diff --git a/cmd/containerd-shim-runhcs-v1/main.go b/cmd/containerd-shim-runhcs-v1/main.go
index 05a59fa2cd..77d51b61ed 100644
--- a/cmd/containerd-shim-runhcs-v1/main.go
+++ b/cmd/containerd-shim-runhcs-v1/main.go
@@ -31,7 +31,7 @@ const usage = ``
 const ttrpcAddressEnv = "TTRPC_ADDRESS"
 
 // Add a manifest to get proper Windows version detection.
-//go:generate go run github.com/josephspurrier/goversioninfo/cmd/goversioninfo -platform-specific
+//go:generate go tool github.com/josephspurrier/goversioninfo/cmd/goversioninfo -platform-specific
 
 // `-ldflags '-X ...'` only works if the variable is uninitialized or set to a constant value.
 // keep empty and override with data from [internal/version] only if empty to allow
diff --git a/cmd/runhcs/main.go b/cmd/runhcs/main.go
index 4ec95970bb..16fc198d3a 100644
--- a/cmd/runhcs/main.go
+++ b/cmd/runhcs/main.go
@@ -20,7 +20,7 @@ import (
 )
 
 // Add a manifest to get proper Windows version detection.
-//go:generate go run github.com/josephspurrier/goversioninfo/cmd/goversioninfo -platform-specific
+//go:generate go tool github.com/josephspurrier/goversioninfo/cmd/goversioninfo -platform-specific
 
 // `-ldflags '-X ...'` only works if the variable is uninitialized or set to a constant value.
 // keep empty and override with data from [internal/version] only if empty to allow
diff --git a/cmd/wclayer/wclayer.go b/cmd/wclayer/wclayer.go
index 325459ca3a..9b1b125352 100644
--- a/cmd/wclayer/wclayer.go
+++ b/cmd/wclayer/wclayer.go
@@ -13,7 +13,7 @@ import (
 )
 
 // Add a manifest to get proper Windows version detection.
-//go:generate go run github.com/josephspurrier/goversioninfo/cmd/goversioninfo -platform-specific
+//go:generate go tool github.com/josephspurrier/goversioninfo/cmd/goversioninfo -platform-specific
 
 var usage = `Windows Container layer utility
 
diff --git a/computestorage/storage.go b/computestorage/storage.go
index 5af931f2f4..cf3c3b296d 100644
--- a/computestorage/storage.go
+++ b/computestorage/storage.go
@@ -7,7 +7,7 @@ import (
 	hcsschema "github.com/Microsoft/hcsshim/internal/hcs/schema2"
 )
 
-//go:generate go run github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go storage.go
+//go:generate go tool github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go storage.go
 
 //sys hcsImportLayer(layerPath string, sourceFolderPath string, layerData string) (hr error) = computestorage.HcsImportLayer?
 //sys hcsExportLayer(layerPath string, exportFolderPath string, layerData string, options string) (hr error) = computestorage.HcsExportLayer?
diff --git a/go.mod b/go.mod
index 7a560b6540..17038d19ea 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,27 @@ module github.com/Microsoft/hcsshim
 
