diff --git a/.github/workflows/munge.sh b/.github/workflows/munge.sh
index ba4df569..c03a9a7a 100755
--- a/.github/workflows/munge.sh
+++ b/.github/workflows/munge.sh
@@ -10,6 +10,7 @@ jq '
 		.matrix.include[]
 		| select(.name | test(" (.+)") | not) # ignore any existing munged builds
 		| select(.os | startswith("windows-") | not) # ignore Windows (always downloads)
+		| select(any(.meta.entries[].tags[]; contains("golang:1.20"))) # https://github.com/docker-library/golang/pull/500#issuecomment-1863578601
 		| .name += " (force build)"
 		| .runs.build = ([
 			"# update versions.json to force us to build Go instead of downloading it",
diff --git a/1.20/alpine3.18/Dockerfile b/1.20/alpine3.18/Dockerfile
index 07d9ef53..99d892d2 100644
--- a/1.20/alpine3.18/Dockerfile
+++ b/1.20/alpine3.18/Dockerfile
@@ -49,7 +49,7 @@ RUN set -eux; \
 		build=1; \
 		url='https://dl.google.com/go/go1.20.12.src.tar.gz'; \
 		sha256='c5bf934751d31c315c1d0bb5fb02296545fa6d08923566f7a5afec81f2ed27d6'; \
-# the precompiled binaries published by Go upstream are not compatible with Alpine, so we always build from source here 😅
+# the precompiled binaries published by Go upstream were not compatible with Alpine in Go 1.20, so we always build from source here 😅
 	fi; \
 	\
 	wget -O go.tgz.asc "$url.asc"; \
diff --git a/1.20/alpine3.19/Dockerfile b/1.20/alpine3.19/Dockerfile
index 91e76af4..ddd80a50 100644
--- a/1.20/alpine3.19/Dockerfile
+++ b/1.20/alpine3.19/Dockerfile
@@ -49,7 +49,7 @@ RUN set -eux; \
 		build=1; \
 		url='https://dl.google.com/go/go1.20.12.src.tar.gz'; \
 		sha256='c5bf934751d31c315c1d0bb5fb02296545fa6d08923566f7a5afec81f2ed27d6'; \
-# the precompiled binaries published by Go upstream are not compatible with Alpine, so we always build from source here 😅
+# the precompiled binaries published by Go upstream were not compatible with Alpine in Go 1.20, so we always build from source here 😅
 	fi; \
 	\
 	wget -O go.tgz.asc "$url.asc"; \
diff --git a/1.21/alpine3.18/Dockerfile b/1.21/alpine3.18/Dockerfile
index 3f3d9f4f..675a35a7 100644
--- a/1.21/alpine3.18/Dockerfile
+++ b/1.21/alpine3.18/Dockerfile
@@ -51,16 +51,6 @@ RUN set -eux; \
 			;; \
 		*) echo >&2 "error: unsupported architecture '$arch' (likely packaging update needed)"; exit 1 ;; \
 	esac; \
-	build=; \
-	if [ -z "$url" ]; then \
-# https://github.com/golang/go/issues/38536#issuecomment-616897960
-		build=1; \
-		url='https://dl.google.com/go/go1.21.5.src.tar.gz'; \
-		sha256='285cbbdf4b6e6e62ed58f370f3f6d8c30825d6e56c5853c66d3c23bcdb09db19'; \
-		echo >&2; \
-		echo >&2 "warning: current architecture ($arch) does not have a compatible Go binary release; will be building from source"; \
-		echo >&2; \
-	fi; \
 	\
 	wget -O go.tgz.asc "$url.asc"; \
 	wget -O go.tgz "$url"; \
@@ -79,50 +69,6 @@ RUN set -eux; \
 	tar -C /usr/local -xzf go.tgz; \
 	rm go.tgz; \
 	\
-	if [ -n "$build" ]; then \
-		apk add --no-cache --virtual .build-deps \
-			bash \
-			gcc \
-			go \
-			musl-dev \
-		; \
-		\
-		export GOCACHE='/tmp/gocache'; \
-		\
-		( \
-			cd /usr/local/go/src; \
-# set GOROOT_BOOTSTRAP + GOHOST* such that we can build Go successfully
-			export GOROOT_BOOTSTRAP="$(go env GOROOT)" GOHOSTOS="$GOOS" GOHOSTARCH="$GOARCH"; \
-			if [ "${GOARCH:-}" = '386' ]; then \
-# https://github.com/golang/go/issues/52919; https://github.com/docker-library/golang/pull/426#issuecomment-1152623837
-				export CGO_CFLAGS='-fno-stack-protector'; \
-			fi; \
-			./make.bash; \
-		); \
-		\
-		apk del --no-network .build-deps; \
-		\
-# remove a few intermediate / bootstrapping files the official binary release tarballs do not contain
-		rm -rf \
-			/usr/local/go/pkg/*/cmd \
-			/usr/local/go/pkg/bootstrap \
-			/usr/local/go/pkg/obj \
-			/usr/local/go/pkg/tool/*/api \
-			/usr/local/go/pkg/tool/*/go_bootstrap \
-			/usr/local/go/src/cmd/dist/dist \
-			"$GOCACHE" \
-		; \
-	elif [ "$arch" = 'armv7' ]; then \
-		[ -s /usr/local/go/go.env ]; \
-		before="$(go env GOARM)"; [ "$before" != '7' ]; \
-		{ \
-			echo; \
-			echo '# https://github.com/docker-library/golang/issues/494'; \
-			echo 'GOARM=7'; \
-		} >> /usr/local/go/go.env; \
-		after="$(go env GOARM)"; [ "$after" = '7' ]; \
-	fi; \
-	\
 	apk del --no-network .fetch-deps; \
 	\
 	go version
diff --git a/1.21/alpine3.19/Dockerfile b/1.21/alpine3.19/Dockerfile
index 44b083f7..0670a867 100644
--- a/1.21/alpine3.19/Dockerfile
+++ b/1.21/alpine3.19/Dockerfile
@@ -51,16 +51,6 @@ RUN set -eux; \
 			;; \
 		*) echo >&2 "error: unsupported architecture '$arch' (likely packaging update needed)"; exit 1 ;; \
 	esac; \
-	build=; \
-	if [ -z "$url" ]; then \
-# https://github.com/golang/go/issues/38536#issuecomment-616897960
-		build=1; \
-		url='https://dl.google.com/go/go1.21.5.src.tar.gz'; \
-		sha256='285cbbdf4b6e6e62ed58f370f3f6d8c30825d6e56c5853c66d3c23bcdb09db19'; \
-		echo >&2; \
-		echo >&2 "warning: current architecture ($arch) does not have a compatible Go binary release; will be building from source"; \
-		echo >&2; \
-	fi; \
 	\
 	wget -O go.tgz.asc "$url.asc"; \
 	wget -O go.tgz "$url"; \
@@ -79,50 +69,6 @@ RUN set -eux; \
 	tar -C /usr/local -xzf go.tgz; \
 	rm go.tgz; \
 	\
-	if [ -n "$build" ]; then \
-		apk add --no-cache --virtual .build-deps \
-			bash \
-			gcc \
-			go \
-			musl-dev \
-		; \
-		\
-		export GOCACHE='/tmp/gocache'; \
-		\
-		( \
-			cd /usr/local/go/src; \
-# set GOROOT_BOOTSTRAP + GOHOST* such that we can build Go successfully
-			export GOROOT_BOOTSTRAP="$(go env GOROOT)" GOHOSTOS="$GOOS" GOHOSTARCH="$GOARCH"; \
-			if [ "${GOARCH:-}" = '386' ]; then \
-# https://github.com/golang/go/issues/52919; https://github.com/docker-library/golang/pull/426#issuecomment-1152623837
-				export CGO_CFLAGS='-fno-stack-protector'; \
-			fi; \
-			./make.bash; \
-		); \
-		\
-		apk del --no-network .build-deps; \
-		\
-# remove a few intermediate / bootstrapping files the official binary release tarballs do not contain
-		rm -rf \
-			/usr/local/go/pkg/*/cmd \
-			/usr/local/go/pkg/bootstrap \
-			/usr/local/go/pkg/obj \
-			/usr/local/go/pkg/tool/*/api \
-			/usr/local/go/pkg/tool/*/go_bootstrap \
-			/usr/local/go/src/cmd/dist/dist \
-			"$GOCACHE" \
-		; \
-	elif [ "$arch" = 'armv7' ]; then \
-		[ -s /usr/local/go/go.env ]; \
-		before="$(go env GOARM)"; [ "$before" != '7' ]; \
-		{ \
-			echo; \
-			echo '# https://github.com/docker-library/golang/issues/494'; \
-			echo 'GOARM=7'; \
-		} >> /usr/local/go/go.env; \
-		after="$(go env GOARM)"; [ "$after" = '7' ]; \
-	fi; \
