diff --git a/.github/workflows/go-ci.yml b/.github/workflows/go-ci.yml
index 17e8ae6926..ba885f473f 100644
--- a/.github/workflows/go-ci.yml
+++ b/.github/workflows/go-ci.yml
@@ -21,15 +21,10 @@ jobs:
         run: echo "go-version=$(grep 'golang' mise.toml | cut -d'"' -f2)" >> $GITHUB_OUTPUT
         shell: bash
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: sourcegraph/actions/go-setup@main
         with:
           go-version: ${{ steps.mise.outputs.go-version }}
-      - name: (Windows) Enable pulling Go modules from private sourcegraph/sourcegraph
-        if: runner.os == 'Windows'
-        run: git config --global url."https://$env:PRIVATE_TOKEN@github.com/sourcegraph/".insteadOf "/sourcegraph/"
-      - name: (Default) Enable pulling Go modules from private sourcegraph/sourcegraph
-        if: runner.os != 'Windows'
-        run: git config --global url."https://${PRIVATE_TOKEN}@github.com/sourcegraph/".insteadOf "/sourcegraph/"
+          private-token: ${{ secrets.PRIVATE_SG_ACCESS_TOKEN }}
       - run: |
           go test -race -v ./...
           go test -v ./...
diff --git a/.github/workflows/go-lint.yml b/.github/workflows/go-lint.yml
index d4a8ee3847..3f207b1d60 100644
--- a/.github/workflows/go-lint.yml
+++ b/.github/workflows/go-lint.yml
@@ -17,9 +17,8 @@ jobs:
         id: mise
         run: echo "go-version=$(grep 'golang' mise.toml | cut -d'"' -f2)" >> $GITHUB_OUTPUT
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: sourcegraph/actions/go-setup@main
         with:
           go-version: ${{ steps.mise.outputs.go-version }}
-      - name: Enable pulling Go modules from private sourcegraph/sourcegraph
-        run: git config --global url."https://${PRIVATE_TOKEN}@github.com/sourcegraph/".insteadOf "/sourcegraph/"
+          private-token: ${{ secrets.PRIVATE_SG_ACCESS_TOKEN }}
       - run: ./dev/go-lint.sh
diff --git a/.github/workflows/goreleaser-check.yml b/.github/workflows/goreleaser-check.yml
index 547e6a554c..ec07eab81c 100644
--- a/.github/workflows/goreleaser-check.yml
+++ b/.github/workflows/goreleaser-check.yml
@@ -20,11 +20,10 @@ jobs:
         id: mise
         run: echo "go-version=$(grep 'golang' mise.toml | cut -d'"' -f2)" >> $GITHUB_OUTPUT
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: sourcegraph/actions/go-setup@main
         with:
           go-version: ${{ steps.mise.outputs.go-version }}
-      - name: Enable pulling Go modules from private sourcegraph/sourcegraph
-        run: git config --global url."https://${PRIVATE_TOKEN}@github.com/sourcegraph/".insteadOf "/sourcegraph/"
+          private-token: ${{ secrets.PRIVATE_SG_ACCESS_TOKEN }}
       - name: Check GoReleaser config
         uses: goreleaser/goreleaser-action@v5
         with:
diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml
index 8f305d36a7..3da3999ecd 100644
--- a/.github/workflows/goreleaser.yml
+++ b/.github/workflows/goreleaser.yml
@@ -182,11 +182,10 @@ jobs:
         id: mise
         run: echo "go-version=$(grep 'golang' mise.toml | cut -d'"' -f2)" >> $GITHUB_OUTPUT
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: sourcegraph/actions/go-setup@main
         with:
           go-version: ${{ steps.mise.outputs.go-version }}
-      - name: Enable pulling Go modules from private sourcegraph/sourcegraph
-        run: git config --global url."https://${PRIVATE_TOKEN}@github.com/sourcegraph/".insteadOf "/sourcegraph/"
+          private-token: ${{ secrets.PRIVATE_SG_ACCESS_TOKEN }}
       - run: go test ./...
       - run: go test -race -v ./...
       - run: echo "${DOCKER_PASSWORD}" | docker login -u=$DOCKER_USERNAME --password-stdin
diff --git a/.github/workflows/scip.yml b/.github/workflows/scip.yml
index b546ea8bfa..d877ad14d7 100644
--- a/.github/workflows/scip.yml
+++ b/.github/workflows/scip.yml
@@ -15,9 +15,10 @@ jobs:
         id: mise
         run: echo "go-version=$(grep 'golang' mise.toml | cut -d'"' -f2)" >> $GITHUB_OUTPUT
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: sourcegraph/actions/go-setup@main
         with:
           go-version: ${{ steps.mise.outputs.go-version }}
+          private-token: ${{ secrets.PRIVATE_SG_ACCESS_TOKEN }}
 
       - name: Set directory to safe for git
         run: git config --global --add safe.directory $GITHUB_WORKSPACE
@@ -25,9 +26,6 @@ jobs:
       - name: Build src-cli
         run: go build -o ./src-cli ./cmd/src
 
-      - name: Enable pulling Go modules from private sourcegraph/sourcegraph
-        run: git config --global url."https://${PRIVATE_TOKEN}@github.com/sourcegraph/".insteadOf "/sourcegraph/"
-
       - name: Generate SCIP data
         run: scip-go
 
diff --git a/mise.toml b/mise.toml
index a1f15d3c03..959b476244 100644
--- a/mise.toml
+++ b/mise.toml
@@ -1,4 +1,4 @@
 [tools]
-golang = "1.25.4"
+golang = "1.25.6"
 shfmt = "3.8.0"
 shellcheck = "0.10.0"