diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 7b9ae7a35d..6cc9556cef 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -16,8 +16,8 @@ updates:
       # We manually update this from main and lock the commit in make/buf/all.mk
       - dependency-name: "github.com/bufbuild/protocompile"
       # This needs to be locked to the same version we generate with, which is
-      # controlled via dep_protoc_gen_connect_go.mk
-      - dependency-name: "github.com/bufbuild/connect-go"
+      # controlled via make/go/dep_protoc_gen_connect_go.mk
+      - dependency-name: "connectrpc.com/connect"
       # This needs to be locked to the same version we generate with, which is
       # controlled via make/go/dep_protoc_gen_go.mk
       - dependency-name: "google.golang.org/protobuf"
diff --git a/etc/windows/test.bash b/etc/windows/test.bash
index 90514e8ed3..6a4889a1a1 100644
--- a/etc/windows/test.bash
+++ b/etc/windows/test.bash
@@ -3,8 +3,8 @@
 set -eo pipefail
 
 PROTOC_VERSION="33.3"
-PROTOC_GEN_GO_VERSION="v1.36.6"
-CONNECT_VERSION="v1.18.1"
+PROTOC_GEN_GO_VERSION="v1.36.11"
+CONNECT_VERSION="v1.19.2"
 
 # Convert DOWNLOAD_CACHE from d:\path to /d/path
 DOWNLOAD_CACHE="$(echo "/${DOWNLOAD_CACHE}" | sed 's|\\|/|g' | sed 's/://')"
diff --git a/make/go/dep_buf.mk b/make/go/dep_buf.mk
index 303b972cd5..5eaca7f9ad 100644
--- a/make/go/dep_buf.mk
+++ b/make/go/dep_buf.mk
@@ -7,8 +7,8 @@ $(call _assert_var,CACHE_VERSIONS)
 $(call _assert_var,CACHE_BIN)
 
 # Settable
-# https://github.com/bufbuild/buf/releases 20260223 checked 20260223
-BUF_VERSION ?= v1.66.1
+# https://github.com/bufbuild/buf/releases 20260422 checked 20260422
+BUF_VERSION ?= v1.68.4
 # Settable
 #
 # If set, this path will be installed every time someone depends on $(BUF)
@@ -20,7 +20,7 @@ BUF_GO_INSTALL_PATH ?=
 ifneq ($(BUF_GO_INSTALL_PATH),)
 .PHONY: __goinstallbuf
 __goinstallbuf:
-	go install $(BUF_GO_INSTALL_PATH)
+	go install $(GO_INSTALL_EXTRA_FLAGS) $(BUF_GO_INSTALL_PATH)
 
 BUF := __goinstallbuf
 
diff --git a/make/go/dep_govulncheck.mk b/make/go/dep_govulncheck.mk
index 3693454c07..aa02abde1c 100644
--- a/make/go/dep_govulncheck.mk
+++ b/make/go/dep_govulncheck.mk
@@ -14,8 +14,8 @@ GOVULNCHECK_GOTOOLCHAIN_VERSION := $(shell go env GOVERSION | sed 's/^go//')
 GOVULNCHECK_GO_VERSION := $(shell echo $(GOVULNCHECK_GOTOOLCHAIN_VERSION) | cut -d'.' -f1-2)
 
 # Settable
-# https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck 20250106 checked 20250212
-GOVULNCHECK_VERSION ?= v1.1.4
+# https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck 20260410 checked 20260422
+GOVULNCHECK_VERSION ?= v1.2.0
 
 GOVULNCHECK := $(CACHE_BIN)/govulncheck
 
diff --git a/make/go/dep_protoc.mk b/make/go/dep_protoc.mk
index 3a6d1e2804..55060959e8 100644
--- a/make/go/dep_protoc.mk
+++ b/make/go/dep_protoc.mk
@@ -10,8 +10,9 @@ $(call _assert_var,CACHE_INCLUDE)
 $(call _assert_var,CACHE_BIN)
 