-	\
 	apk del --no-network .fetch-deps; \
 	\
 	go version
diff --git a/1.21/bookworm/Dockerfile b/1.21/bookworm/Dockerfile
index def7f931..a08b58c8 100644
--- a/1.21/bookworm/Dockerfile
+++ b/1.21/bookworm/Dockerfile
@@ -30,9 +30,6 @@ RUN set -eux; \
 			url='https://dl.google.com/go/go1.21.5.linux-amd64.tar.gz'; \
 			sha256='e2bc0b3e4b64111ec117295c088bde5f00eeed1567999ff77bc859d7df70078e'; \
 			;; \
-		'armel') \
-			export GOARCH='arm' GOARM='5' GOOS='linux'; \
-			;; \
 		'armhf') \
 			url='https://dl.google.com/go/go1.21.5.linux-armv6l.tar.gz'; \
 			sha256='837f4bf4e22fcdf920ffeaa4abf3d02d1314e03725431065f4d44c46a01b42fe'; \
@@ -63,16 +60,6 @@ RUN set -eux; \
 			;; \
 		*) echo >&2 "error: unsupported architecture '$arch' (likely packaging update needed)"; exit 1 ;; \
 	esac; \
-	build=; \
-	if [ -z "$url" ]; then \
-# https://github.com/golang/go/issues/38536#issuecomment-616897960
-		build=1; \
-		url='https://dl.google.com/go/go1.21.5.src.tar.gz'; \
-		sha256='285cbbdf4b6e6e62ed58f370f3f6d8c30825d6e56c5853c66d3c23bcdb09db19'; \
-		echo >&2; \
-		echo >&2 "warning: current architecture ($arch) does not have a compatible Go binary release; will be building from source"; \
-		echo >&2; \
-	fi; \
 	\
 	wget -O go.tgz.asc "$url.asc"; \
 	wget -O go.tgz "$url" --progress=dot:giga; \
@@ -91,46 +78,6 @@ RUN set -eux; \
 	tar -C /usr/local -xzf go.tgz; \
 	rm go.tgz; \
 	\
-	if [ -n "$build" ]; then \
-		savedAptMark="$(apt-mark showmanual)"; \
-		apt-get update; \
-		apt-get install -y --no-install-recommends golang-go; \
-		\
-		export GOCACHE='/tmp/gocache'; \
-		\
-		( \
-			cd /usr/local/go/src; \
-# set GOROOT_BOOTSTRAP + GOHOST* such that we can build Go successfully
-			export GOROOT_BOOTSTRAP="$(go env GOROOT)" GOHOSTOS="$GOOS" GOHOSTARCH="$GOARCH"; \
-			./make.bash; \
-		); \
-		\
-		apt-mark auto '.*' > /dev/null; \
-		apt-mark manual $savedAptMark > /dev/null; \
-		apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
-		rm -rf /var/lib/apt/lists/*; \
-		\
-# remove a few intermediate / bootstrapping files the official binary release tarballs do not contain
-		rm -rf \
-			/usr/local/go/pkg/*/cmd \
-			/usr/local/go/pkg/bootstrap \
-			/usr/local/go/pkg/obj \
-			/usr/local/go/pkg/tool/*/api \
-			/usr/local/go/pkg/tool/*/go_bootstrap \
-			/usr/local/go/src/cmd/dist/dist \
-			"$GOCACHE" \
-		; \
-	elif [ "$arch" = 'armhf' ]; then \
-		[ -s /usr/local/go/go.env ]; \
-		before="$(go env GOARM)"; [ "$before" != '7' ]; \
-		{ \
-			echo; \
-			echo '# https://github.com/docker-library/golang/issues/494'; \
-			echo 'GOARM=7'; \
-		} >> /usr/local/go/go.env; \
-		after="$(go env GOARM)"; [ "$after" = '7' ]; \
-	fi; \
-	\
 	go version
 
 # don't auto-upgrade the gotoolchain
diff --git a/1.21/bullseye/Dockerfile b/1.21/bullseye/Dockerfile
index 0b1349c6..2b9fe697 100644
--- a/1.21/bullseye/Dockerfile
+++ b/1.21/bullseye/Dockerfile
@@ -30,9 +30,6 @@ RUN set -eux; \
 			url='https://dl.google.com/go/go1.21.5.linux-amd64.tar.gz'; \
 			sha256='e2bc0b3e4b64111ec117295c088bde5f00eeed1567999ff77bc859d7df70078e'; \
 			;; \
-		'armel') \
-			export GOARCH='arm' GOARM='5' GOOS='linux'; \
-			;; \
 		'armhf') \
 			url='https://dl.google.com/go/go1.21.5.linux-armv6l.tar.gz'; \
 			sha256='837f4bf4e22fcdf920ffeaa4abf3d02d1314e03725431065f4d44c46a01b42fe'; \
@@ -63,16 +60,6 @@ RUN set -eux; \
 			;; \
 		*) echo >&2 "error: unsupported architecture '$arch' (likely packaging update needed)"; exit 1 ;; \
 	esac; \
-	build=; \
-	if [ -z "$url" ]; then \
-# https://github.com/golang/go/issues/38536#issuecomment-616897960
-		build=1; \
-		url='https://dl.google.com/go/go1.21.5.src.tar.gz'; \
-		sha256='285cbbdf4b6e6e62ed58f370f3f6d8c30825d6e56c5853c66d3c23bcdb09db19'; \
-		echo >&2; \
-		echo >&2 "warning: current architecture ($arch) does not have a compatible Go binary release; will be building from source"; \
-		echo >&2; \
-	fi; \
 	\
 	wget -O go.tgz.asc "$url.asc"; \
 	wget -O go.tgz "$url" --progress=dot:giga; \
@@ -91,52 +78,6 @@ RUN set -eux; \
 	tar -C /usr/local -xzf go.tgz; \
 	rm go.tgz; \
 	\
-	if [ -n "$build" ]; then \
-		savedAptMark="$(apt-mark showmanual)"; \
-# add backports for newer go version for bootstrap build: https://github.com/golang/go/issues/44505
-		( \
-			. /etc/os-release; \
-			echo "deb https://deb.debian.org/debian $VERSION_CODENAME-backports main" > /etc/apt/sources.list.d/backports.list; \
-			\
-			apt-get update; \
-			apt-get install -y --no-install-recommends -t "$VERSION_CODENAME-backports" golang-go; \
-		); \
-		\
-		export GOCACHE='/tmp/gocache'; \
-		\
-		( \
-			cd /usr/local/go/src; \
-# set GOROOT_BOOTSTRAP + GOHOST* such that we can build Go successfully
-			export GOROOT_BOOTSTRAP="$(go env GOROOT)" GOHOSTOS="$GOOS" GOHOSTARCH="$GOARCH"; \
-			./make.bash; \
-		); \
-		\
-		apt-mark auto '.*' > /dev/null; \
-		apt-mark manual $savedAptMark > /dev/null; \
-		apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
-		rm -rf /var/lib/apt/lists/*; \
-		\
-# remove a few intermediate / bootstrapping files the official binary release tarballs do not contain
-		rm -rf \
-			/usr/local/go/pkg/*/cmd \
-			/usr/local/go/pkg/bootstrap \
-			/usr/local/go/pkg/obj \
-			/usr/local/go/pkg/tool/*/api \
-			/usr/local/go/pkg/tool/*/go_bootstrap \
-			/usr/local/go/src/cmd/dist/dist \
-			"$GOCACHE" \
-		; \
-	elif [ "$arch" = 'armhf' ]; then \
-		[ -s /usr/local/go/go.env ]; \
-		before="$(go env GOARM)"; [ "$before" != '7' ]; \
-		{ \
-			echo; \
-			echo '# https://github.com/docker-library/golang/issues/494'; \
-			echo 'GOARM=7'; \
-		} >> /usr/local/go/go.env; \
-		after="$(go env GOARM)"; [ "$after" = '7' ]; \
-	fi; \
-	\
 	go version
 
 # don't auto-upgrade the gotoolchain
diff --git a/1.22-rc/alpine3.18/Dockerfile b/1.22-rc/alpine3.18/Dockerfile
new file mode 100644
index 00000000..81c54072
--- /dev/null
+++ b/1.22-rc/alpine3.18/Dockerfile
@@ -0,0 +1,83 @@
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
+FROM alpine:3.18
+
+RUN apk add --no-cache ca-certificates
+
+ENV PATH /usr/local/go/bin:$PATH
+
+ENV GOLANG_VERSION 1.22rc1
+
+RUN set -eux; \
+	apk add --no-cache --virtual .fetch-deps gnupg; \
+	arch="$(apk --print-arch)"; \
+	url=; \
+	case "$arch" in \
+		'x86_64') \
+			url='https://dl.google.com/go/go1.22rc1.linux-amd64.tar.gz'; \
+			sha256='fbe9d0585b9322d44008f6baf78b391b22f64294338c6ce2b9eb6040d6373c52'; \
+			;; \
+		'armhf') \
+			url='https://dl.google.com/go/go1.22rc1.linux-armv6l.tar.gz'; \
