diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index 54bf2197c..ac2539f88 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -531,7 +531,7 @@ Discovery is read-only, never touches the network, and never fails the run: a ma
 | bun | `bun.lock`; `bun.lockb` only when there is no `bun.lock` (bun reads exactly one) | URL tuple / binary remote-tarball resolution; version from the URL leaf. A user URL or `file:` tarball tuple / record whose `<name>-<ver>.tgz` leaf names the same `name@version` is installed from its own spec, so every ref for that `name@version` is dropped | `.socket/vendor/npm/<uuid>/<name>-<ver>.tgz` tuple / local-tarball resolution | `sha512-…`, required. A 2-tuple that Bun < 1.3.10 re-saved without its digest is still a reference, but it attests only from an installed tree. |
 | vlt | `vlt-lock.json` (lockfileVersion absent, `0` or `1`; a BOM-prefixed, unparseable, non-object or other-version lock is not read: diagnosed, no ref). `vlt.json` (read only for its `modifiers`) and `node_modules/.vlt-lock.json` are never wiring. | a registry node (any segment) whose slot [3] is a `/patch/npm/…` URL on the patch host with the leaf `<bare>-<ver>.tgz` of its DepID's `name@version`, whose embedded `<name>/<ver>` path (when present) is that `name@version`, and slot [1] == name; version from the DepID | a `file` node `.socket/vendor/npm/<uuid>/<name>-<ver>/node_modules/<name>` (or a user-installed `<name>-<ver>.tgz`) with slot [1] == name; version from the path. A same-`name@version` registry node, or a diagnosed Socket-shaped one, beside it is diagnosed, no ref. | slot [2] `sha512-…`, required (a hosted node without one is no reference). A same-`name@version` node on another registry, or a diagnosed Socket-shaped one, keeps the reference but withholds the lockfile basis: only an installed tree whose every store copy verifies attests. So does a lock some vlt release discards, the conditions of `redirect_vlt_lockfile_version_missing`, `redirect_vlt_old_lockfile_ignored` and `redirect_vlt_scalar_registry_ignored` (which in-run `--vex` withholds too): every hosted reference in it keeps no pin, and one `patched_ref_unattributable` names them. |
 | cargo | `Cargo.lock`, `Cargo.toml`, `.cargo/config` (else `.cargo/config.toml`) | `Cargo.lock` `source = "sparse+…/<uuid>/index/"`, confirmed by `Cargo.toml`: a crate the root manifest declares must pin `registry = "socket-patch-<uuid>"`. A reverted pin is diagnosed, no ref. Another `[[package]]` of the same `name@version` from a non-Socket source (crates.io, git), which cargo locks beside the pin for a dependent added later and builds unpatched (#679), withholds the ref (`patched_ref_unattributable`, never attested) while `rollback` / `remove` still unwind it. | `[patch.<source>] <key> = { path = ".socket/vendor/cargo/<uuid>/<name>-<ver>" }` — primarily the root `Cargo.toml` (v5 `vendor`; key-agnostic: `<name>` is `package` when renamed, else the key, so `<name>-socket-<uuid8>` keys count), also the project config (pre-v5 wiring), live only while the lock holds a sourceless entry for it that is not in `[[patch.unused]]`; a manifest entry cargo ignores — the project config redefines its key with another path, or a `[patch."https://github.com/rust-lang/crates.io-index"]` table replaces `[patch.crates-io]` — is diagnosed (`patched_ref_invalid`), no ref | `checksum` (v1: `[metadata]`), required |
-| golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` | `replace M v => ./.socket/vendor/golang/<uuid>/M@v` | the socket module's `/go.mod` go.sum line, required. The zip line (`h1:` of the module tree) is the locked integrity when present; `go mod tidy` prunes it when no package of the module is loaded and the build stays green, so the `/go.mod` line alone still attests from the lockfile, unless the main modules' `require`s or go.sum show the build selects another version (MVS keeps the `/go.mod` line of versions it only reads): then the replace is inert. With a `go.work` the main modules are its `use` members and the build selects by MVS over their module graph: each member's `require`s and the `go.mod` of every dependency go loads (read from its replacement directory or the module cache when the root is on disk). go keeps no member's `go.mod` tidy in workspace mode, so a member's dependency can raise the module past every `require`. A pin, zip line or not, whose replaced version a member's or a dependency's `require` raises is inert, as is one of a module that is itself a `use` member (go builds it from that directory). Sum-file zip lines are no evidence of the selection (go only appends to `go.work.sum`), and a `/go.mod`-only pin is never the lockfile basis in a workspace (`integrity_required = true`). Any mode writes the replace of a module a workspace shares into the root `go.work` (source `go.work`); a `go.work` root without a `go.mod` also reads each in-root member's `go.mod` replaces (source `<member>/go.mod`). The sum files are the ones go reads: the root `go.sum`, or with a `go.work`, `go.work.sum` and each in-root `use` member's `go.sum` (the root's only when `.