diff --git a/klone.yaml b/klone.yaml
index 4ecbb5a..e7cb8db 100644
--- a/klone.yaml
+++ b/klone.yaml
@@ -10,65 +10,65 @@ targets:
     - folder_name: boilerplate
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 96530a5ed1a52c40cdf6b2469ad49fa5a13ab7c0
+      repo_hash: 7458086828acec84648afb1beb18da8a7d0e5e3c
       repo_path: modules/boilerplate
     - folder_name: cert-manager
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 96530a5ed1a52c40cdf6b2469ad49fa5a13ab7c0
+      repo_hash: 7458086828acec84648afb1beb18da8a7d0e5e3c
       repo_path: modules/cert-manager
     - folder_name: controller-gen
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 96530a5ed1a52c40cdf6b2469ad49fa5a13ab7c0
+      repo_hash: 7458086828acec84648afb1beb18da8a7d0e5e3c
       repo_path: modules/controller-gen
     - folder_name: generate-verify
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 96530a5ed1a52c40cdf6b2469ad49fa5a13ab7c0
+      repo_hash: 7458086828acec84648afb1beb18da8a7d0e5e3c
       repo_path: modules/generate-verify
     - folder_name: go
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 96530a5ed1a52c40cdf6b2469ad49fa5a13ab7c0
+      repo_hash: 7458086828acec84648afb1beb18da8a7d0e5e3c
       repo_path: modules/go
     - folder_name: helm
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 96530a5ed1a52c40cdf6b2469ad49fa5a13ab7c0
+      repo_hash: 7458086828acec84648afb1beb18da8a7d0e5e3c
       repo_path: modules/helm
     - folder_name: help
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 96530a5ed1a52c40cdf6b2469ad49fa5a13ab7c0
+      repo_hash: 7458086828acec84648afb1beb18da8a7d0e5e3c
       repo_path: modules/help
     - folder_name: kind
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 96530a5ed1a52c40cdf6b2469ad49fa5a13ab7c0
+      repo_hash: 7458086828acec84648afb1beb18da8a7d0e5e3c
       repo_path: modules/kind
     - folder_name: klone
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 96530a5ed1a52c40cdf6b2469ad49fa5a13ab7c0
+      repo_hash: 7458086828acec84648afb1beb18da8a7d0e5e3c
       repo_path: modules/klone
     - folder_name: oci-build
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 96530a5ed1a52c40cdf6b2469ad49fa5a13ab7c0
+      repo_hash: 7458086828acec84648afb1beb18da8a7d0e5e3c
       repo_path: modules/oci-build
     - folder_name: oci-publish
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 96530a5ed1a52c40cdf6b2469ad49fa5a13ab7c0
+      repo_hash: 7458086828acec84648afb1beb18da8a7d0e5e3c
       repo_path: modules/oci-publish
     - folder_name: repository-base
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 96530a5ed1a52c40cdf6b2469ad49fa5a13ab7c0
+      repo_hash: 7458086828acec84648afb1beb18da8a7d0e5e3c
       repo_path: modules/repository-base
     - folder_name: tools
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 96530a5ed1a52c40cdf6b2469ad49fa5a13ab7c0
+      repo_hash: 7458086828acec84648afb1beb18da8a7d0e5e3c
       repo_path: modules/tools
diff --git a/make/_shared/go/01_mod.mk b/make/_shared/go/01_mod.mk
index 0e4d418..9a28ed3 100644
--- a/make/_shared/go/01_mod.mk
+++ b/make/_shared/go/01_mod.mk
@@ -23,6 +23,41 @@ endif
 go_base_dir := $(dir $(lastword $(MAKEFILE_LIST)))/base/
 golangci_lint_override := $(dir $(lastword $(MAKEFILE_LIST)))/.golangci.override.yaml
 
+.PHONY: go-workspace
+go-workspace: export GOWORK?=$(abspath go.work)
+## Create a go.work file in the repository root (or GOWORK)
+##
+## @category Development
+go-workspace: | $(NEEDS_GO)
+	@rm -f $(GOWORK)
+	$(GO) work init
+	@find . -name go.mod -not \( -path "./$(bin_dir)/*" -or -path "./make/_shared/*" \) \
+		| while read d; do \
+				target=$$(dirname $${d}); \
+				$(GO) work use "$${target}"; \
+			done
+
+.PHONY: go-tidy
+## Alias for `make generate-go-mod-tidy`
+## @category [shared] Generate/ Verify
+go-tidy: generate-go-mod-tidy
+
+.PHONY: generate-go-mod-tidy
+## Run `go mod tidy` on all Go modules
+## @category [shared] Generate/ Verify
+generate-go-mod-tidy: | $(NEEDS_GO)
+	@find . -name go.mod -not \( -path "./$(bin_dir)/*" -or -path "./make/_shared/*" \) \
+		| while read d; do \
+				target=$$(dirname $${d}); \
+				echo "Running 'go mod tidy' in directory '$${target}'"; \
+				pushd "$${target}" >/dev/null; \
+				$(GO) mod tidy || exit; \
+				popd >/dev/null; \
+				echo ""; \
+			done
+
+shared_generate_targets += generate-go-mod-tidy
+
 .PHONY: generate-govulncheck
 ## Generate base files in the repository
 ## @category [shared] Generate/ Verify
diff --git a/make/_shared/tools/00_mod.mk b/make/_shared/tools/00_mod.mk
index 39caa7a..8065fdc 100644
--- a/make/_shared/tools/00_mod.mk
+++ b/make/_shared/tools/00_mod.mk
@@ -153,7 +153,7 @@ ADDITIONAL_TOOLS ?=
 tools += $(ADDITIONAL_TOOLS)
 