+			sha256='78e86eb1f449d88692829f1d794cd9f696b66c4f5e25f4ceb4ddd3ad7bee3683'; \
+			;; \
+		'armv7') \
+			url='https://dl.google.com/go/go1.22rc1.linux-armv6l.tar.gz'; \
+			sha256='78e86eb1f449d88692829f1d794cd9f696b66c4f5e25f4ceb4ddd3ad7bee3683'; \
+			;; \
+		'aarch64') \
+			url='https://dl.google.com/go/go1.22rc1.linux-arm64.tar.gz'; \
+			sha256='d777d6bc3241bcd470603c3af896d1c60ed1d8cc718cf92d0a5d9035b149a827'; \
+			;; \
+		'x86') \
+			url='https://dl.google.com/go/go1.22rc1.linux-386.tar.gz'; \
+			sha256='85ea68ef2fbd0d28179a8852401f498cb02dd7a2d688e71e54ee6180a790d105'; \
+			;; \
+		'ppc64le') \
+			url='https://dl.google.com/go/go1.22rc1.linux-ppc64le.tar.gz'; \
+			sha256='051d68e1fb9c804db0c5ecf856493ccf7611f6b05424bfe6d6a03ce03e5dbb24'; \
+			;; \
+		'riscv64') \
+			url='https://dl.google.com/go/go1.22rc1.linux-riscv64.tar.gz'; \
+			sha256='f7c9d98683f52004bc9942a6ac4ae628f89070446f24ad5451404ad7ee27682a'; \
+			;; \
+		's390x') \
+			url='https://dl.google.com/go/go1.22rc1.linux-s390x.tar.gz'; \
+			sha256='29e6b990a47cb3942e72208e91e370b3620119d0a7dcb2a58de57bde7716fc2b'; \
+			;; \
+		*) echo >&2 "error: unsupported architecture '$arch' (likely packaging update needed)"; exit 1 ;; \
+	esac; \
+	\
+	wget -O go.tgz.asc "$url.asc"; \
+	wget -O go.tgz "$url"; \
+	echo "$sha256 *go.tgz" | sha256sum -c -; \
+	\
+# https://github.com/golang/go/issues/14739#issuecomment-324767697
+	GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
+# https://www.google.com/linuxrepositories/
+	gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 'EB4C 1BFD 4F04 2F6D DDCC  EC91 7721 F63B D38B 4796'; \
+# let's also fetch the specific subkey of that key explicitly that we expect "go.tgz.asc" to be signed by, just to make sure we definitely have it
+	gpg --batch --keyserver keyserver.ubuntu.com --recv-keys '2F52 8D36 D67B 69ED F998  D857 78BD 6547 3CB3 BD13'; \
+	gpg --batch --verify go.tgz.asc go.tgz; \
+	gpgconf --kill all; \
+	rm -rf "$GNUPGHOME" go.tgz.asc; \
+	\
+	tar -C /usr/local -xzf go.tgz; \
+	rm go.tgz; \
+	\
+	apk del --no-network .fetch-deps; \
+	\
+	go version
+
+# don't auto-upgrade the gotoolchain
+# https://github.com/docker-library/golang/issues/472
+ENV GOTOOLCHAIN=local
+
+ENV GOPATH /go
+ENV PATH $GOPATH/bin:$PATH
+RUN mkdir -p "$GOPATH/src" "$GOPATH/bin" && chmod -R 1777 "$GOPATH"
+WORKDIR $GOPATH
diff --git a/1.22-rc/alpine3.19/Dockerfile b/1.22-rc/alpine3.19/Dockerfile
new file mode 100644
index 00000000..f9049f85
--- /dev/null
+++ b/1.22-rc/alpine3.19/Dockerfile
@@ -0,0 +1,83 @@
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
+FROM alpine:3.19
+
+RUN apk add --no-cache ca-certificates
+
+ENV PATH /usr/local/go/bin:$PATH
+
+ENV GOLANG_VERSION 1.22rc1
+
+RUN set -eux; \
+	apk add --no-cache --virtual .fetch-deps gnupg; \
+	arch="$(apk --print-arch)"; \
+	url=; \
+	case "$arch" in \
+		'x86_64') \
+			url='https://dl.google.com/go/go1.22rc1.linux-amd64.tar.gz'; \
+			sha256='fbe9d0585b9322d44008f6baf78b391b22f64294338c6ce2b9eb6040d6373c52'; \
+			;; \
+		'armhf') \
+			url='https://dl.google.com/go/go1.22rc1.linux-armv6l.tar.gz'; \
+			sha256='78e86eb1f449d88692829f1d794cd9f696b66c4f5e25f4ceb4ddd3ad7bee3683'; \
+			;; \
+		'armv7') \
+			url='https://dl.google.com/go/go1.22rc1.linux-armv6l.tar.gz'; \
+			sha256='78e86eb1f449d88692829f1d794cd9f696b66c4f5e25f4ceb4ddd3ad7bee3683'; \
+			;; \
+		'aarch64') \
+			url='https://dl.google.com/go/go1.22rc1.linux-arm64.tar.gz'; \
+			sha256='d777d6bc3241bcd470603c3af896d1c60ed1d8cc718cf92d0a5d9035b149a827'; \
+			;; \
+		'x86') \
+			url='https://dl.google.com/go/go1.22rc1.linux-386.tar.gz'; \
+			sha256='85ea68ef2fbd0d28179a8852401f498cb02dd7a2d688e71e54ee6180a790d105'; \
+			;; \
+		'ppc64le') \
+			url='https://dl.google.com/go/go1.22rc1.linux-ppc64le.tar.gz'; \
+			sha256='051d68e1fb9c804db0c5ecf856493ccf7611f6b05424bfe6d6a03ce03e5dbb24'; \
+			;; \
+		'riscv64') \
+			url='https://dl.google.com/go/go1.22rc1.linux-riscv64.tar.gz'; \
+			sha256='f7c9d98683f52004bc9942a6ac4ae628f89070446f24ad5451404ad7ee27682a'; \
+			;; \
+		's390x') \
+			url='https://dl.google.com/go/go1.22rc1.linux-s390x.tar.gz'; \
+			sha256='29e6b990a47cb3942e72208e91e370b3620119d0a7dcb2a58de57bde7716fc2b'; \
+			;; \
+		*) echo >&2 "error: unsupported architecture '$arch' (likely packaging update needed)"; exit 1 ;; \
+	esac; \
+	\
+	wget -O go.tgz.asc "$url.asc"; \
+	wget -O go.tgz "$url"; \
+	echo "$sha256 *go.tgz" | sha256sum -c -; \
+	\
+# https://github.com/golang/go/issues/14739#issuecomment-324767697
+	GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
+# https://www.google.com/linuxrepositories/
+	gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 'EB4C 1BFD 4F04 2F6D DDCC  EC91 7721 F63B D38B 4796'; \
+# let's also fetch the specific subkey of that key explicitly that we expect "go.tgz.asc" to be signed by, just to make sure we definitely have it
+	gpg --batch --keyserver keyserver.ubuntu.com --recv-keys '2F52 8D36 D67B 69ED F998  D857 78BD 6547 3CB3 BD13'; \
+	gpg --batch --verify go.tgz.asc go.tgz; \
+	gpgconf --kill all; \
+	rm -rf "$GNUPGHOME" go.tgz.asc; \
+	\
+	tar -C /usr/local -xzf go.tgz; \
+	rm go.tgz; \
+	\
+	apk del --no-network .fetch-deps; \
+	\
+	go version
+
+# don't auto-upgrade the gotoolchain
+# https://github.com/docker-library/golang/issues/472
+ENV GOTOOLCHAIN=local
+
+ENV GOPATH /go
+ENV PATH $GOPATH/bin:$PATH
+RUN mkdir -p "$GOPATH/src" "$GOPATH/bin" && chmod -R 1777 "$GOPATH"
+WORKDIR $GOPATH
diff --git a/1.22-rc/bookworm/Dockerfile b/1.22-rc/bookworm/Dockerfile
new file mode 100644
index 00000000..e10376a4
--- /dev/null
+++ b/1.22-rc/bookworm/Dockerfile
@@ -0,0 +1,90 @@
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
+FROM buildpack-deps:bookworm-scm
+
+# install cgo-related dependencies
+RUN set -eux; \
+	apt-get update; \
+	apt-get install -y --no-install-recommends \
+		g++ \
+		gcc \
+		libc6-dev \
+		make \
+		pkg-config \
+	; \
+	rm -rf /var/lib/apt/lists/*
+
+ENV PATH /usr/local/go/bin:$PATH
+
+ENV GOLANG_VERSION 1.22rc1
+
+RUN set -eux; \
+	arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; \
+	url=; \
+	case "$arch" in \
+		'amd64') \
+			url='https://dl.google.com/go/go1.22rc1.linux-amd64.tar.gz'; \
+			sha256='fbe9d0585b9322d44008f6baf78b391b22f64294338c6ce2b9eb6040d6373c52'; \
+			;; \
+		'armhf') \
+			url='https://dl.google.com/go/go1.22rc1.linux-armv6l.tar.gz'; \
+			sha256='78e86eb1f449d88692829f1d794cd9f696b66c4f5e25f4ceb4ddd3ad7bee3683'; \
+			;; \
+		'arm64') \