` is a member); under `GOWORK=off`, `go.work` and its replaces are ignored; a `GOWORK` naming any file other than the root's `go.work` (or a relative path, which go rejects) leaves the workspace unread: each Go ref is reported as `patched_ref_invalid` instead. A conflicting hash or a malformed `h1:` for the socket module+version, or a line of other than three tokens anywhere in a sum file, is no pin. A replace that `require` no longer selects (`require M v'`) is inert: diagnosed, no ref. |
+| golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | `replace M v => patch.socket.dev/gopatch/<uuid> <sver>` | `replace M v => ./.socket/vendor/golang/<uuid>/M@v` | the socket module's `/go.mod` go.sum line, required. The zip line (`h1:` of the module tree) is the locked integrity when present; `go mod tidy` prunes it when no package of the module is loaded and the build stays green, so the `/go.mod` line alone still attests from the lockfile, unless the main modules' `require`s or go.sum show the build selects another version (MVS keeps the `/go.mod` line of versions it only reads): then the replace is inert. With a `go.work` the main modules are its `use` members and the build selects by MVS over their module graph: each member's `require`s and the `go.mod` of every dependency go loads (read from its replacement directory or the module cache when the root is on disk). go keeps no member's `go.mod` tidy in workspace mode, so a member's dependency can raise the module past every `require`. A pin, zip line or not, whose replaced version a member's or a dependency's `require` raises is inert, as is one of a module that is itself a `use` member (go builds it from that directory). Sum-file zip lines are no evidence of the selection (go only appends to `go.work.sum`), and a `/go.mod`-only pin is never the lockfile basis in a workspace (`integrity_required = true`). Any mode writes the replace of a module a workspace shares into the root `go.work` (source `go.work`); a `go.work` root without a `go.mod` also reads each in-root member's `go.mod` replaces (source `<member>/go.mod`). The sum files are the ones go reads: the root `go.sum`, or with a `go.work`, `go.work.sum` and each in-root `use` member's `go.sum` (the root's only when `.` is a member); under `GOWORK=off`, `go.work` and its replaces are ignored; a `GOWORK` naming any file other than the root's `go.work` (or a relative path, which go rejects) leaves the workspace unread: each Go ref is reported as `patched_ref_invalid` instead, as it is when `GOFLAGS` sets a `-modfile` other than the root `go.mod`. A conflicting hash or a malformed `h1:` for the socket module+version, or a line of other than three tokens anywhere in a sum file, is no pin. A replace that `require` no longer selects (`require M v'`) is inert: diagnosed, no ref. |
 | pypi | `uv.lock` (confirmed by `pyproject.toml` `[tool.uv.sources]` when present), PEP 723 `<script>.py.lock`, `pylock.toml` / `pylock.<name>.toml`, `poetry.lock`, `pdm.lock`, `Pipfile.lock`, `requirements.txt` + its in-root `-r` includes, PEP 508 direct references in `pyproject.toml` / `hatch.toml` | Socket-host artifact url | `.socket/vendor/pypi/<uuid>/<wheel>` naming the entry's own dist | sha256, required |
 | gem | `Gemfile.lock` and `gems.locked` (the `Gemfile` / `gems.rb` only to cross-check a merged multi-remote `GEM` section) | a `GEM` section whose remote ends `patch-registry/gem/<token>/<uuid>` | `PATH` remote `.socket/vendor/gem/<uuid>/<name>-<ver>` | `CHECKSUMS` sha256, required only when the lock has a `CHECKSUMS` section (bundler ≥ 2.6) |
 | composer | `composer.lock` (`packages` + `packages-dev`) | `dist.url` on the patch host | `dist: {type: "path", url: ".socket/vendor/composer/<uuid>/…", reference: "<uuid>"}` | `dist.shasum`, required |
@@ -659,7 +659,13 @@ are patched by `socket-patch apply` like every other ecosystem:
   --check` is a read-only audit of the committed redirect.
