diff --git a/.circleci/config.yml b/.circleci/config.yml
index 654005137d67d..4821c723f9347 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -104,10 +104,13 @@ jobs:
     shell: /usr/bin/env bash -euo pipefail -c
     working_directory: /home/circleci/go/src/github.com/hashicorp/vault
     steps:
+    - checkout
     - run:
         command: |
+          GO_VERSION=$(cat .go-version)
           [ -n "$GO_VERSION" ] || { echo "You must set GO_VERSION"; exit 1; }
           # Install Go
+          cd ~
           curl -sSLO "https://dl.google.com/go/go${GO_VERSION}.linux-amd64.tar.gz"
           sudo rm -rf /usr/local/go
           sudo tar -C /usr/local -xzf "go${GO_VERSION}.linux-amd64.tar.gz"
@@ -123,8 +126,6 @@ jobs:
           echo "$ go version"
           go version
         name: Setup Go
-        working_directory: ~/
-    - checkout
     - restore_cache:
         keys:
         - v1.5-{{checksum "go.sum"}}-{{checksum "sdk/go.sum"}}-{{checksum "api/go.sum"}}
@@ -146,9 +147,9 @@ jobs:
         root: .
     environment:
     - CIRCLECI_CLI_VERSION: 0.1.5546
+    - GO_IMAGE: docker.mirror.hashicorp.services/cimg/go:1.17.13
     - GO_TAGS: ''
-    - GO_VERSION: 1.17.13
-    - GOFUMPT_VERSION: 0.2.1
+    - GOFUMPT_VERSION: 0.3.1
     - GOTESTSUM_VERSION: 0.5.2
   algolia-index:
     docker:
@@ -316,7 +317,7 @@ jobs:
               -e NO_PROXY \
               -e VAULT_TEST_LOG_DIR=/tmp/testlogs \
               --network vaulttest --name \
-              testcontainer docker.mirror.hashicorp.services/cimg/go:1.17.13 \
+              testcontainer $GO_IMAGE \
               tail -f /dev/null
 
             # Run tests
@@ -377,17 +378,23 @@ jobs:
         path: /tmp/testlogs
     environment:
     - CIRCLECI_CLI_VERSION: 0.1.5546
+    - GO_IMAGE: docker.mirror.hashicorp.services/cimg/go:1.17.13
     - GO_TAGS: ''
+    - GOFUMPT_VERSION: 0.3.1
+    - GOTESTSUM_VERSION: 0.5.2
   fmt:
     machine:
       image: ubuntu-2004:202201-02
     shell: /usr/bin/env bash -euo pipefail -c
     working_directory: /home/circleci/go/src/github.com/hashicorp/vault
     steps:
+    - checkout
     - run:
         command: |
+          GO_VERSION=$(cat .go-version)
           [ -n "$GO_VERSION" ] || { echo "You must set GO_VERSION"; exit 1; }
           # Install Go
+          cd ~
           curl -sSLO "https://dl.google.com/go/go${GO_VERSION}.linux-amd64.tar.gz"
           sudo rm -rf /usr/local/go
           sudo tar -C /usr/local -xzf "go${GO_VERSION}.linux-amd64.tar.gz"
@@ -403,8 +410,6 @@ jobs:
           echo "$ go version"
           go version
         name: Setup Go
-        working_directory: ~/
-    - checkout
     - run:
         command: |
           go install "mvdan.cc/gofumpt@v${GOFUMPT_VERSION}"
@@ -416,9 +421,9 @@ jobs:
         name: make fmt
     environment:
     - CIRCLECI_CLI_VERSION: 0.1.5546
+    - GO_IMAGE: docker.mirror.hashicorp.services/cimg/go:1.17.13
     - GO_TAGS: ''
-    - GO_VERSION: 1.17.13
-    - GOFUMPT_VERSION: 0.2.1
+    - GOFUMPT_VERSION: 0.3.1
     - GOTESTSUM_VERSION: 0.5.2
   test-go-race:
     docker:
@@ -566,7 +571,7 @@ jobs:
               -e NO_PROXY \
               -e VAULT_TEST_LOG_DIR=/tmp/testlogs \
               --network vaulttest --name \
-              testcontainer docker.mirror.hashicorp.services/cimg/go:1.17.13 \
+              testcontainer $GO_IMAGE \
               tail -f /dev/null
 