+			url='https://dl.google.com/go/go1.22rc1.linux-arm64.tar.gz'; \
+			sha256='d777d6bc3241bcd470603c3af896d1c60ed1d8cc718cf92d0a5d9035b149a827'; \
+			;; \
+		'i386') \
+			url='https://dl.google.com/go/go1.22rc1.linux-386.tar.gz'; \
+			sha256='85ea68ef2fbd0d28179a8852401f498cb02dd7a2d688e71e54ee6180a790d105'; \
+			;; \
+		'mips64el') \
+			url='https://dl.google.com/go/go1.22rc1.linux-mips64le.tar.gz'; \
+			sha256='c424d3145bb770b5fc04e0b2316cbb9be34724ba66e83c83659830835ef698f9'; \
+			;; \
+		'ppc64el') \
+			url='https://dl.google.com/go/go1.22rc1.linux-ppc64le.tar.gz'; \
+			sha256='051d68e1fb9c804db0c5ecf856493ccf7611f6b05424bfe6d6a03ce03e5dbb24'; \
+			;; \
+		'riscv64') \
+			url='https://dl.google.com/go/go1.22rc1.linux-riscv64.tar.gz'; \
+			sha256='f7c9d98683f52004bc9942a6ac4ae628f89070446f24ad5451404ad7ee27682a'; \
+			;; \
+		's390x') \
+			url='https://dl.google.com/go/go1.22rc1.linux-s390x.tar.gz'; \
+			sha256='29e6b990a47cb3942e72208e91e370b3620119d0a7dcb2a58de57bde7716fc2b'; \
+			;; \
+		*) echo >&2 "error: unsupported architecture '$arch' (likely packaging update needed)"; exit 1 ;; \
+	esac; \
+	\
+	wget -O go.tgz.asc "$url.asc"; \
+	wget -O go.tgz "$url" --progress=dot:giga; \
+	echo "$sha256 *go.tgz" | sha256sum -c -; \
+	\
+# https://github.com/golang/go/issues/14739#issuecomment-324767697
+	GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
+# https://www.google.com/linuxrepositories/
+	gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 'EB4C 1BFD 4F04 2F6D DDCC  EC91 7721 F63B D38B 4796'; \
+# let's also fetch the specific subkey of that key explicitly that we expect "go.tgz.asc" to be signed by, just to make sure we definitely have it
+	gpg --batch --keyserver keyserver.ubuntu.com --recv-keys '2F52 8D36 D67B 69ED F998  D857 78BD 6547 3CB3 BD13'; \
+	gpg --batch --verify go.tgz.asc go.tgz; \
+	gpgconf --kill all; \
+	rm -rf "$GNUPGHOME" go.tgz.asc; \
+	\
+	tar -C /usr/local -xzf go.tgz; \
+	rm go.tgz; \
+	\
+	go version
+
+# don't auto-upgrade the gotoolchain
+# https://github.com/docker-library/golang/issues/472
+ENV GOTOOLCHAIN=local
+
+ENV GOPATH /go
+ENV PATH $GOPATH/bin:$PATH
+RUN mkdir -p "$GOPATH/src" "$GOPATH/bin" && chmod -R 1777 "$GOPATH"
+WORKDIR $GOPATH
diff --git a/1.22-rc/bullseye/Dockerfile b/1.22-rc/bullseye/Dockerfile
new file mode 100644
index 00000000..f25a8acd
--- /dev/null
+++ b/1.22-rc/bullseye/Dockerfile
@@ -0,0 +1,90 @@
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
+FROM buildpack-deps:bullseye-scm
+
+# install cgo-related dependencies
+RUN set -eux; \
+	apt-get update; \
+	apt-get install -y --no-install-recommends \
+		g++ \
+		gcc \
+		libc6-dev \
+		make \
+		pkg-config \
+	; \
+	rm -rf /var/lib/apt/lists/*
+
+ENV PATH /usr/local/go/bin:$PATH
+
+ENV GOLANG_VERSION 1.22rc1
+
+RUN set -eux; \
+	arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; \
+	url=; \
+	case "$arch" in \
+		'amd64') \
+			url='https://dl.google.com/go/go1.22rc1.linux-amd64.tar.gz'; \
+			sha256='fbe9d0585b9322d44008f6baf78b391b22f64294338c6ce2b9eb6040d6373c52'; \
+			;; \
+		'armhf') \
+			url='https://dl.google.com/go/go1.22rc1.linux-armv6l.tar.gz'; \
+			sha256='78e86eb1f449d88692829f1d794cd9f696b66c4f5e25f4ceb4ddd3ad7bee3683'; \
+			;; \
+		'arm64') \
+			url='https://dl.google.com/go/go1.22rc1.linux-arm64.tar.gz'; \
+			sha256='d777d6bc3241bcd470603c3af896d1c60ed1d8cc718cf92d0a5d9035b149a827'; \
+			;; \
+		'i386') \
+			url='https://dl.google.com/go/go1.22rc1.linux-386.tar.gz'; \
+			sha256='85ea68ef2fbd0d28179a8852401f498cb02dd7a2d688e71e54ee6180a790d105'; \
+			;; \
+		'mips64el') \
+			url='https://dl.google.com/go/go1.22rc1.linux-mips64le.tar.gz'; \
+			sha256='c424d3145bb770b5fc04e0b2316cbb9be34724ba66e83c83659830835ef698f9'; \
+			;; \
+		'ppc64el') \
+			url='https://dl.google.com/go/go1.22rc1.linux-ppc64le.tar.gz'; \
+			sha256='051d68e1fb9c804db0c5ecf856493ccf7611f6b05424bfe6d6a03ce03e5dbb24'; \
+			;; \
+		'riscv64') \
+			url='https://dl.google.com/go/go1.22rc1.linux-riscv64.tar.gz'; \
+			sha256='f7c9d98683f52004bc9942a6ac4ae628f89070446f24ad5451404ad7ee27682a'; \
+			;; \
+		's390x') \
+			url='https://dl.google.com/go/go1.22rc1.linux-s390x.tar.gz'; \
+			sha256='29e6b990a47cb3942e72208e91e370b3620119d0a7dcb2a58de57bde7716fc2b'; \
+			;; \
+		*) echo >&2 "error: unsupported architecture '$arch' (likely packaging update needed)"; exit 1 ;; \
+	esac; \
+	\
+	wget -O go.tgz.asc "$url.asc"; \
+	wget -O go.tgz "$url" --progress=dot:giga; \
+	echo "$sha256 *go.tgz" | sha256sum -c -; \
+	\
+# https://github.com/golang/go/issues/14739#issuecomment-324767697
+	GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
+# https://www.google.com/linuxrepositories/
+	gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 'EB4C 1BFD 4F04 2F6D DDCC  EC91 7721 F63B D38B 4796'; \
+# let's also fetch the specific subkey of that key explicitly that we expect "go.tgz.asc" to be signed by, just to make sure we definitely have it
+	gpg --batch --keyserver keyserver.ubuntu.com --recv-keys '2F52 8D36 D67B 69ED F998  D857 78BD 6547 3CB3 BD13'; \
+	gpg --batch --verify go.tgz.asc go.tgz; \
+	gpgconf --kill all; \
+	rm -rf "$GNUPGHOME" go.tgz.asc; \
+	\
+	tar -C /usr/local -xzf go.tgz; \
+	rm go.tgz; \
+	\
+	go version
+
+# don't auto-upgrade the gotoolchain
+# https://github.com/docker-library/golang/issues/472
+ENV GOTOOLCHAIN=local
+
+ENV GOPATH /go
+ENV PATH $GOPATH/bin:$PATH
+RUN mkdir -p "$GOPATH/src" "$GOPATH/bin" && chmod -R 1777 "$GOPATH"
+WORKDIR $GOPATH
diff --git a/1.22-rc/windows/nanoserver-1809/Dockerfile b/1.22-rc/windows/nanoserver-1809/Dockerfile
new file mode 100644
index 00000000..2a7e8638
--- /dev/null
+++ b/1.22-rc/windows/nanoserver-1809/Dockerfile
@@ -0,0 +1,30 @@
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
+FROM mcr.microsoft.com/windows/nanoserver:1809
+
+SHELL ["cmd", "/S", "/C"]
+
+# no Git installed (intentionally)
+#  -- Nano Server is "Windows Slim"
+
+# for 1.17+, we'll follow the (new) Go upstream default for install (https://golang.org/cl/283600), which frees up C:\go to be the default GOPATH and thus match the Linux images more closely (https://github.com/docker-library/golang/issues/288)
+ENV GOPATH C:\\go
+# HOWEVER, please note that it is the Go upstream intention to remove GOPATH support entirely: https://blog.golang.org/go116-module-changes
+
+# PATH isn't actually set in the Docker image, so we have to set it from within the container
+USER ContainerAdministrator
+RUN setx /m PATH "%GOPATH%\bin;C:\Program Files\Go\bin;%PATH%"
