7e9462 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -219,7 +219,7 @@ jobs:
       - name: Setup Go environment
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: "1.21.1"
+          go-version: "1.21.3"
           cache: true
 
       - name: Build generateMeasurements tool
diff --git a/.github/workflows/test-integration.yml b/.github/workflows/test-integration.yml
index 8895275bb..b47d4a1db 100644
--- a/.github/workflows/test-integration.yml
+++ b/.github/workflows/test-integration.yml
@@ -32,7 +32,7 @@ jobs:
       - name: Setup Go environment
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: "1.21.1"
+          go-version: "1.21.3"
           cache: true
 
       - name: Install Dependencies
diff --git a/.github/workflows/test-operator-codegen.yml b/.github/workflows/test-operator-codegen.yml
index 0cfd4afdc..46d392bcd 100644
--- a/.github/workflows/test-operator-codegen.yml
+++ b/.github/workflows/test-operator-codegen.yml
@@ -28,7 +28,7 @@ jobs:
       - name: Setup Go environment
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: "1.21.1"
+          go-version: "1.21.3"
           cache: true
 
       - name: Run code generation
diff --git a/3rdparty/gcp-guest-agent/Dockerfile b/3rdparty/gcp-guest-agent/Dockerfile
index aced18580..f282d6dbb 100644
--- a/3rdparty/gcp-guest-agent/Dockerfile
+++ b/3rdparty/gcp-guest-agent/Dockerfile
@@ -6,7 +6,7 @@ RUN apt-get update && apt-get install -y \
     git
 
 # Install Go
-ARG GO_VER=1.21.1
+ARG GO_VER=1.21.3
 RUN wget -q https://go.dev/dl/go${GO_VER}.linux-amd64.tar.gz && \
     tar -C /usr/local -xzf go${GO_VER}.linux-amd64.tar.gz && \
     rm go${GO_VER}.linux-amd64.tar.gz
diff --git a/WORKSPACE.bazel b/WORKSPACE.bazel
index 0b4bdbdba..17e1eac6b 100644
--- a/WORKSPACE.bazel
+++ b/WORKSPACE.bazel
@@ -98,7 +98,7 @@ go_rules_dependencies()
 load("@io_tweag_rules_nixpkgs//nixpkgs:toolchains/go.bzl", "nixpkgs_go_configure")
 
 nixpkgs_go_configure(
-    attribute_path = "go_1_21",
+    nix_file = "//bazel/go:go.nix",
     repository = "@nixpkgs",
 )
 
diff --git a/bazel/go/go.nix b/bazel/go/go.nix
new file mode 100644
index 000000000..89da77aea
--- /dev/null
+++ b/bazel/go/go.nix
@@ -0,0 +1,21 @@
+let
+  pkgs = import <nixpkgs> { };
+  goAttr = pkgs.go_1_21.overrideAttrs (_: rec {
+    version = "1.21.3";
+    src = pkgs.fetchurl {
+      url = "https://go.dev/dl/go${version}.src.tar.gz";
+      hash = "sha256-GG8rb4yLcE5paCGwmrIEGlwe4T3LwxVqE63PdZMe5Ig=";
+    };
+  });
+in
+pkgs.buildEnv
+  {
+    name = "bazel-go-toolchain";
+    paths = [ goAttr ];
+    postBuild = ''
+      touch $out/ROOT
+      ln -s $out/share/go/{api,doc,lib,misc,pkg,src,go.env} $out/
+    '';
+  } // {
+  version = goAttr.version;
+}
diff --git a/go.work b/go.work
index f0fca2ceb..a306dfe83 100644
--- a/go.work
+++ b/go.work
@@ -1,6 +1,6 @@
 go 1.21
 
-toolchain go1.21.1
+toolchain go1.21.3
 
 use (
 	.