 go 1.24.0
 
+// protobuf/gRPC/ttrpc generation
+tool (
+	github.com/containerd/protobuild
+	github.com/containerd/protobuild/cmd/go-fix-acronym
+	github.com/containerd/ttrpc/cmd/protoc-gen-go-ttrpc
+	google.golang.org/grpc/cmd/protoc-gen-go-grpc
+	google.golang.org/protobuf/cmd/protoc-gen-go
+)
+
+// used in go:generate directives
+tool (
+	// generate Win32 API code
+	github.com/Microsoft/go-winio/tools/mkwinsyscall
+
+	// create syso files for manifesting
+	github.com/josephspurrier/goversioninfo/cmd/goversioninfo
+
+	// mock gRPC client and servers
+	go.uber.org/mock/mockgen
+)
+
 require (
 	github.com/Microsoft/cosesign1go v1.4.0
 	github.com/Microsoft/didx509go v0.0.3
@@ -16,12 +37,10 @@ require (
 	github.com/containerd/errdefs/pkg v0.3.0
 	github.com/containerd/go-runc v1.1.0
 	github.com/containerd/platforms v1.0.0-rc.1
-	github.com/containerd/protobuild v0.3.0
 	github.com/containerd/ttrpc v1.2.7
 	github.com/containerd/typeurl/v2 v2.2.3
 	github.com/google/go-cmp v0.7.0
 	github.com/google/go-containerregistry v0.20.1
-	github.com/josephspurrier/goversioninfo v1.5.0
 	github.com/linuxkit/virtsock v0.0.0-20241009230534-cb6a20cc0422
 	github.com/mattn/go-shellwords v1.0.12
 	github.com/moby/sys/user v0.4.0
@@ -43,7 +62,6 @@ require (
 	golang.org/x/sync v0.16.0
 	golang.org/x/sys v0.39.0
 	google.golang.org/grpc v1.75.0
-	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1
 	google.golang.org/protobuf v1.36.7
 )
 
@@ -59,6 +77,7 @@ require (
 	github.com/containerd/fifo v1.1.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/plugin v1.0.0 // indirect
+	github.com/containerd/protobuild v0.3.0 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.15.1 // indirect
 	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.5 // indirect
@@ -81,6 +100,7 @@ require (
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
+	github.com/josephspurrier/goversioninfo v1.5.0 // indirect
 	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/lestrrat-go/backoff/v2 v2.0.8 // indirect
 	github.com/lestrrat-go/blackmagic v1.0.2 // indirect
@@ -124,6 +144,7 @@ require (
 	golang.org/x/text v0.28.0 // indirect
 	golang.org/x/tools v0.36.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
+	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	sigs.k8s.io/yaml v1.4.0 // indirect
 )
diff --git a/hcn/hcn.go b/hcn/hcn.go
index 671da24443..ecef66caf6 100644
--- a/hcn/hcn.go
+++ b/hcn/hcn.go
@@ -10,7 +10,7 @@ import (
 	"github.com/Microsoft/go-winio/pkg/guid"
 )
 
-//go:generate go run github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go hcn.go
+//go:generate go tool github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go hcn.go
 
 /// HNS V1 API
 
diff --git a/hcsshim.go b/hcsshim.go
index 13f80e4a81..4557c7cf5f 100644
--- a/hcsshim.go
+++ b/hcsshim.go
@@ -11,7 +11,7 @@ import (
 	"github.com/Microsoft/hcsshim/internal/hcserror"
 )
 
-//go:generate go run github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go hcsshim.go
+//go:generate go tool github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go hcsshim.go
 
 //sys SetCurrentThreadCompartmentId(compartmentId uint32) (hr error) = iphlpapi.SetCurrentThreadCompartmentId
 
diff --git a/internal/computeagent/doc.go b/internal/computeagent/doc.go
index f638a4c206..106136d271 100644
--- a/internal/computeagent/doc.go
+++ b/internal/computeagent/doc.go
@@ -5,4 +5,4 @@
 // used for ncproxy.
 package computeagent
 
-//go:generate go run go.uber.org/mock/mockgen -source=computeagent_ttrpc.pb.go -package=computeagent_mock -destination=mock\computeagent_mock.pb.go
+//go:generate go tool go.uber.org/mock/mockgen -source=computeagent_ttrpc.pb.go -package=computeagent_mock -destination=mock\computeagent_mock.pb.go
diff --git a/internal/hns/hns.go b/internal/hns/hns.go
index ec4c907d1f..8c9aa15c04 100644
--- a/internal/hns/hns.go
+++ b/internal/hns/hns.go
@@ -2,7 +2,7 @@ package hns
 
 import "fmt"
 