             # Run tests
@@ -621,7 +626,10 @@ jobs:
         path: /tmp/testlogs
     environment:
     - CIRCLECI_CLI_VERSION: 0.1.5546
+    - GO_IMAGE: docker.mirror.hashicorp.services/cimg/go:1.17.13
     - GO_TAGS: ''
+    - GOFUMPT_VERSION: 0.3.1
+    - GOTESTSUM_VERSION: 0.5.2
   website-docker-image:
     docker:
     - image: circleci/buildpack-deps
@@ -791,7 +799,7 @@ jobs:
               -e NO_PROXY \
               -e VAULT_TEST_LOG_DIR=/tmp/testlogs \
               --network vaulttest --name \
-              testcontainer docker.mirror.hashicorp.services/cimg/go:1.17.13 \
+              testcontainer $GO_IMAGE \
               tail -f /dev/null
 
             # Run tests
@@ -846,17 +854,23 @@ jobs:
         path: /tmp/testlogs
     environment:
     - CIRCLECI_CLI_VERSION: 0.1.5546
+    - GO_IMAGE: docker.mirror.hashicorp.services/cimg/go:1.17.13
     - GO_TAGS: ''
+    - GOFUMPT_VERSION: 0.3.1
+    - GOTESTSUM_VERSION: 0.5.2
   pre-flight-checks:
     machine:
       image: ubuntu-2004:202201-02
     shell: /usr/bin/env bash -euo pipefail -c
     working_directory: /home/circleci/go/src/github.com/hashicorp/vault
     steps:
+    - checkout
     - run:
         command: |
+          GO_VERSION=$(cat .go-version)
           [ -n "$GO_VERSION" ] || { echo "You must set GO_VERSION"; exit 1; }
           # Install Go
+          cd ~
           curl -sSLO "https://dl.google.com/go/go${GO_VERSION}.linux-amd64.tar.gz"
           sudo rm -rf /usr/local/go
           sudo tar -C /usr/local -xzf "go${GO_VERSION}.linux-amd64.tar.gz"
@@ -872,8 +886,6 @@ jobs:
           echo "$ go version"
           go version
         name: Setup Go
-        working_directory: ~/
-    - checkout
     - run:
         command: |
           export CCI_PATH=/tmp/circleci-cli/$CIRCLECI_CLI_VERSION
@@ -937,9 +949,9 @@ jobs:
         - /home/circleci/go/pkg/mod
     environment:
     - CIRCLECI_CLI_VERSION: 0.1.5546
+    - GO_IMAGE: docker.mirror.hashicorp.services/cimg/go:1.17.13
     - GO_TAGS: ''
-    - GO_VERSION: 1.17.13
-    - GOFUMPT_VERSION: 0.2.1
+    - GOFUMPT_VERSION: 0.3.1
     - GOTESTSUM_VERSION: 0.5.2
   test-go-race-remote-docker:
     docker:
@@ -1091,7 +1103,7 @@ jobs:
               -e NO_PROXY \
               -e VAULT_TEST_LOG_DIR=/tmp/testlogs \
               --network vaulttest --name \
-              testcontainer docker.mirror.hashicorp.services/cimg/go:1.17.13 \
+              testcontainer $GO_IMAGE \
               tail -f /dev/null
 