 # https://go.dev/dl/
-VENDORED_GO_VERSION := 1.22.4
+VENDORED_GO_VERSION := 1.22.5
 
 # Print the go version which can be used in GH actions
 .PHONY: print-go-version
@@ -363,10 +363,10 @@ $(call for_each_kv,go_dependency,$(go_dependencies))
 # File downloads #
 ##################
 
-go_linux_amd64_SHA256SUM=ba79d4526102575196273416239cca418a651e049c2b099f3159db85e7bade7d
-go_linux_arm64_SHA256SUM=a8e177c354d2e4a1b61020aca3562e27ea3e8f8247eca3170e3fa1e0c2f9e771
-go_darwin_amd64_SHA256SUM=c95967f50aa4ace34af0c236cbdb49a9a3e80ee2ad09d85775cb4462a5c19ed3
-go_darwin_arm64_SHA256SUM=242b78dc4c8f3d5435d28a0d2cec9b4c1aa999b601fb8aa59fb4e5a1364bf827
+go_linux_amd64_SHA256SUM=904b924d435eaea086515bc63235b192ea441bd8c9b198c507e85009e6e4c7f0
+go_linux_arm64_SHA256SUM=8d21325bfcf431be3660527c1a39d3d9ad71535fabdf5041c826e44e31642b5a
+go_darwin_amd64_SHA256SUM=95d9933cdcf45f211243c42c7705c37353cccd99f27eb4d8e2d1bf2f4165cb50
+go_darwin_arm64_SHA256SUM=4cd1bcb05be03cecb77bccd765785d5ff69d79adf4dd49790471d00c06b41133
 
 .PRECIOUS: $(DOWNLOAD_DIR)/tools/go@$(VENDORED_GO_VERSION)_$(HOST_OS)_$(HOST_ARCH).tar.gz
 $(DOWNLOAD_DIR)/tools/go@$(VENDORED_GO_VERSION)_$(HOST_OS)_$(HOST_ARCH).tar.gz: | $(DOWNLOAD_DIR)/tools
@@ -616,34 +616,3 @@ endif
 ## Download and setup all tools
 ## @category [shared] Tools
 tools: $(tools_paths)
-
-self_file := $(dir $(lastword $(MAKEFILE_LIST)))/00_mod.mk
-
-# see https://stackoverflow.com/a/53408233
-sed_inplace := sed -i''
-ifeq ($(HOST_OS),darwin)
-	sed_inplace := sed -i ''
-endif
-
-# This target is used to learn the sha256sum of the tools. It is used only
-# in the makefile-modules repo, and should not be used in any other repo.
-.PHONY: tools-learn-sha
-tools-learn-sha: | $(bin_dir)
-	rm -rf ./$(bin_dir)/
-	mkdir -p ./$(bin_dir)/scratch/
-	$(eval export LEARN_FILE=$(CURDIR)/$(bin_dir)/scratch/learn_tools_file)
-	echo -n "" > "$(LEARN_FILE)"
-
-	HOST_OS=linux HOST_ARCH=amd64 $(MAKE) tools
-	HOST_OS=linux HOST_ARCH=arm64 $(MAKE) tools
-	HOST_OS=darwin HOST_ARCH=amd64 $(MAKE) tools
-	HOST_OS=darwin HOST_ARCH=arm64 $(MAKE) tools
-
-	HOST_OS=linux HOST_ARCH=amd64 $(MAKE) vendor-go
-	HOST_OS=linux HOST_ARCH=arm64 $(MAKE) vendor-go
-	HOST_OS=darwin HOST_ARCH=amd64 $(MAKE) vendor-go
-	HOST_OS=darwin HOST_ARCH=arm64 $(MAKE) vendor-go
-
-	while read p; do \
-		$(sed_inplace) "$$p" $(self_file); \
-	done <"$(LEARN_FILE)"