diff --git a/build/dependencies.yaml b/build/dependencies.yaml
index ac32cb5b5e4..c02ddecb8b5 100644
--- a/build/dependencies.yaml
+++ b/build/dependencies.yaml
@@ -137,8 +137,6 @@ dependencies:
     - path: build/build-image/cross/VERSION
     - path: hack/lib/golang.sh
       match: minimum_go_version=go([0-9]+\.[0-9]+)
-    - path: staging/src/k8s.io/kms/internal/plugins/_mock/Dockerfile
-      match: golang:([0-9]+\.[0-9]+).0-bullseye
 
   - name: "registry.k8s.io/kube-cross: dependents"
     version: v1.33.0-go1.24.0-bullseye.0
diff --git a/staging/src/k8s.io/kms/internal/plugins/_mock/Dockerfile b/staging/src/k8s.io/kms/internal/plugins/_mock/Dockerfile
index da79d81fdde..035ccdbb8fa 100644
--- a/staging/src/k8s.io/kms/internal/plugins/_mock/Dockerfile
+++ b/staging/src/k8s.io/kms/internal/plugins/_mock/Dockerfile
@@ -12,7 +12,10 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.24.0-bullseye as builder
+# NOTE: this is just a default placeholder for convenience
+# To build this image properly, please invoke test/e2e/testing-manifests/auth/encrypt/run-e2e.sh
+ARG BUILDER_IMAGE=golang:latest
+FROM $BUILDER_IMAGE AS builder
 
 WORKDIR /workspace
 
@@ -23,6 +26,7 @@ WORKDIR /workspace/kms/internal/plugins/_mock
 
 ARG TARGETARCH
 ARG TARGETPLATFORM
+ARG GOTOOLCHAIN
 RUN CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} GO111MODULE=on go build -a -o mock-kms-plugin plugin.go
 
 FROM alpine:latest
diff --git a/test/e2e/testing-manifests/auth/encrypt/run-e2e.sh b/test/e2e/testing-manifests/auth/encrypt/run-e2e.sh
index c1659404118..78f04ef0c61 100755
--- a/test/e2e/testing-manifests/auth/encrypt/run-e2e.sh
+++ b/test/e2e/testing-manifests/auth/encrypt/run-e2e.sh
@@ -25,6 +25,10 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
+KUBE_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")"/../../../../.. && pwd -P)"
+source "${KUBE_ROOT}/hack/lib/init.sh"
+source "${KUBE_ROOT}/build/common.sh"
+
 readonly cluster_name="kms"
 readonly registry_name="kind-registry"
 readonly kind_network="kind"
@@ -35,6 +39,8 @@ build_and_push_mock_plugin() {
         --no-cache \
         --platform linux/amd64 \
         --output=type=docker \
+        --build-arg=GOTOOLCHAIN="${GOTOOLCHAIN:?}" \
+        --build-arg=BUILDER_IMAGE="${KUBE_CROSS_IMAGE:?}:${KUBE_CROSS_VERSION:?}" \
         -t localhost:5000/mock-kms-provider:e2e \
         -f staging/src/k8s.io/kms/internal/plugins/_mock/Dockerfile staging/src/k8s.io/ \
         --progress=plain;
@@ -136,18 +142,23 @@ main(){
     export ARTIFACTS="${ARTIFACTS:-${PWD}/_artifacts}"
     mkdir -p "${ARTIFACTS}"
 
-    export GO111MODULE=on;
-    go install sigs.k8s.io/kind@latest;
-    go install sigs.k8s.io/kubetest2@latest;
-    go install sigs.k8s.io/kubetest2/kubetest2-kind@latest;
-    go install sigs.k8s.io/kubetest2/kubetest2-tester-ginkgo@latest;
+    kube::golang::setup_env
+    (
+        # just while installing external tools
+        export GO111MODULE=on GOTOOLCHAIN=auto
+        # TODO: consider using specific versions to avoid surprise breaking changes
+        go install sigs.k8s.io/kind@latest
+        go install sigs.k8s.io/kubetest2@latest
+        go install sigs.k8s.io/kubetest2/kubetest2-kind@latest
+        go install sigs.k8s.io/kubetest2/kubetest2-tester-ginkgo@latest
+    )
 
     # The build e2e.test, ginkgo and kubectl binaries + copy to dockerized dir is
     # because of https://github.com/kubernetes-sigs/kubetest2/issues/184
-    make all WHAT="test/e2e/e2e.test vendor/github.com/onsi/ginkgo/v2/ginkgo cmd/kubectl";
+    make all WHAT="test/e2e/e2e.test vendor/github.com/onsi/ginkgo/v2/ginkgo cmd/kubectl"
     mkdir -p _output/dockerized/bin/linux/amd64;
     for binary in kubectl e2e.test ginkgo; do
-        cp -f _output/local/go/bin/${binary} _output/dockerized/bin/linux/amd64/${binary};
+        cp -f _output/local/go/bin/${binary} _output/dockerized/bin/linux/amd64/${binary}
     done;
 
     create_registry