 # Settable
-# https://github.com/protocolbuffers/protobuf/releases 20250225 checked 20250310
+# https://github.com/protocolbuffers/protobuf/releases 20260109 checked 20260427
 # NOTE: Set to version compatible with genproto source code (only used in tests).
+# This version must be supported by the matching https://github.com/protocolbuffers/protobuf-go version.
 PROTOC_VERSION ?= 33.3
 
 # Google adds a dash to release candidate versions in the name of the
diff --git a/make/go/dep_protoc_gen_connect_go.mk b/make/go/dep_protoc_gen_connect_go.mk
index b3f0603719..79cbce11fa 100644
--- a/make/go/dep_protoc_gen_connect_go.mk
+++ b/make/go/dep_protoc_gen_connect_go.mk
@@ -7,8 +7,8 @@ $(call _assert_var,CACHE_VERSIONS)
 $(call _assert_var,CACHE_BIN)
 
 # Settable
-# https://github.com/connectrpc/connect-go 20251006 checked 20251013
-CONNECT_VERSION ?= v1.19.1
+# https://github.com/connectrpc/connect-go 20260420 checked 20260422
+CONNECT_VERSION ?= v1.19.2
 
 GO_GET_PKGS := $(GO_GET_PKGS) \
 	connectrpc.com/connect@$(CONNECT_VERSION)
diff --git a/make/go/go.mk b/make/go/go.mk
index ba63d36a87..e1cee4e74a 100644
--- a/make/go/go.mk
+++ b/make/go/go.mk
@@ -44,6 +44,12 @@ DISALLOW_NOLINT ?=
 BUFPRIVATEUSAGE_PKGS ?=
 # Settable
 BANDEPS_CONFIG ?=
+# Settable
+GO_BUILD_EXTRA_FLAGS ?=
+# Settable
+GO_INSTALL_EXTRA_FLAGS ?= $(GO_BUILD_EXTRA_FLAGS)
+# Settable
+GO_TEST_EXTRA_FLAGS ?= $(GO_BUILD_EXTRA_FLAGS)
 
 # Runtime
 GOPKGS ?= $(GO_ALL_REPO_PKGS)
@@ -56,9 +62,9 @@ COVER_HTML := $(TMP)/cover.html
 COVER_TXT := $(TMP)/cover.txt
 
 ifdef GONOTESTCACHE
-GO_TEST_FLAGS := -count=1
+GO_TEST_FLAGS := -count=1 $(GO_TEST_EXTRA_FLAGS)
 else
-GO_TEST_FLAGS :=
+GO_TEST_FLAGS := $(GO_TEST_EXTRA_FLAGS)
 endif
 
 
@@ -198,7 +204,7 @@ prebuild::
 
 .PHONY: build
 build: prebuild ## Run go build.
-	go build ./...
+	go build $(GO_BUILD_EXTRA_FLAGS) ./...
 
 .PHONY: pretest
 pretest::
@@ -244,7 +250,7 @@ install:: ## Install all go binaries.
 define gobinfunc
 .PHONY: install$(notdir $(1))
 install$(notdir $(1)):
-	go install ./$(1)
+	go install $(GO_INSTALL_EXTRA_FLAGS) ./$(1)
 
 install:: install$(notdir $(1))
 
@@ -264,7 +270,7 @@ installtest::
 define gotestbinfunc
 .PHONY: installtest$(notdir $(1))
 installtest$(notdir $(1)):
-	go install ./$(1)
+	go install $(GO_INSTALL_EXTRA_FLAGS) ./$(1)
 
 installtest:: installtest$(notdir $(1))
 endef
@@ -278,7 +284,7 @@ installtestwasm::
 define gotestwasmfunc
 .PHONY: installtestwasm$(notdir $(1))
 installtestwasm$(notdir $(1)):
-	GOOS=wasip1 GOARCH=wasm go build -o $(GOBIN)/$(notdir $(1)).wasm ./$(1)
+	GOOS=wasip1 GOARCH=wasm go build $(GO_BUILD_EXTRA_FLAGS) -o $(GOBIN)/$(notdir $(1)).wasm ./$(1)
 
 installtestwasm:: installtestwasm$(notdir $(1))
 endef