diff --git a/hack/lib/golang.sh b/hack/lib/golang.sh
index 978ba6727e6..6af68ce42bc 100755
--- a/hack/lib/golang.sh
+++ b/hack/lib/golang.sh
@@ -504,7 +504,7 @@ kube::golang::set_platform_envs() {
 # Inputs:
 #   env-var GO_VERSION is the desired go version to use, downloading it if needed (defaults to content of .go-version)
 #   env-var FORCE_HOST_GO set to a non-empty value uses the go version in the $PATH and skips ensuring $GO_VERSION is used
-kube::golang::verify_go_version() {
+kube::golang::internal::verify_go_version() {
   # default GO_VERSION to content of .go-version
   GO_VERSION="${GO_VERSION:-"$(cat "${KUBE_ROOT}/.go-version")"}"
   if [ "${GOTOOLCHAIN:-auto}" != 'auto' ]; then
@@ -557,8 +557,6 @@ EOF
 #   env-var GOBIN is unset (we want binaries in a predictable place)
 #   env-var PATH includes the local GOPATH
 kube::golang::setup_env() {
-  kube::golang::verify_go_version
-
   # Even in module mode, we need to set GOPATH for `go build` and `go install`
   # to work.  We build various tools (usually via `go install`) from a lot of
   # scripts.
@@ -588,6 +586,10 @@ kube::golang::setup_env() {
 
   # Explicitly turn on modules.
   export GO111MODULE=on
+
+  # This may try to download our specific Go version.  Do it last so it uses
+  # the above-configured environment.
+  kube::golang::internal::verify_go_version
 }
 
 kube::golang::setup_gomaxprocs() {
diff --git a/hack/lib/protoc.sh b/hack/lib/protoc.sh
index 8fbf0e9ba0f..521bb3c5d9b 100644
--- a/hack/lib/protoc.sh
+++ b/hack/lib/protoc.sh
@@ -84,7 +84,7 @@ function kube::protoc::format() {
   cat hack/boilerplate/boilerplate.generatego.txt "${package}/api.pb.go" > tmpfile && mv tmpfile "${package}/api.pb.go"
 
   # Run gofmt to clean up the generated code.
-  kube::golang::verify_go_version
+  kube::golang::setup_env
   gofmt -s -w "${package}/api.pb.go"
 }
 
diff --git a/hack/lint-dependencies.sh b/hack/lint-dependencies.sh
index cc0e204f141..7ea765d55e3 100755
--- a/hack/lint-dependencies.sh
+++ b/hack/lint-dependencies.sh
@@ -36,7 +36,6 @@ if [[ "${GOPROXY:-}" == "off" ]]; then
 fi
 
 kube::golang::setup_env
-kube::golang::verify_go_version
 kube::util::require-jq
 
 # let us log all errors before we exit
diff --git a/hack/pin-dependency.sh b/hack/pin-dependency.sh
index 0ea148aab49..37984b82a06 100755
--- a/hack/pin-dependency.sh
+++ b/hack/pin-dependency.sh
@@ -26,7 +26,6 @@ KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
 kube::golang::setup_env
-kube::golang::verify_go_version
 kube::util::require-jq
 
 # Explicitly set GOFLAGS to ignore vendor, since GOFLAGS=-mod=vendor breaks dependency resolution while rebuilding vendor
diff --git a/hack/update-gofmt.sh b/hack/update-gofmt.sh
index 5cb40252678..b9e8bc53d88 100755
--- a/hack/update-gofmt.sh
+++ b/hack/update-gofmt.sh
@@ -23,7 +23,7 @@ set -o pipefail
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
-kube::golang::verify_go_version
+kube::golang::setup_env
 
 cd "${KUBE_ROOT}"
 
diff --git a/hack/update-import-aliases.sh b/hack/update-import-aliases.sh
index 98635fff260..3a7c7b67260 100755
--- a/hack/update-import-aliases.sh
+++ b/hack/update-import-aliases.sh
@@ -26,7 +26,6 @@ KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
 kube::golang::setup_env
-kube::golang::verify_go_version
 
 cd "${KUBE_ROOT}"
 
diff --git a/hack/update-internal-modules.sh b/hack/update-internal-modules.sh
index 4b81ca00afe..2b29b9f1688 100755
--- a/hack/update-internal-modules.sh
+++ b/hack/update-internal-modules.sh
@@ -36,7 +36,6 @@ if [[ "${GOPROXY:-}" == "off" ]]; then
 fi
 
 kube::golang::setup_env
-kube::golang::verify_go_version
 
 for mod in "${MODULES[@]}"; do
   pushd "${KUBE_ROOT}/${mod}" >/dev/null
diff --git a/hack/update-mocks.sh b/hack/update-mocks.sh
index a76b8b139ce..55544106680 100755
--- a/hack/update-mocks.sh
+++ b/hack/update-mocks.sh
@@ -24,7 +24,6 @@ set -o pipefail
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
-kube::golang::verify_go_version
 kube::golang::setup_env
 