             # Run tests
@@ -1152,7 +1164,10 @@ jobs:
         path: /tmp/testlogs
     environment:
     - CIRCLECI_CLI_VERSION: 0.1.5546
+    - GO_IMAGE: docker.mirror.hashicorp.services/cimg/go:1.17.13
     - GO_TAGS: ''
+    - GOFUMPT_VERSION: 0.3.1
+    - GOTESTSUM_VERSION: 0.5.2
 workflows:
   ci:
     jobs:
diff --git a/.circleci/config/commands/go_test.yml b/.circleci/config/commands/go_test.yml
index afa98bcc25cf1..1345ca3f6e5eb 100644
--- a/.circleci/config/commands/go_test.yml
+++ b/.circleci/config/commands/go_test.yml
@@ -12,9 +12,6 @@ parameters:
   save_cache:
     type: boolean
     default: false
-  go_image:
-    type: string
-    default: "docker.mirror.hashicorp.services/cimg/go:1.17.13"
   use_docker:
     type: boolean
     default: false
@@ -149,7 +146,7 @@ steps:
             -e NO_PROXY \
             -e VAULT_TEST_LOG_DIR=<< parameters.log_dir >> \
             --network vaulttest --name \
-            testcontainer << parameters.go_image >> \
+            testcontainer $GO_IMAGE \
             tail -f /dev/null
 