-//go:generate go run github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go hns.go
+//go:generate go tool github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go hns.go
 
 //sys _hnsCall(method string, path string, object string, response **uint16) (hr error) = vmcompute.HNSCall?
 
diff --git a/internal/interop/interop.go b/internal/interop/interop.go
index a564696568..0f8f676c58 100644
--- a/internal/interop/interop.go
+++ b/internal/interop/interop.go
@@ -7,7 +7,7 @@ import (
 	"unsafe"
 )
 
-//go:generate go run github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go interop.go
+//go:generate go tool github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go interop.go
 
 //sys coTaskMemFree(buffer unsafe.Pointer) = api_ms_win_core_com_l1_1_0.CoTaskMemFree
 
diff --git a/internal/regstate/regstate.go b/internal/regstate/regstate.go
index 1ccce1944c..f10b367ad4 100644
--- a/internal/regstate/regstate.go
+++ b/internal/regstate/regstate.go
@@ -16,7 +16,7 @@ import (
 	"golang.org/x/sys/windows/registry"
 )
 
-//go:generate go run github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go regstate.go
+//go:generate go tool github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go regstate.go
 
 //sys	regCreateKeyEx(key syscall.Handle, subkey *uint16, reserved uint32, class *uint16, options uint32, desired uint32, sa *syscall.SecurityAttributes, result *syscall.Handle, disposition *uint32) (regerrno error) = advapi32.RegCreateKeyExW
 
diff --git a/internal/security/syscall_windows.go b/internal/security/syscall_windows.go
index 71326e4e46..81ec7df43a 100644
--- a/internal/security/syscall_windows.go
+++ b/internal/security/syscall_windows.go
@@ -1,6 +1,6 @@
 package security
 
-//go:generate go run github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go syscall_windows.go
+//go:generate go tool github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go syscall_windows.go
 
 //sys getSecurityInfo(handle syscall.Handle, objectType uint32, si uint32, ppsidOwner **uintptr, ppsidGroup **uintptr, ppDacl *uintptr, ppSacl *uintptr, ppSecurityDescriptor *uintptr) (win32err error) = advapi32.GetSecurityInfo
 //sys setSecurityInfo(handle syscall.Handle, objectType uint32, si uint32, psidOwner uintptr, psidGroup uintptr, pDacl uintptr, pSacl uintptr) (win32err error) = advapi32.SetSecurityInfo
diff --git a/internal/vmcompute/vmcompute.go b/internal/vmcompute/vmcompute.go
index 965086a580..5819dc6df3 100644
--- a/internal/vmcompute/vmcompute.go
+++ b/internal/vmcompute/vmcompute.go
@@ -17,7 +17,7 @@ import (
 	"github.com/Microsoft/hcsshim/internal/timeout"
 )
 
-//go:generate go run github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go vmcompute.go
+//go:generate go tool github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go vmcompute.go
 
 //sys hcsEnumerateComputeSystems(query string, computeSystems **uint16, result **uint16) (hr error) = vmcompute.HcsEnumerateComputeSystems?
 //sys hcsCreateComputeSystem(id string, configuration string, identity syscall.Handle, computeSystem *HcsSystem, result **uint16) (hr error) = vmcompute.HcsCreateComputeSystem?
diff --git a/internal/wclayer/wclayer.go b/internal/wclayer/wclayer.go
index 39682b8171..8cc661cbfe 100644
--- a/internal/wclayer/wclayer.go
+++ b/internal/wclayer/wclayer.go
@@ -4,7 +4,7 @@ package wclayer
 
 import "github.com/Microsoft/go-winio/pkg/guid"
 
-//go:generate go run github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go wclayer.go
+//go:generate go tool github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go wclayer.go
 