+USER ContainerUser
+# doing this first to share cache across versions more aggressively
+
+ENV GOLANG_VERSION 1.22rc1
+
+# Docker's Windows path parsing is absolutely *cursed*; please just trust me on this one -Tianon
+COPY --from=golang:1.22rc1-windowsservercore-1809 ["C:\\\\Program Files\\\\Go","C:\\\\Program Files\\\\Go"]
+RUN go version
+
+WORKDIR $GOPATH
diff --git a/1.22-rc/windows/nanoserver-ltsc2022/Dockerfile b/1.22-rc/windows/nanoserver-ltsc2022/Dockerfile
new file mode 100644
index 00000000..fee318ba
--- /dev/null
+++ b/1.22-rc/windows/nanoserver-ltsc2022/Dockerfile
@@ -0,0 +1,30 @@
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
+FROM mcr.microsoft.com/windows/nanoserver:ltsc2022
+
+SHELL ["cmd", "/S", "/C"]
+
+# no Git installed (intentionally)
+#  -- Nano Server is "Windows Slim"
+
+# for 1.17+, we'll follow the (new) Go upstream default for install (https://golang.org/cl/283600), which frees up C:\go to be the default GOPATH and thus match the Linux images more closely (https://github.com/docker-library/golang/issues/288)
+ENV GOPATH C:\\go
+# HOWEVER, please note that it is the Go upstream intention to remove GOPATH support entirely: https://blog.golang.org/go116-module-changes
+
+# PATH isn't actually set in the Docker image, so we have to set it from within the container
+USER ContainerAdministrator
+RUN setx /m PATH "%GOPATH%\bin;C:\Program Files\Go\bin;%PATH%"
+USER ContainerUser
+# doing this first to share cache across versions more aggressively
+
+ENV GOLANG_VERSION 1.22rc1
+
+# Docker's Windows path parsing is absolutely *cursed*; please just trust me on this one -Tianon
+COPY --from=golang:1.22rc1-windowsservercore-ltsc2022 ["C:\\\\Program Files\\\\Go","C:\\\\Program Files\\\\Go"]
+RUN go version
+
+WORKDIR $GOPATH
diff --git a/1.22-rc/windows/windowsservercore-1809/Dockerfile b/1.22-rc/windows/windowsservercore-1809/Dockerfile
new file mode 100644
index 00000000..38f596d1
--- /dev/null
+++ b/1.22-rc/windows/windowsservercore-1809/Dockerfile
@@ -0,0 +1,84 @@
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
+FROM mcr.microsoft.com/windows/servercore:1809
+
+# $ProgressPreference: https://github.com/PowerShell/PowerShell/issues/2138#issuecomment-251261324
+SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]
+
+# install MinGit (especially for "go get")
+# https://blogs.msdn.microsoft.com/visualstudioalm/2016/09/03/whats-new-in-git-for-windows-2-10/
+# "Essentially, it is a Git for Windows that was stripped down as much as possible without sacrificing the functionality in which 3rd-party software may be interested."
+# "It currently requires only ~45MB on disk."
+ENV GIT_VERSION 2.23.0
+ENV GIT_TAG v${GIT_VERSION}.windows.1
+ENV GIT_DOWNLOAD_URL https://github.com/git-for-windows/git/releases/download/${GIT_TAG}/MinGit-${GIT_VERSION}-64-bit.zip
+ENV GIT_DOWNLOAD_SHA256 8f65208f92c0b4c3ae4c0cf02d4b5f6791d539cd1a07b2df62b7116467724735
+# steps inspired by "chcolateyInstall.ps1" from "git.install" (https://chocolatey.org/packages/git.install)
+RUN Write-Host ('Downloading {0} ...' -f $env:GIT_DOWNLOAD_URL); \
+	[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; \
+	Invoke-WebRequest -Uri $env:GIT_DOWNLOAD_URL -OutFile 'git.zip'; \
+	\
+	Write-Host ('Verifying sha256 ({0}) ...' -f $env:GIT_DOWNLOAD_SHA256); \
+	if ((Get-FileHash git.zip -Algorithm sha256).Hash -ne $env:GIT_DOWNLOAD_SHA256) { \
+		Write-Host 'FAILED!'; \
+		exit 1; \
+	}; \
+	\
+	Write-Host 'Expanding ...'; \
+	Expand-Archive -Path git.zip -DestinationPath C:\git\.; \
+	\
+	Write-Host 'Removing ...'; \
+	Remove-Item git.zip -Force; \
+	\
+	Write-Host 'Updating PATH ...'; \
+	$env:PATH = 'C:\git\cmd;C:\git\mingw64\bin;C:\git\usr\bin;' + $env:PATH; \
+	[Environment]::SetEnvironmentVariable('PATH', $env:PATH, [EnvironmentVariableTarget]::Machine); \
+	\
+	Write-Host 'Verifying install ("git version") ...'; \
+	git version; \
+	\
+	Write-Host 'Complete.';
+
+# for 1.17+, we'll follow the (new) Go upstream default for install (https://golang.org/cl/283600), which frees up C:\go to be the default GOPATH and thus match the Linux images more closely (https://github.com/docker-library/golang/issues/288)
+ENV GOPATH C:\\go
+# HOWEVER, please note that it is the Go upstream intention to remove GOPATH support entirely: https://blog.golang.org/go116-module-changes
+
+# PATH isn't actually set in the Docker image, so we have to set it from within the container
+RUN $newPath = ('{0}\bin;C:\Program Files\Go\bin;{1}' -f $env:GOPATH, $env:PATH); \
+	Write-Host ('Updating PATH: {0}' -f $newPath); \
+	[Environment]::SetEnvironmentVariable('PATH', $newPath, [EnvironmentVariableTarget]::Machine);
+# doing this first to share cache across versions more aggressively
+
+ENV GOLANG_VERSION 1.22rc1
+
+RUN $url = 'https://dl.google.com/go/go1.22rc1.windows-amd64.zip'; \
+	Write-Host ('Downloading {0} ...' -f $url); \
+	[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; \
+	Invoke-WebRequest -Uri $url -OutFile 'go.zip'; \
+	\
+	$sha256 = '4aea6071f7a0505d9b99bccd6d5d40dba8d89e8b0c98f77db6c9b9202e2b76bf'; \
+	Write-Host ('Verifying sha256 ({0}) ...' -f $sha256); \
+	if ((Get-FileHash go.zip -Algorithm sha256).Hash -ne $sha256) { \
+		Write-Host 'FAILED!'; \
+		exit 1; \
+	}; \
+	\
+	Write-Host 'Expanding ...'; \
+	Expand-Archive go.zip -DestinationPath C:\; \
+	\
+	Write-Host 'Moving ...'; \
+	Move-Item -Path C:\go -Destination 'C:\Program Files\Go'; \
+	\
+	Write-Host 'Removing ...'; \
+	Remove-Item go.zip -Force; \
+	\
+	Write-Host 'Verifying install ("go version") ...'; \
+	go version; \
+	\
+	Write-Host 'Complete.';
+
+WORKDIR $GOPATH
diff --git a/1.22-rc/windows/windowsservercore-ltsc2022/Dockerfile b/1.22-rc/windows/windowsservercore-ltsc2022/Dockerfile
new file mode 100644
index 00000000..c2794217
--- /dev/null
+++ b/1.22-rc/windows/windowsservercore-ltsc2022/Dockerfile
@@ -0,0 +1,84 @@
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
+FROM mcr.microsoft.com/windows/servercore:ltsc2022
+
+# $ProgressPreference: https://github.com/PowerShell/PowerShell/issues/2138#issuecomment-251261324
+SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]
+
+# install MinGit (especially for "go get")
+# https://blogs.msdn.microsoft.com/visualstudioalm/2016/09/03/whats-new-in-git-for-windows-2-10/
+# "Essentially, it is a Git for Windows that was stripped down as much as possible without sacrificing the functionality in which 3rd-party software may be interested."
+# "It currently requires only ~45MB on disk."
