diff --git a/.github/workflows/deps.yml b/.github/workflows/deps.yml
index 3f5c7d945..e53e896ae 100644
--- a/.github/workflows/deps.yml
+++ b/.github/workflows/deps.yml
@@ -26,4 +26,3 @@ jobs:
         with:
           go-version-input: 1.21.5
           go-version-file: go.mod
-
diff --git a/.gitignore b/.gitignore
index d0834b9a8..e6367060e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,7 @@
 aws-iam-authenticator
 
+bin
+
 /dist
 /_output
 
diff --git a/.go-version b/.go-version
new file mode 100644
index 000000000..ce2dd5357
--- /dev/null
+++ b/.go-version
@@ -0,0 +1 @@
+1.21.5
diff --git a/Dockerfile b/Dockerfile
index 4168e6506..48d642f52 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,6 +17,7 @@ ARG golang_image=public.ecr.aws/docker/library/golang:1.21.5
 FROM --platform=$BUILDPLATFORM $golang_image AS builder
 WORKDIR /go/src/github.com/kubernetes-sigs/aws-iam-authenticator
 COPY . .
+RUN go version
 RUN goproxy=https://goproxy.io go mod download
 ARG TARGETOS TARGETARCH
 RUN GOOS=$TARGETOS GOARCH=$TARGETARCH make bin
diff --git a/Makefile b/Makefile
index be14c41d3..ede3fc206 100644
--- a/Makefile
+++ b/Makefile
@@ -102,6 +102,7 @@ image: .image-linux-$(GOARCH)
 .PHONY: .image-linux-%
 .image-linux-%:
 	docker buildx build --output=type=docker --platform linux/$* \
+		--build-arg golang_image=$(shell hack/setup-go.sh) \
 		--tag aws-iam-authenticator:$(VERSION)_$(GIT_COMMIT)_$(BUILD_DATE_STRIPPED)-linux_$* .
 
 .PHONY: goreleaser
@@ -113,8 +114,7 @@ endif
 
 .PHONY: test
 test:
-	go test -v -coverprofile=coverage.out -race $(PKG)/pkg/...
-	go tool cover -html=coverage.out -o coverage.html
+	./hack/test-unit.sh
 
 .PHONY: integration
 integration:
diff --git a/hack/setup-go.sh b/hack/setup-go.sh
new file mode 100755
index 000000000..2dae86bb0
--- /dev/null
+++ b/hack/setup-go.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+# Copyright 2020 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# script to setup go version as needed
+# MUST BE RUN FROM THE REPO ROOT DIRECTORY
+
+# read go-version file unless GO_VERSION is set
+GO_VERSION="${GO_VERSION:-"$(cat .go-version)"}"
+GO_IMAGE=public.ecr.aws/docker/library/golang:$GO_VERSION
+
+# gotoolchain
+# https://go.dev/doc/toolchain
+export GOSUMDB="sum.golang.org"
+export GOTOOLCHAIN=go${GO_VERSION}
+
+# force go modules
+export GO111MODULE=on
+
+echo $GO_IMAGE
diff --git a/hack/test-integration.sh b/hack/test-integration.sh
index 4b7d97ded..272659a91 100755
--- a/hack/test-integration.sh
+++ b/hack/test-integration.sh
@@ -78,6 +78,10 @@ if [[ "${CREATE_TEST_ROLE}" = "true" ]]; then
     TEST_ROLE_ARN="$(echo ${create_role_output} | jq -r '.Role.Arn')"
 fi
 
+source hack/setup-go.sh
+
+go version
+
 make clean
 make bin
 
diff --git a/hack/test-unit.sh b/hack/test-unit.sh
new file mode 100755
index 000000000..0dd47c6b0
--- /dev/null
+++ b/hack/test-unit.sh
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o pipefail
+set -o nounset
+
+# cd to the repo root and setup go
+REPO_ROOT="$(cd "$( dirname "${BASH_SOURCE[0]}" )"/.. &> /dev/null && pwd)"
+
+source hack/setup-go.sh
+
+pushd ${REPO_ROOT}
+
+go version
+go test -v -coverprofile=coverage.out -race sigs.k8s.io/aws-iam-authenticator/pkg/...
+go tool cover -html=coverage.out -o coverage.html
+popd