           # Run tests
diff --git a/.circleci/config/commands/setup-go.yml b/.circleci/config/commands/setup-go.yml
index 715c4d6f4d705..5aec0087e9dad 100644
--- a/.circleci/config/commands/setup-go.yml
+++ b/.circleci/config/commands/setup-go.yml
@@ -13,11 +13,12 @@ parameters:
     default: github.com/hashicorp/*
 steps:
   - run:
-      working_directory: ~/
       name: Setup Go
       command: |
+        GO_VERSION=$(cat .go-version)
         [ -n "$GO_VERSION" ] || { echo "You must set GO_VERSION"; exit 1; }
         # Install Go
+        cd ~
         curl -sSLO "https://dl.google.com/go/go${GO_VERSION}.linux-amd64.tar.gz"
         sudo rm -rf /usr/local/go
         sudo tar -C /usr/local -xzf "go${GO_VERSION}.linux-amd64.tar.gz"
diff --git a/.circleci/config/executors/@executors.yml b/.circleci/config/executors/@executors.yml
index 40e16db67de92..0d9aac2b3594a 100644
--- a/.circleci/config/executors/@executors.yml
+++ b/.circleci/config/executors/@executors.yml
@@ -1,13 +1,16 @@
+references:
+  environment: &ENVIRONMENT
+    CIRCLECI_CLI_VERSION: 0.1.5546 # Pin CircleCI CLI to patch version (ex: 1.2.3)
+    GOTESTSUM_VERSION: 0.5.2 # Pin gotestsum to patch version (ex: 1.2.3)
+    GOFUMPT_VERSION: 0.3.1 # Pin gofumpt to patch version (ex: 1.2.3)
+    GO_TAGS: ""
+    GO_IMAGE: &GO_IMAGE "docker.mirror.hashicorp.services/cimg/go:1.17.13"
+
 go-machine:
   machine:
     image: ubuntu-2004:202201-02
+  environment: *ENVIRONMENT
   shell: /usr/bin/env bash -euo pipefail -c
-  environment:
-    CIRCLECI_CLI_VERSION: 0.1.5546  # Pin CircleCI CLI to patch version (ex: 1.2.3)
-    GO_VERSION: 1.17.13  # Pin Go to patch version (ex: 1.2.3)
-    GOTESTSUM_VERSION: 0.5.2  # Pin gotestsum to patch version (ex: 1.2.3)
-    GOFUMPT_VERSION: 0.2.1  # Pin gofumpt to patch version (ex: 1.2.3)
-    GO_TAGS: ""
   working_directory: /home/circleci/go/src/github.com/hashicorp/vault
 node:
   docker:
@@ -27,24 +30,18 @@ alpine:
 docker-env-go-test-remote-docker:
   resource_class: medium
   docker:
-    - image: "docker.mirror.hashicorp.services/cimg/go:1.17.13"
-  environment:
-    CIRCLECI_CLI_VERSION: 0.1.5546  # Pin CircleCI CLI to patch version (ex: 1.2.3)
-    GO_TAGS: ""
+    - image: *GO_IMAGE
+  environment: *ENVIRONMENT
   working_directory: /home/circleci/go/src/github.com/hashicorp/vault
 docker-env-go-test:
   resource_class: large
   docker:
-    - image: "docker.mirror.hashicorp.services/cimg/go:1.17.13"
-  environment:
-    CIRCLECI_CLI_VERSION: 0.1.5546  # Pin CircleCI CLI to patch version (ex: 1.2.3)
-    GO_TAGS: ""
+    - image: *GO_IMAGE
+  environment: *ENVIRONMENT
   working_directory: /home/circleci/go/src/github.com/hashicorp/vault
 docker-env-go-test-race:
   resource_class: xlarge
   docker:
-    - image: "docker.mirror.hashicorp.services/cimg/go:1.17.13"
-  environment:
-    CIRCLECI_CLI_VERSION: 0.1.5546  # Pin CircleCI CLI to patch version (ex: 1.2.3)
-    GO_TAGS: ""
+    - image: *GO_IMAGE
+  environment: *ENVIRONMENT
   working_directory: /home/circleci/go/src/github.com/hashicorp/vault
diff --git a/.circleci/config/jobs/build-go-dev.yml b/.circleci/config/jobs/build-go-dev.yml
index b193488e1c28c..cce6d3f61edda 100644
--- a/.circleci/config/jobs/build-go-dev.yml
+++ b/.circleci/config/jobs/build-go-dev.yml
@@ -1,7 +1,7 @@
 executor: go-machine
 steps:
-  - setup-go
   - checkout
+  - setup-go
   - restore_go_mod_cache
   - attach_workspace:
       at: .
diff --git a/.circleci/config/jobs/fmt.yml b/.circleci/config/jobs/fmt.yml
index 29a8a70d7693e..68f8a87e3ec63 100644
--- a/.circleci/config/jobs/fmt.yml
+++ b/.circleci/config/jobs/fmt.yml
@@ -1,10 +1,10 @@
 description: Ensure go formatting is correct.
 executor: go-machine
 steps:
+  - checkout
   # Setup Go enabling the proxy for downloading modules.
   - setup-go:
       GOPROXY: https://proxy.golang.org,direct
-  - checkout
   - run:
       name: make fmt
       command: |
diff --git a/.circleci/config/jobs/pre-flight-checks.yml b/.circleci/config/jobs/pre-flight-checks.yml
index 347a6a7def433..924b451b51d2c 100644
--- a/.circleci/config/jobs/pre-flight-checks.yml
+++ b/.circleci/config/jobs/pre-flight-checks.yml
@@ -1,10 +1,10 @@
 description: Ensure nothing obvious is broken, and pre-cache Go modules.
 executor: go-machine
 steps:
+  - checkout
   # Setup Go enabling the proxy for downloading modules.
   - setup-go:
       GOPROXY: https://proxy.golang.org,direct
-  - checkout
   - run:
       name: Install CircleCI CLI
       environment:
diff --git a/.circleci/config/jobs/test-go-nightly.yml b/.circleci/config/jobs/test-go-nightly.yml
index 11cb11913e0b6..502cdfa4e185a 100644
--- a/.circleci/config/jobs/test-go-nightly.yml
+++ b/.circleci/config/jobs/test-go-nightly.yml
@@ -1,7 +1,7 @@
 executor: go-machine
 steps:
-  - setup-go
   - checkout
+  - setup-go
   - restore_go_mod_cache
   - go_test:
       log_dir: "/tmp/testlogs"
diff --git a/.github/workflows/goversion-checker.yml b/.github/workflows/goversion-checker.yml
new file mode 100644
index 0000000000000..71ed31b65e5f2
--- /dev/null
+++ b/.github/workflows/goversion-checker.yml
@@ -0,0 +1,23 @@
+name: Check Go version
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+
+jobs:
+  go-version-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+      - name: Verify go versions in tree are consistent with one another
+        run: |
+          GOVER=$(cat .go-version)
+          EXPECTED="docker.mirror.hashicorp.services/cimg/go:$GOVER"
+          GOT=$(yq .references.environment.GO_IMAGE .circleci/config/executors/@executors.yml)
+          if [ "$EXPECTED" != "$GOT" ]; then
+            echo "version mismatch, .go-version has '$GOVER' and circleci config uses '$GOT'"
+            exit 1
+          fi
\ No newline at end of file
diff --git a/.go-version b/.go-version
new file mode 100644
index 0000000000000..836ae4eda2992
--- /dev/null
+++ b/.go-version
@@ -0,0 +1 @@
+1.19.2
diff --git a/Makefile b/Makefile
index a00e52cb201e6..0395aab2e8c78 100644
--- a/Makefile
+++ b/Makefile
@@ -15,7 +15,7 @@ EXTERNAL_TOOLS=\
 GOFMT_FILES?=$$(find . -name '*.go' | grep -v pb.go | grep -v vendor)
 