 echo 'installing mockgen'
diff --git a/hack/update-netparse-cve.sh b/hack/update-netparse-cve.sh
index 44fca785f59..4860657e586 100755
--- a/hack/update-netparse-cve.sh
+++ b/hack/update-netparse-cve.sh
@@ -29,7 +29,6 @@ source "${KUBE_ROOT}/hack/lib/init.sh"
 source "${KUBE_ROOT}/hack/lib/util.sh"
 
 kube::golang::setup_env
-kube::golang::verify_go_version
 
 # Ensure that we find the binaries we build before anything else.
 export GOBIN="${KUBE_OUTPUT_BIN}"
diff --git a/hack/update-vendor.sh b/hack/update-vendor.sh
index 327406aa4b1..c416239b3e6 100755
--- a/hack/update-vendor.sh
+++ b/hack/update-vendor.sh
@@ -26,7 +26,6 @@ source "${KUBE_ROOT}/hack/lib/init.sh"
 
 # Get all the default Go environment.
 kube::golang::setup_env
-kube::golang::verify_go_version
 
 # Turn off workspaces until we are ready for them later
 export GOWORK=off
diff --git a/hack/verify-conformance-requirements.sh b/hack/verify-conformance-requirements.sh
index a9293a728f7..50419cc8955 100755
--- a/hack/verify-conformance-requirements.sh
+++ b/hack/verify-conformance-requirements.sh
@@ -26,7 +26,6 @@ KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 source "${KUBE_ROOT}/hack/lib/util.sh"
 
-kube::golang::verify_go_version
 kube::golang::setup_env
 
 cd "${KUBE_ROOT}"
diff --git a/hack/verify-e2e-suites.sh b/hack/verify-e2e-suites.sh
index 1235a838c37..fc18621d990 100755
--- a/hack/verify-e2e-suites.sh
+++ b/hack/verify-e2e-suites.sh
@@ -25,7 +25,7 @@ KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 source "${KUBE_ROOT}/hack/lib/util.sh"
 
-kube::golang::verify_go_version
+kube::golang::setup_env
 
 cd "${KUBE_ROOT}"
 
diff --git a/hack/verify-external-dependencies-version.sh b/hack/verify-external-dependencies-version.sh
index 5419c860875..2bbdf168412 100755
--- a/hack/verify-external-dependencies-version.sh
+++ b/hack/verify-external-dependencies-version.sh
@@ -25,7 +25,6 @@ KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
 kube::golang::setup_env
-kube::golang::verify_go_version
 
 # Ensure that we find the binaries we build before anything else.
 export GOBIN="${KUBE_OUTPUT_BIN}"
diff --git a/hack/verify-golangci-lint.sh b/hack/verify-golangci-lint.sh
index 8531a2db7d6..80559dd6407 100755
--- a/hack/verify-golangci-lint.sh
+++ b/hack/verify-golangci-lint.sh
@@ -45,7 +45,6 @@ source "${KUBE_ROOT}/hack/lib/init.sh"
 source "${KUBE_ROOT}/hack/lib/util.sh"
 
 kube::golang::setup_env
-kube::golang::verify_go_version
 export GOBIN="${KUBE_OUTPUT_BIN}"
 
 kube::util::require-jq
diff --git a/hack/verify-import-aliases.sh b/hack/verify-import-aliases.sh
index b7bded72d24..a15497c5723 100755
--- a/hack/verify-import-aliases.sh
+++ b/hack/verify-import-aliases.sh
@@ -26,7 +26,6 @@ KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
 kube::golang::setup_env
-kube::golang::verify_go_version
 
 cd "${KUBE_ROOT}"
 
diff --git a/hack/verify-no-vendor-cycles.sh b/hack/verify-no-vendor-cycles.sh
index 6a5888c039c..eaa3f82fe11 100755
--- a/hack/verify-no-vendor-cycles.sh
+++ b/hack/verify-no-vendor-cycles.sh
@@ -26,7 +26,6 @@ KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
 kube::golang::setup_env
-kube::golang::verify_go_version
 
 staging_repos=()
 kube::util::read-array staging_repos < <(kube::util::list_staging_repos)
diff --git a/hack/verify-typecheck.sh b/hack/verify-typecheck.sh
index 99ea3b1e3fd..685e50b24ae 100755
--- a/hack/verify-typecheck.sh
+++ b/hack/verify-typecheck.sh
@@ -26,7 +26,6 @@ source "${KUBE_ROOT}/hack/lib/init.sh"
 cd "${KUBE_ROOT}"
 
 kube::golang::setup_env
-kube::golang::verify_go_version
 
 ret=0
 TYPECHECK_SERIAL="${TYPECHECK_SERIAL:-false}"
diff --git a/test/instrumentation/stability-utils.sh b/test/instrumentation/stability-utils.sh
index a0495e9519b..fd7d1fb0157 100755
--- a/test/instrumentation/stability-utils.sh
+++ b/test/instrumentation/stability-utils.sh
@@ -23,7 +23,6 @@ source "${KUBE_ROOT}/hack/lib/init.sh"
 source "${KUBE_ROOT}/hack/lib/util.sh"
 
 stability_check_setup() {
-  kube::golang::verify_go_version
   kube::util::ensure-temp-dir
   cd "${KUBE_ROOT}"
   kube::golang::setup_env