+ENV GIT_VERSION 2.23.0
+ENV GIT_TAG v${GIT_VERSION}.windows.1
+ENV GIT_DOWNLOAD_URL https://github.com/git-for-windows/git/releases/download/${GIT_TAG}/MinGit-${GIT_VERSION}-64-bit.zip
+ENV GIT_DOWNLOAD_SHA256 8f65208f92c0b4c3ae4c0cf02d4b5f6791d539cd1a07b2df62b7116467724735
+# steps inspired by "chcolateyInstall.ps1" from "git.install" (https://chocolatey.org/packages/git.install)
+RUN Write-Host ('Downloading {0} ...' -f $env:GIT_DOWNLOAD_URL); \
+	[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; \
+	Invoke-WebRequest -Uri $env:GIT_DOWNLOAD_URL -OutFile 'git.zip'; \
+	\
+	Write-Host ('Verifying sha256 ({0}) ...' -f $env:GIT_DOWNLOAD_SHA256); \
+	if ((Get-FileHash git.zip -Algorithm sha256).Hash -ne $env:GIT_DOWNLOAD_SHA256) { \
+		Write-Host 'FAILED!'; \
+		exit 1; \
+	}; \
+	\
+	Write-Host 'Expanding ...'; \
+	Expand-Archive -Path git.zip -DestinationPath C:\git\.; \
+	\
+	Write-Host 'Removing ...'; \
+	Remove-Item git.zip -Force; \
+	\
+	Write-Host 'Updating PATH ...'; \
+	$env:PATH = 'C:\git\cmd;C:\git\mingw64\bin;C:\git\usr\bin;' + $env:PATH; \
+	[Environment]::SetEnvironmentVariable('PATH', $env:PATH, [EnvironmentVariableTarget]::Machine); \
+	\
+	Write-Host 'Verifying install ("git version") ...'; \
+	git version; \
+	\
+	Write-Host 'Complete.';
+
+# for 1.17+, we'll follow the (new) Go upstream default for install (https://golang.org/cl/283600), which frees up C:\go to be the default GOPATH and thus match the Linux images more closely (https://github.com/docker-library/golang/issues/288)
+ENV GOPATH C:\\go
+# HOWEVER, please note that it is the Go upstream intention to remove GOPATH support entirely: https://blog.golang.org/go116-module-changes
+
+# PATH isn't actually set in the Docker image, so we have to set it from within the container
+RUN $newPath = ('{0}\bin;C:\Program Files\Go\bin;{1}' -f $env:GOPATH, $env:PATH); \
+	Write-Host ('Updating PATH: {0}' -f $newPath); \
+	[Environment]::SetEnvironmentVariable('PATH', $newPath, [EnvironmentVariableTarget]::Machine);
+# doing this first to share cache across versions more aggressively
+
+ENV GOLANG_VERSION 1.22rc1
+
+RUN $url = 'https://dl.google.com/go/go1.22rc1.windows-amd64.zip'; \
+	Write-Host ('Downloading {0} ...' -f $url); \
+	[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; \
+	Invoke-WebRequest -Uri $url -OutFile 'go.zip'; \
+	\
+	$sha256 = '4aea6071f7a0505d9b99bccd6d5d40dba8d89e8b0c98f77db6c9b9202e2b76bf'; \
+	Write-Host ('Verifying sha256 ({0}) ...' -f $sha256); \
+	if ((Get-FileHash go.zip -Algorithm sha256).Hash -ne $sha256) { \
+		Write-Host 'FAILED!'; \
+		exit 1; \
+	}; \
+	\
+	Write-Host 'Expanding ...'; \
+	Expand-Archive go.zip -DestinationPath C:\; \
+	\
+	Write-Host 'Moving ...'; \
+	Move-Item -Path C:\go -Destination 'C:\Program Files\Go'; \
+	\
+	Write-Host 'Removing ...'; \
+	Remove-Item go.zip -Force; \
+	\
+	Write-Host 'Verifying install ("go version") ...'; \
+	go version; \
+	\
+	Write-Host 'Complete.';
+
+WORKDIR $GOPATH
diff --git a/Dockerfile-linux.template b/Dockerfile-linux.template
index 19246b31..80be7f91 100644
--- a/Dockerfile-linux.template
+++ b/Dockerfile-linux.template
@@ -5,9 +5,13 @@
 	def alpine_version:
 		env.variant | ltrimstr("alpine")
 	;
+	def sometimes_build_from_source:
+		# https://github.com/docker-library/golang/pull/500#issuecomment-1863578601
+		[ "1.20" ] | index(env.version | rtrimstr("-rc"))
+	;
 	def always_build_from_source:
 		# https://github.com/golang/go/issues/57007! (as of Go 1.21, the upstream release binaries are fully static and thus appropriate for Alpine)
-		is_alpine and ([ "1.20" ] | index(env.version | rtrimstr("-rc")))
+		is_alpine and sometimes_build_from_source
 -}}
 {{ if is_alpine then ( -}}
 FROM alpine:{{ alpine_version }}
@@ -52,6 +56,7 @@ ENV GOLANG_VERSION {{ .version }}
 			{
 				# https://salsa.debian.org/dpkg-team/dpkg/-/blob/main/data/cputable
 				# https://wiki.debian.org/ArchitectureSpecificsMemo#Architecture_baselines
+				# https://deb.debian.org/debian/dists/unstable/Release ("Architectures:")
 				# http://deb.debian.org/debian/dists/unstable/main/
 				# http://deb.debian.org/debian/dists/stable/main/
 				# https://deb.debian.org/debian-ports/dists/unstable/main/
@@ -89,7 +94,8 @@ RUN set -eux; \
 		| (
 -}}
 		{{ $osArch | @sh }}) \
-{{ if always_build_from_source or (.url | not) then ( -}}
+{{ # TODO remove this "build-from-source" logic when 1.20 is EOL / 1.22 is GA -}}
+{{ if (.url | not) or always_build_from_source then ( -}}
 			export {{ .env | to_entries | map(.key + "=" + (.value | @sh)) | join(" ") }}; \
 {{ ) else ( -}}
 			url={{ .url | @sh }}; \
@@ -102,6 +108,7 @@ RUN set -eux; \
 -}}
 		*) echo >&2 "error: unsupported architecture '$arch' (likely packaging update needed)"; exit 1 ;; \
 	esac; \
+{{ if sometimes_build_from_source then ( -}}
 	build=; \
 	if [ -z "$url" ]; then \
 # https://github.com/golang/go/issues/38536#issuecomment-616897960
@@ -109,13 +116,14 @@ RUN set -eux; \
 		url={{ .arches.src.url | @sh }}; \
 		sha256={{ .arches.src.sha256 | @sh }}; \
 {{ if always_build_from_source then ( -}}
-# the precompiled binaries published by Go upstream are not compatible with Alpine, so we always build from source here 😅
+# the precompiled binaries published by Go upstream were not compatible with Alpine in Go 1.20, so we always build from source here 😅
 {{ ) else ( -}}
 		echo >&2; \
 		echo >&2 "warning: current architecture ($arch) does not have a compatible Go binary release; will be building from source"; \
 		echo >&2; \
 {{ ) end -}}
 	fi; \
+{{ ) else "" end -}}
 	\
 	wget -O go.tgz.asc "$url.asc"; \
 	wget -O go.tgz "$url"{{ if is_alpine then "" else " --progress=dot:giga" end }}; \
@@ -134,6 +142,7 @@ RUN set -eux; \
 	tar -C /usr/local -xzf go.tgz; \
 	rm go.tgz; \
 	\
+{{ if sometimes_build_from_source then ( -}}
 	if [ -n "$build" ]; then \
 {{ if is_alpine then ( -}}
 		apk add --no-cache --virtual .build-deps \
@@ -206,6 +215,7 @@ RUN set -eux; \
 {{ ) else "" end -}}
 	fi; \
 	\
+{{ ) else "" end -}}
 {{ if is_alpine then ( -}}
 	apk del --no-network .fetch-deps; \
 	\
diff --git a/versions.json b/versions.json
index 78950af9..488287f7 100644
--- a/versions.json
+++ b/versions.json
@@ -198,7 +198,7 @@
           "GOARM": "5",
           "GOOS": "linux"
         },
-        "supported": true
+        "supported": false
       },
       "arm32v6": {
         "env": {
@@ -562,5 +562,397 @@
       "windows/nanoserver-1809"
     ],
     "version": "1.21.5"
+  },
+  "1.22-rc": {
+    "arches": {
+      "aix-ppc64": {
+        "env": {
+          "GOARCH": "ppc64",
+          "GOOS": "aix"
+        },
+        "sha256": "32db340f361f398a80357e287b6ba3579d61dace9d2d111a9cb5eff565b2812a",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.aix-ppc64.tar.gz"
+      },
+      "amd64": {
+        "env": {
+          "GOAMD64": "v1",
+          "GOARCH": "amd64",
+          "GOOS": "linux"
+        },
+        "sha256": "fbe9d0585b9322d44008f6baf78b391b22f64294338c6ce2b9eb6040d6373c52",
+        "supported": true,
+        "url": "https://dl.google.com/go/go1.22rc1.linux-amd64.tar.gz"
+      },
+      "arm32v5": {
+        "env": {
+          "GOARCH": "arm",
+          "GOARM": "5",
+          "GOOS": "linux"
+        },
+        "supported": false
+      },
+      "arm32v6": {
+        "env": {
+          "GOARCH": "arm",
+          "GOARM": "6",
+          "GOOS": "linux"