 
-GO_VERSION_MIN=1.17.13
+GO_VERSION_MIN=$$(cat $(CURDIR)/.go_version)
 GO_CMD?=go
 CGO_ENABLED?=0
 ifneq ($(FDB_ENABLED), )
@@ -179,8 +179,8 @@ ember-dist-dev:
 	@echo "--> Building Ember application"
 	@cd ui && yarn run build:dev
 
-static-dist: ember-dist 
-static-dist-dev: ember-dist-dev 
+static-dist: ember-dist
+static-dist-dev: ember-dist-dev
 
 proto: bootstrap
 	protoc --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative vault/*.proto
diff --git a/README.md b/README.md
index 39b12e8aa0290..5931eab6671f0 100644
--- a/README.md
+++ b/README.md
@@ -70,8 +70,7 @@ Developing Vault
 --------------------
 
 If you wish to work on Vault itself or any of its built-in systems, you'll
-first need [Go](https://www.golang.org) installed on your machine. Go version
-1.17.13+ is *required*.
+first need [Go](https://www.golang.org) installed on your machine.
 
 For local dev first make sure Go is properly installed, including setting up a
 [GOPATH](https://golang.org/doc/code.html#GOPATH). Ensure that `$GOPATH/bin` is in
diff --git a/scripts/docker/Dockerfile b/scripts/docker/Dockerfile
index 1ee94cf09652c..d109b75a074e3 100644
--- a/scripts/docker/Dockerfile
+++ b/scripts/docker/Dockerfile
@@ -1,7 +1,6 @@
 # Multi-stage builder to avoid polluting users environment with wrong
-# architecture binaries.  Since this binary is used in an alpine container,
-# we're explicitly compiling for 'linux/amd64'
-ARG VERSION=1.17.13
+# architecture binaries.
+ARG VERSION
 
 FROM golang:${VERSION} AS builder
 
diff --git a/scripts/docker/Dockerfile.ui b/scripts/docker/Dockerfile.ui
index 9bfbfb38110c1..33754d6cb9eb8 100644
--- a/scripts/docker/Dockerfile.ui
+++ b/scripts/docker/Dockerfile.ui
@@ -3,7 +3,7 @@
 # we're explicitly compiling for 'linux/amd64'
 FROM debian:buster AS builder
 
-ARG VERSION=1.17.13
+ARG VERSION
 ARG CGO_ENABLED=0
 ARG BUILD_TAGS
 ENV JOBS=2