   The `go.work` in effect is resolved as go resolves it: `GOWORK` naming an absolute file, none under
   `GOWORK=off`, else (unset, empty or `auto`) the nearest `go.work` at or above the project; a relative
-  `GOWORK` is invalid to go, so nothing is written or attested. When a `go.work` is in effect, `apply`,
+  `GOWORK` is invalid to go, so nothing is written or attested. A `-modfile` in `GOFLAGS` (#1799)
+  that names any file other than the project's `go.mod` (a relative one is taken from the project
+  directory) makes go build from that file and ignore `go.mod`'s replaces, and in workspace mode go
+  refuses `-modfile` outright: `apply`, `vendor` and `scan --mode hosted` write nothing
+  (`redirect_golang_workspace_conflict` in hosted mode), a replace already written fails
+  `apply --check` / `vendor --check` with `go_workspace_replace_ineffective`, and `vex` omits the patch
+  with `go_workspace_override` (discovered Go refs become `patched_ref_invalid`). When a `go.work` is in effect, `apply`,
   `vendor` and `scan --mode hosted` refuse a `replace` that it would override (a go.work `replace` of
   that version of the module, or a version-less one; one of another version leaves the member's in
   force), ignore (the project isn't a `use` member) or reject (another member replaces the same
@@ -1406,7 +1412,7 @@ Env-only knobs used for hosted upstream restoration and JVM metadata verificatio
 | Env var | Default | Notes |
 |---|---|---|
 | `SOCKET_NPM_REGISTRY` | `https://registry.npmjs.org` | Base for npm version documents (`<base>/<name>/<version>`, a scoped name's `/` as `%2f`; `dist.tarball` / `integrity` / `shasum`) the npm-family and vlt upstream restore reads, unless the project names another registry (yarn berry `npmRegistryServer`, pnpm's lock-sibling `.npmrc` `registry` / `@scope:registry` or pnpm-workspace.yaml `registry` / `registries` as the pnpm major reads them, vlt's node registry), whose document is read first. |
-| `SOCKET_GOPROXY` | `https://proxy.golang.org` | Go module proxy used for upstream restoration, honoring `GOPROXY`, `GONOPROXY` and `GOPRIVATE`. Like every Go setting socket-patch reads (`GOMODCACHE`, `GOPATH`, `GOWORK`, `GOSUMDB`, `GONOSUMDB`), each resolves as go resolves it: the environment, then the `go env -w` file (`$GOENV`, default `os.UserConfigDir()/go/env`; `GOENV=off` disables it), then go's default. |
+| `SOCKET_GOPROXY` | `https://proxy.golang.org` | Go module proxy used for upstream restoration, honoring `GOPROXY`, `GONOPROXY` and `GOPRIVATE`. Like every Go setting socket-patch reads (`GOMODCACHE`, `GOPATH`, `GOWORK`, `GOFLAGS`, `GOSUMDB`, `GONOSUMDB`), each resolves as go resolves it: the environment, then the `go env -w` file (`$GOENV`, default `os.UserConfigDir()/go/env`; `GOENV=off` disables it), then go's default. |
 | `SOCKET_MAVEN_REGISTRY` | `https://repo1.maven.org/maven2` | maven2 base for the fallback upstream-pom download. |
 | `SOCKET_CRATES_INDEX` | `https://index.crates.io` | v5.0 upstream restore: the crates.io sparse index whose `checksum` a restored `Cargo.lock` entry gets back. |
 | `SOCKET_GOSUMDB_URL` | `https://sum.golang.org` | v5.0 upstream restore: the checksum database the restored go.sum lines are checked against. Without it, `GOSUMDB=off` or a module matching `GONOSUMDB` (default `GOPRIVATE`) skips the database and the hashes come from the module proxy's bytes alone (`SOCKET_GOPROXY` above). |
diff --git a/crates/socket-patch-cli/src/commands/vex.rs b/crates/socket-patch-cli/src/commands/vex.rs
index 21f688fe7..1c17af0ae 100644
--- a/crates/socket-patch-cli/src/commands/vex.rs
+++ b/crates/socket-patch-cli/src/commands/vex.rs
@@ -959,6 +959,7 @@ async fn generate_vex(
                 module,
                 version,
                 conflict,
+                ..
             } = &issue
             else {
                 continue;
diff --git a/crates/socket-patch-cli/tests/e2e_golang_build.rs b/crates/socket-patch-cli/tests/e2e_golang_build.rs
index 6c913c704..0553769e2 100644
--- a/crates/socket-patch-cli/tests/e2e_golang_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_golang_build.rs
@@ -1337,3 +1337,123 @@ fn global_apply_flags_tools_built_from_the_unpatched_module() {
 
     chmod_writable(&modcache);
 }
+
+// ── GOFLAGS=-modfile (#1799) ─────────────────────────────────────────
+
+/// `socket-patch <args>` in `dir` with `GOFLAGS` (and `GOENV`) set.
+fn run_goflags(
+    dir: &Path,
+    args: &[&str],
+    modcache: &Path,
+    goflags: &str,
+    goenv: &str,
+) -> (i32, String, String) {
+    let mut full = args.to_vec();
+    full.extend(["--cwd", dir.to_str().unwrap()]);
+    common::run_with_env(
+        dir,
+        &full,
+        &[
+            ("GOMODCACHE", modcache.to_str().unwrap()),
+            ("GOFLAGS", goflags),
+            ("GOENV", goenv),
+        ],
+    )
+}
+
+/// #1799: with `-modfile` in `GOFLAGS` go builds from another go.mod, so a
+/// replace in go.mod never reaches the build. apply must refuse instead of
+/// reporting the patch applied; one written before `-modfile` was set fails
+/// `apply --check` and is left out of VEX, whether `-modfile` comes from
+/// the environment or the `go env -w` file.
