diff --git a/Makefile b/Makefile
index 5f1459d..1cdf048 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,12 @@
+# GOTOOLCHAIN=local pins us to the vendored deps/go tree. Without it, a go.mod
+# `go` directive newer than deps/go re-execs into a downloaded toolchain module,
+# and those ship only 7 of the 15 GOROOT tools (no covdata) -- which makes
+# `test` below fail on the two packages that have no test files. deps-go builds
+# the missing tools in, so the vendored tree is self-sufficient. Keep the version
+# here in step with the `go` directive in go.mod.
+GO_VERSION := 1.25.5
 GO       := $(shell pwd)/deps/go/go/bin/go
+export GOTOOLCHAIN := local
 GOFLAGS  :=
 CGO_LDFLAGS := -L$(shell pwd)/deps/lib -Wl,-rpath,$(shell pwd)/deps/lib
 CGO_CFLAGS  := -I$(shell pwd)/deps/include -I$(shell pwd)/deps/whisper.cpp/ggml/include
@@ -8,7 +16,7 @@ PIPER_BIN     := $(shell pwd)/deps/piper/piper
 PIPER_MODEL   := $(shell pwd)/models/tts/ru_RU-irina-medium.onnx
 PIPER_ESPEAK  := $(shell pwd)/deps/piper/espeak-ng-data
 
-.PHONY: all build build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav clean test run-stt run-tts run-web download-embedder
+.PHONY: all build build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav clean test run-stt run-tts run-web download-embedder deps-go
 
 all: build
 
@@ -45,6 +53,22 @@ build-caldav:
 run-web: build-web
 	./mavweb -addr :9200 -voice 127.0.0.1:9100
 
+# Install the vendored Go toolchain from scratch. Go 1.24+ release tarballs no
+# longer ship covdata/pprof/test2json/nm/objdump/trace prebuilt -- `go tool X`
+# builds them on demand, but `go test -coverprofile` calls covdata through
+# base.Tool(), which only stats pkg/tool and exits. So build them in once here.
+GO_TARBALL := go$(GO_VERSION).linux-amd64.tar.gz
+GO_SHA256  := 9e9b755d63b36acf30c12a9a3fc379243714c1c6d3dd72861da637f336ebb35b
+deps-go:
+	@mkdir -p deps/go
+	cd deps/go && curl -fLO 'https://go.dev/dl/$(GO_TARBALL)'
+	cd deps/go && echo '$(GO_SHA256)  $(GO_TARBALL)' | sha256sum -c -
+	cd deps/go && rm -rf go && tar xzf $(GO_TARBALL) && rm $(GO_TARBALL)
+	cd deps/go/go/src && for t in covdata pprof test2json nm objdump trace addr2line buildid; do \
+		GOROOT="$(shell pwd)/deps/go/go" $(GO) build -o "$(shell pwd)/deps/go/go/pkg/tool/linux_amd64/$$t" "cmd/$$t" || exit 1; \
+	done
+	$(GO) version
+
 test:
 	CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \
 		$(GO) test -race -coverprofile=coverage.out ./internal/... ./cmd/...