 //sys activateLayer(info *driverInfo, id string) (hr error) = vmcompute.ActivateLayer?
 //sys copyLayer(info *driverInfo, srcId string, dstId string, descriptors []WC_LAYER_DESCRIPTOR) (hr error) = vmcompute.CopyLayer?
diff --git a/internal/winapi/winapi.go b/internal/winapi/winapi.go
index 6a90e3a69a..009e70ab19 100644
--- a/internal/winapi/winapi.go
+++ b/internal/winapi/winapi.go
@@ -1,3 +1,3 @@
 package winapi
 
-//go:generate go run github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go ./*.go
+//go:generate go tool github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go ./*.go
diff --git a/pkg/ncproxy/nodenetsvc/v0/doc.go b/pkg/ncproxy/nodenetsvc/v0/doc.go
index c832e3b744..f143e3c19d 100644
--- a/pkg/ncproxy/nodenetsvc/v0/doc.go
+++ b/pkg/ncproxy/nodenetsvc/v0/doc.go
@@ -1,3 +1,3 @@
 package v0
 
-//go:generate go run go.uber.org/mock/mockgen -source=nodenetsvc_grpc.pb.go -package=nodenetsvc_v0_mock -destination=mock\nodenetsvc_mock.pb.go
+//go:generate go tool go.uber.org/mock/mockgen -source=nodenetsvc_grpc.pb.go -package=nodenetsvc_v0_mock -destination=mock\nodenetsvc_mock.pb.go
diff --git a/pkg/ncproxy/nodenetsvc/v1/doc.go b/pkg/ncproxy/nodenetsvc/v1/doc.go
index 4284123a5f..a9b9a70aba 100644
--- a/pkg/ncproxy/nodenetsvc/v1/doc.go
+++ b/pkg/ncproxy/nodenetsvc/v1/doc.go
@@ -5,4 +5,4 @@
 // used for ncproxy.
 package v1
 
-//go:generate go run go.uber.org/mock/mockgen -source=nodenetsvc_grpc.pb.go -package=nodenetsvc_v1_mock -destination=mock\nodenetsvc_mock.pb.go
+//go:generate go tool go.uber.org/mock/mockgen -source=nodenetsvc_grpc.pb.go -package=nodenetsvc_v1_mock -destination=mock\nodenetsvc_mock.pb.go
diff --git a/scripts/Update-Proto.ps1 b/scripts/Update-Proto.ps1
index 1192a69acf..78995209ec 100644
--- a/scripts/Update-Proto.ps1
+++ b/scripts/Update-Proto.ps1
@@ -19,7 +19,12 @@ function run([string]$cmd, [string[]]$params) {
 
 # Install protobuild and co.
 # calling `go install` without a version will install current module (ie., the vendor directory)
-# this relies on `./tools.go` to vendor correct dependencies
+# this relies on go.mod tool directives to vendor correct dependencies
+#
+# Note: we cannot use `go tool <cmd>` to install them since it builds the binaries in a temp dir and
+# they, therefore, are not available from $PATH.
+#
+# See: https://go.dev/ref/mod#go-mod-file-tool
 @(
     'github.com/containerd/protobuild',
     'github.com/containerd/protobuild/cmd/go-fix-acronym',
diff --git a/test/go.mod b/test/go.mod
index b08e13e2e9..6c18179c35 100644
--- a/test/go.mod
+++ b/test/go.mod
@@ -2,6 +2,9 @@ module github.com/Microsoft/hcsshim/test
 