+        },
+        "sha256": "78e86eb1f449d88692829f1d794cd9f696b66c4f5e25f4ceb4ddd3ad7bee3683",
+        "supported": true,
+        "url": "https://dl.google.com/go/go1.22rc1.linux-armv6l.tar.gz"
+      },
+      "arm32v7": {
+        "env": {
+          "GOARCH": "arm",
+          "GOARM": "7",
+          "GOOS": "linux"
+        },
+        "sha256": "78e86eb1f449d88692829f1d794cd9f696b66c4f5e25f4ceb4ddd3ad7bee3683",
+        "supported": true,
+        "url": "https://dl.google.com/go/go1.22rc1.linux-armv6l.tar.gz"
+      },
+      "arm64v8": {
+        "env": {
+          "GOARCH": "arm64",
+          "GOOS": "linux"
+        },
+        "sha256": "d777d6bc3241bcd470603c3af896d1c60ed1d8cc718cf92d0a5d9035b149a827",
+        "supported": true,
+        "url": "https://dl.google.com/go/go1.22rc1.linux-arm64.tar.gz"
+      },
+      "darwin-amd64": {
+        "env": {
+          "GOARCH": "amd64",
+          "GOOS": "darwin"
+        },
+        "sha256": "e826132e72eb1f3f6a523309bfabf7cb4b2d72e26e369abed4b30bda2ed61246",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.darwin-amd64.tar.gz"
+      },
+      "darwin-arm64v8": {
+        "env": {
+          "GOARCH": "arm64",
+          "GOOS": "darwin"
+        },
+        "sha256": "799699272100d451f46ce271b65421c3472e6ce99375a8885e24223dcddc0235",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.darwin-arm64.tar.gz"
+      },
+      "dragonfly-amd64": {
+        "env": {
+          "GOARCH": "amd64",
+          "GOOS": "dragonfly"
+        },
+        "sha256": "9004344769c77e8c3ce18102e1ea1d45fd6e7ec5665dfdab2d76c70e5be222b9",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.dragonfly-amd64.tar.gz"
+      },
+      "freebsd-amd64": {
+        "env": {
+          "GOARCH": "amd64",
+          "GOOS": "freebsd"
+        },
+        "sha256": "f884e50062bcffdb8b0a09c91be5e18bd3f6219bae24e88cea5b5737d005fc73",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.freebsd-amd64.tar.gz"
+      },
+      "freebsd-arm32v6": {
+        "env": {
+          "GOARCH": "armv6l",
+          "GOOS": "freebsd"
+        },
+        "sha256": "9d41593688282c51257388debd4e107d2b4134139fa0c24260f7b0072cbc2886",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.freebsd-arm.tar.gz"
+      },
+      "freebsd-arm64v8": {
+        "env": {
+          "GOARCH": "arm64",
+          "GOOS": "freebsd"
+        },
+        "sha256": "61fceff9fd9d7e04a14770570ade80ba905068918cc07bd3c324c48ff31b53c1",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.freebsd-arm64.tar.gz"
+      },
+      "freebsd-i386": {
+        "env": {
+          "GOARCH": "386",
+          "GOOS": "freebsd"
+        },
+        "sha256": "1f163bdd8ad40eba68f90da048bd3962a19b63d660ec557ce3aa70e22216bef0",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.freebsd-386.tar.gz"
+      },
+      "freebsd-riscv64": {
+        "env": {
+          "GOARCH": "riscv64",
+          "GOOS": "freebsd"
+        },
+        "sha256": "765c0c16c8c5cf4bf9c440927b1f67413ff43461ca606961b26ee35265c6364a",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.freebsd-riscv64.tar.gz"
+      },
+      "i386": {
+        "env": {
+          "GO386": "softfloat",
+          "GOARCH": "386",
+          "GOOS": "linux"
+        },
+        "sha256": "85ea68ef2fbd0d28179a8852401f498cb02dd7a2d688e71e54ee6180a790d105",
+        "supported": true,
+        "url": "https://dl.google.com/go/go1.22rc1.linux-386.tar.gz"
+      },
+      "illumos-amd64": {
+        "env": {
+          "GOARCH": "amd64",
+          "GOOS": "illumos"
+        },
+        "sha256": "4908199023b0844c4efda0b2fc1b2b06d2a44495706644f89804fd5ae3a2c5b0",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.illumos-amd64.tar.gz"
+      },
+      "loong64": {
+        "env": {
+          "GOARCH": "loong64",
+          "GOOS": "linux"
+        },
+        "sha256": "36041011ce28451c8d6fa303abba678c8d145d42973294306dc183edcdcab9d2",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.linux-loong64.tar.gz"
+      },
+      "mips": {
+        "env": {
+          "GOARCH": "mips",
+          "GOOS": "linux"
+        },
+        "sha256": "fcf99f26847ee2ac772f7c5e146eb373ba573adc5eb077853aec434b64a34578",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.linux-mips.tar.gz"
+      },
+      "mips64": {
+        "env": {
+          "GOARCH": "mips64",
+          "GOOS": "linux"
+        },
+        "sha256": "f8669ea30bcc0195df1106f8aa4b7514fee46302eaf8738672df7b49ffbf5a72",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.linux-mips64.tar.gz"
+      },
+      "mips64le": {
+        "env": {
+          "GOARCH": "mips64le",
+          "GOOS": "linux"
+        },
+        "sha256": "c424d3145bb770b5fc04e0b2316cbb9be34724ba66e83c83659830835ef698f9",
+        "supported": true,
+        "url": "https://dl.google.com/go/go1.22rc1.linux-mips64le.tar.gz"
+      },
+      "mipsle": {
+        "env": {
+          "GOARCH": "mipsle",
+          "GOOS": "linux"
+        },
+        "sha256": "cf312a659e66704e5d880c00996fe80dd833d8183e03320f907895f3da0018e1",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.linux-mipsle.tar.gz"
+      },
+      "netbsd-amd64": {
+        "env": {
+          "GOARCH": "amd64",
+          "GOOS": "netbsd"
+        },
+        "sha256": "30f3c87a240b83f4bf3853a72bf7ff22ee5cf66c678369f1697b5d095af7b0e2",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.netbsd-amd64.tar.gz"
+      },
+      "netbsd-arm32v6": {
+        "env": {
+          "GOARCH": "armv6l",
+          "GOOS": "netbsd"
+        },
+        "sha256": "7f7ce3ac8853cd6b6fd6e73f4e6949285571bf40192ff9b5d7765131410d86de",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.netbsd-arm.tar.gz"
+      },
+      "netbsd-arm64v8": {
+        "env": {
+          "GOARCH": "arm64",
+          "GOOS": "netbsd"
+        },
+        "sha256": "0ea6db8206cb034c81b7b5315784d07dfda040908e6b0229dd3a4eb6501e3332",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.netbsd-arm64.tar.gz"
+      },
+      "netbsd-i386": {
+        "env": {
+          "GOARCH": "386",
+          "GOOS": "netbsd"
+        },
+        "sha256": "4e0c1992cfef78d95bd3baf0f13eabf72a4a807922980fce62477af87c01af59",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.netbsd-386.tar.gz"
+      },
+      "openbsd-amd64": {
+        "env": {
+          "GOARCH": "amd64",
+          "GOOS": "openbsd"
+        },
+        "sha256": "a2b93d35ee68d5ad7a2bf30f8343dcbc4f3f72181379be57e7f64b27bc64215f",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.openbsd-amd64.tar.gz"
+      },
+      "openbsd-arm32v6": {
+        "env": {
+          "GOARCH": "armv6l",
+          "GOOS": "openbsd"
+        },
+        "sha256": "edad586bc5f424065281986d883375bbd7cc7fcc8ff5f4c3acb029d9a2a8c2eb",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.openbsd-arm.tar.gz"
+      },
+      "openbsd-arm64v8": {
+        "env": {
+          "GOARCH": "arm64",
+          "GOOS": "openbsd"
+        },
+        "sha256": "f67fa74d84e9fb214ea9894d1518ab473b308e609f45cc315c6d970a8118584b",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.openbsd-arm64.tar.gz"
+      },
+      "openbsd-i386": {
+        "env": {
+          "GOARCH": "386",
+          "GOOS": "openbsd"
+        },
+        "sha256": "7468e7d1c729b3bb99ffe37822d6369f0c60481fc46f0076765340652dc6aa77",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.openbsd-386.tar.gz"