 go 1.24.0
 
+// create syso files for manifesting
+tool github.com/josephspurrier/goversioninfo/cmd/goversioninfo
+
 require (
 	github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29
 	github.com/Microsoft/hcsshim v0.13.0
@@ -14,7 +17,6 @@ require (
 	github.com/containerd/ttrpc v1.2.7
 	github.com/google/go-cmp v0.7.0
 	github.com/google/go-containerregistry v0.20.1
-	github.com/josephspurrier/goversioninfo v1.5.0
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/opencontainers/runtime-spec v1.2.1
@@ -71,6 +73,7 @@ require (
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
+	github.com/josephspurrier/goversioninfo v1.5.0 // indirect
 	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/lestrrat-go/backoff/v2 v2.0.8 // indirect
 	github.com/lestrrat-go/blackmagic v1.0.2 // indirect
diff --git a/test/pkg/manifest/manifest.go b/test/pkg/manifest/manifest.go
index 386de8fa57..fb40921761 100644
--- a/test/pkg/manifest/manifest.go
+++ b/test/pkg/manifest/manifest.go
@@ -3,4 +3,4 @@
 // This package allows tests can include the .syso to manifest them to pick up the right Windows build
 package manifest
 
-//go:generate go run github.com/josephspurrier/goversioninfo/cmd/goversioninfo -platform-specific
+//go:generate go tool github.com/josephspurrier/goversioninfo/cmd/goversioninfo -platform-specific
diff --git a/test/tools.go b/test/tools.go
deleted file mode 100644
index 2604c63aeb..0000000000
--- a/test/tools.go
+++ /dev/null
@@ -1,8 +0,0 @@
-//go:build tools
-
-package tools
-
-import (
-	// create syso files for manifesting
-	_ "github.com/josephspurrier/goversioninfo/cmd/goversioninfo"
-)
diff --git a/tools/README.md b/tools/README.md
deleted file mode 100644
index 27593cee66..0000000000
--- a/tools/README.md
+++ /dev/null
@@ -1,22 +0,0 @@
-# Tools
-
-This package contains imports to various tools used (eg, via `//go:generate`) within the hcsshim repo,
-allowing them to be versioned and ensuring their dependencies match what the shim use
-(specifically for auto-generated protobuf code).
-
-Calls to `go run <cmd/import/path>` (or `//go:generate go run <cmd/import/path>`) for go executables
-included here  will use the version specified in `go.mod` and build the executable from vendored code.
-
-Using a dedicate package prevents callers who import `github.com/Microsoft/hcsshim` from including these
-tools in their dependencies.
-
-Based on golang [guidance].
-
-## Adding Dependencies
-
-To add a new dependency, add a `_ "cmd/import/path"` to `tools.go`, and then tidy and vendor the repo.
-
-In general executables used in auto-generating code (eg, `protobuild`, `protoc-gen-go-*`, and co.), or testing
-(eg, `gotestsum`, `benchstat`) should be included here.
-
-[guidance]: https://github.com/golang/go/wiki/Modules#how-can-i-track-tool-dependencies-for-a-module
diff --git a/tools/tools.go b/tools/tools.go
deleted file mode 100644
index 90d87d0edb..0000000000
--- a/tools/tools.go
+++ /dev/null
@@ -1,28 +0,0 @@
-//go:build tools
-
-package tools
-
-// TODO(go1.24): use tools directive in go.mod
-// See:
-//  - https://github.com/golang/go/issues/48429
-//  - https://go.googlesource.com/proposal/+/54d6775ff71ccbc00c276db2a4e4841d67011cf4/design/48429-go-tool-modules.md
-
-import (
-	// protobuf/gRPC/ttrpc generation
-	_ "github.com/containerd/protobuild"
-	_ "github.com/containerd/protobuild/cmd/go-fix-acronym"
-	_ "github.com/containerd/ttrpc/cmd/protoc-gen-go-ttrpc"
-	_ "google.golang.org/grpc/cmd/protoc-gen-go-grpc"
-	_ "google.golang.org/protobuf/cmd/protoc-gen-go"
-
-	// used in go:generate directives
-
-	// generate Win32 API code
-	_ "github.com/Microsoft/go-winio/tools/mkwinsyscall"
-
-	// create syso files for manifesting
-	_ "github.com/josephspurrier/goversioninfo/cmd/goversioninfo"
-
-	// mock gRPC client and servers
-	_ "go.uber.org/mock/mockgen"
-)