+      },
+      "plan9-amd64": {
+        "env": {
+          "GOARCH": "amd64",
+          "GOOS": "plan9"
+        },
+        "sha256": "9b5c49b3961986809082654823b157f9b62e133e4b55d709e26f36febbd5bcc5",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.plan9-amd64.tar.gz"
+      },
+      "plan9-arm32v6": {
+        "env": {
+          "GOARCH": "armv6l",
+          "GOOS": "plan9"
+        },
+        "sha256": "b54543d7edbfacfad5d2fc139dea1bba1833d55e695b806e8894d46a18d69415",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.plan9-arm.tar.gz"
+      },
+      "plan9-i386": {
+        "env": {
+          "GOARCH": "386",
+          "GOOS": "plan9"
+        },
+        "sha256": "f60fe8f97f276a29fff132cb68dac05ba1fe4a9f1f3c38a846d0cfce2b690c39",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.plan9-386.tar.gz"
+      },
+      "ppc64": {
+        "env": {
+          "GOARCH": "ppc64",
+          "GOOS": "linux"
+        },
+        "sha256": "fc384999709044715573fec4d236e9543c65b52b0eb876bc4310a75e3fdeb45b",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.linux-ppc64.tar.gz"
+      },
+      "ppc64le": {
+        "env": {
+          "GOARCH": "ppc64le",
+          "GOOS": "linux"
+        },
+        "sha256": "051d68e1fb9c804db0c5ecf856493ccf7611f6b05424bfe6d6a03ce03e5dbb24",
+        "supported": true,
+        "url": "https://dl.google.com/go/go1.22rc1.linux-ppc64le.tar.gz"
+      },
+      "riscv64": {
+        "env": {
+          "GOARCH": "riscv64",
+          "GOOS": "linux"
+        },
+        "sha256": "f7c9d98683f52004bc9942a6ac4ae628f89070446f24ad5451404ad7ee27682a",
+        "supported": true,
+        "url": "https://dl.google.com/go/go1.22rc1.linux-riscv64.tar.gz"
+      },
+      "s390x": {
+        "env": {
+          "GOARCH": "s390x",
+          "GOOS": "linux"
+        },
+        "sha256": "29e6b990a47cb3942e72208e91e370b3620119d0a7dcb2a58de57bde7716fc2b",
+        "supported": true,
+        "url": "https://dl.google.com/go/go1.22rc1.linux-s390x.tar.gz"
+      },
+      "solaris-amd64": {
+        "env": {
+          "GOARCH": "amd64",
+          "GOOS": "solaris"
+        },
+        "sha256": "68a0c674a136181452d424a4db0120f248c98b5fb36ab73fca9dc02a9dff9330",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.solaris-amd64.tar.gz"
+      },
+      "src": {
+        "sha256": "9aecbb8ebae41b93ea26ef5b014296fbbe70a07630249c0d8a275df3bd4d26ea",
+        "supported": true,
+        "url": "https://dl.google.com/go/go1.22rc1.src.tar.gz"
+      },
+      "windows-amd64": {
+        "env": {
+          "GOARCH": "amd64",
+          "GOOS": "windows"
+        },
+        "sha256": "4aea6071f7a0505d9b99bccd6d5d40dba8d89e8b0c98f77db6c9b9202e2b76bf",
+        "supported": true,
+        "url": "https://dl.google.com/go/go1.22rc1.windows-amd64.zip"
+      },
+      "windows-arm32v6": {
+        "env": {
+          "GOARCH": "armv6l",
+          "GOOS": "windows"
+        },
+        "sha256": "281f3b04113e5c112ca72bb090e5a387c3e8ece53ebeb34090a038bbd364e30e",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.windows-arm.zip"
+      },
+      "windows-arm64v8": {
+        "env": {
+          "GOARCH": "arm64",
+          "GOOS": "windows"
+        },
+        "sha256": "c4642c253cd48419e2ede19e7c38b6bfdf34755c5e3e8ed9a29fd5d85f9ec7d3",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.windows-arm64.zip"
+      },
+      "windows-i386": {
+        "env": {
+          "GOARCH": "386",
+          "GOOS": "windows"
+        },
+        "sha256": "b8ed30dbef189597363ac3965f7354579d2d99b4c7b6daedf9bd9a67ef2e676e",
+        "supported": false,
+        "url": "https://dl.google.com/go/go1.22rc1.windows-386.zip"
+      }
+    },
+    "variants": [
+      "bookworm",
+      "bullseye",
+      "alpine3.19",
+      "alpine3.18",
+      "windows/windowsservercore-ltsc2022",
+      "windows/windowsservercore-1809",
+      "windows/nanoserver-ltsc2022",
+      "windows/nanoserver-1809"
+    ],
+    "version": "1.22rc1"
   }
 }
diff --git a/versions.sh b/versions.sh
index 9e59762c..0d0cc86e 100755
--- a/versions.sh
+++ b/versions.sh
@@ -44,40 +44,43 @@ goVersions="$(
 			| {
 				version: $version,
 				major: ( $major + if .stable then "" else "-rc" end ),
-				arches: ([
-					.files[]
-					| select(.kind == "archive" or .kind == "source")
-					| (
-						if .kind == "source" then
-							"src"
-						else
-							if .os != "linux" then
-								.os + "-"
-							else "" end
-							+ (
-								.arch
-								| sub("^386$"; "i386")
-								| sub("^arm64$"; "arm64v8")
-								| sub("^arm-?v?(?<v>[0-9]+)l?$"; "arm32v\(.v)")
-							)
-						end
-					) as $bashbrewArch
-					| {
-						( $bashbrewArch ): (
-							{
-								sha256: .sha256,
-								url: ("https://dl.google.com/go/" + .filename),
-								env: { GOOS: .os, GOARCH: .arch },
-							}
-						),
-					}
-				] | add)
-			}
+				arches: (
+					[
+						.files[]
+						| select(.kind == "archive" or .kind == "source")
+						| (
+							if .kind == "source" then
+								"src"
+							else
+								if .os != "linux" then
+									.os + "-"
+								else "" end
+								+ (
+									.arch
+									| sub("^386$"; "i386")
+									| sub("^arm64$"; "arm64v8")
+									| sub("^arm-?v?(?<v>[0-9]+)l?$"; "arm32v\(.v)")
+								)
+							end
+						) as $bashbrewArch
+						| {
+							( $bashbrewArch ): (
+								{
+									sha256: .sha256,
+									url: ("https://dl.google.com/go/" + .filename),
+									env: { GOOS: .os, GOARCH: .arch },
+								}
+							),
+						}
+					]
+					| add
 
-			# the published binaries only support glibc, which translates to Debian, so the "correct" binary for v7 is v6 (TODO find some way to reasonably benchmark the compiler on a proper v7 chip and determine whether recompiling for GOARM=7 is worthwhile)
-			| if (.arches | has("arm32v7") | not) and (.arches | has("arm32v6")) then
-				.arches["arm32v7"] = (.arches["arm32v6"] | .env.GOARM = "7")
-			else . end
+					# upstream (still as of 2023-12-19) only publishes "armv6" binaries, which are appropriate for v7 as well
+					| if (has("arm32v7") | not) and has("arm32v6") then
+						.["arm32v7"] = .["arm32v6"]
+					else . end
+				)
+			}
 		]
 	'
 )"
@@ -127,7 +130,11 @@ for version in "${versions[@]}"; do
 			)
 			| with_entries(
 				.key as $bashbrewArch
-				| .value.supported = ($potentiallySupportedArches | index($bashbrewArch) != null)
+				| .value.supported = (
+					# https://github.com/docker-library/golang/pull/500#issuecomment-1863578601 - as of Go 1.21+, we no longer build from source
+					(.value.url or ([ "1.20" ] | index(env.version | rtrimstr("-rc"))))
+					and ($potentiallySupportedArches | index($bashbrewArch))
+				)
 				| .value.env +=
 						if $bashbrewArch == "i386" then
 							# i386 in Debian is non-SSE2, Alpine appears to be similar (but interesting, not FreeBSD?)
@@ -149,16 +156,19 @@ for version in "${versions[@]}"; do
 			"bullseye",
 			(
 				"3.19",
-				"3.18"
+				"3.18",
+				empty
 			| "alpine" + .),
 			if .arches | has("windows-amd64") and .["windows-amd64"].url then
 				(
 					"ltsc2022",
-					"1809"
+					"1809",
+					empty
 				| "windows/windowsservercore-" + .),
 				(
 					"ltsc2022",
-					"1809"
+					"1809",
+					empty
 				| "windows/nanoserver-" + .)
 			else empty end
 		],