+#[test]
+fn goflags_modfile_keeps_the_go_mod_replace_from_the_build() {
+    if !golang_e2e_matrix::toolchain_ready("e2e_golang_build(goflags-modfile)") {
+        return;
+    }
+    let tmp = tempfile::tempdir().unwrap();
+    let (consumer, modcache, proxy_url) = stage(tmp.path());
+    let mc = modcache.to_str().unwrap();
+    let env = go_env(mc, &proxy_url);
+    assert!(go(&consumer, &["mod", "tidy"], &env).status.success());
+    std::fs::copy(consumer.join("go.mod"), consumer.join("go.alt.mod")).unwrap();
+    std::fs::copy(consumer.join("go.sum"), consumer.join("go.alt.sum")).unwrap();
+    let alt_env: Vec<(&str, &str)> = env
+        .iter()
+        .map(|&(k, v)| match k {
+            "GOFLAGS" => (k, "-mod=mod -modfile=go.alt.mod"),
+            _ => (k, v),
+        })
+        .collect();
+    assert!(go_out(&consumer, &alt_env).contains("OUT: PRISTINE"));
+    write_patch(&consumer);
+    let modfile = "-modfile=go.alt.mod";
+    let no_goenv = "off";
+
+    // The dry run predicts the refusal; the real run writes nothing.
+    for dry in [true, false] {
+        let mut args = vec!["apply", "--offline", "--ecosystems", "golang", "--json"];
+        if dry {
+            args.push("--dry-run");
+        }
+        let (code, so, se) = run_goflags(&consumer, &args, &modcache, modfile, no_goenv);
+        assert_ne!(code, 0, "apply (dry run {dry}) must refuse:\n{so}\n{se}");
+        assert!(so.contains("-modfile=go.alt.mod"), "{so}");
+        assert!(replace_lines(&consumer.join("go.mod")).is_empty());
+        assert!(
+            !consumer.join(".socket/go-patches").exists(),
+            "a refused apply leaves no copy behind"
+        );
+    }
+    assert!(go_out(&consumer, &alt_env).contains("OUT: PRISTINE"));
+
+    // Applied without -modfile: the replace patches the default build...
+    let (code, so, se) = run_goflags(
+        &consumer,
+        &["apply", "--offline", "--ecosystems", "golang", "--json"],
+        &modcache,
+        "",
+        no_goenv,
+    );
+    assert_eq!(code, 0, "apply without -modfile:\n{so}\n{se}");
+    assert!(go_out(&consumer, &env).contains("OUT: PATCHED"));
+    // ...but not the -modfile one, which neither --check nor vex may pass.
+    assert!(go_out(&consumer, &alt_env).contains("OUT: PRISTINE"));
+    let goenv_file = tmp.path().join("goenv");
+    std::fs::write(&goenv_file, format!("GOFLAGS={modfile}\n")).unwrap();
+    for (goflags, goenv) in [(modfile, no_goenv), ("", goenv_file.to_str().unwrap())] {
+        let (code, so, se) = run_goflags(
+            &consumer,
+            &["apply", "--check", "--ecosystems", "golang"],
+            &modcache,
+            goflags,
+            goenv,
+        );
+        assert_eq!(code, 1, "apply --check must flag the replace:\n{so}\n{se}");
+        assert!(se.contains("-modfile=go.alt.mod"), "{se}");
+
+        let r = VexRun {
+            offline: true,
+            product: Some("pkg:golang/example.com/consumer@v0.0.1".into()),
+            ..VexRun::default()
+        }
+        .env("GOMODCACHE", &modcache)
+        .env("GOFLAGS", goflags)
+        .env("GOENV", goenv);
+        let out = run_vex(&vex_e2e_common::binary(), &consumer, &r);
+        assert_absent(out.doc.as_ref(), UPURL);
+        vex_e2e_common::assert_not_attested(&out.envelope, UPURL, "go_workspace_override");
+    }
+
+    // -modfile naming the project's own go.mod is go's default.
+    let (code, so, se) = run_goflags(
+        &consumer,
+        &["apply", "--check", "--ecosystems", "golang"],
+        &modcache,
+        "-modfile=go.mod",
+        no_goenv,
+    );
+    assert_eq!(code, 0, "-modfile=go.mod is in sync:\n{so}\n{se}");
+
+    chmod_writable(tmp.path());
+}
diff --git a/crates/socket-patch-core/src/hosted/engine.rs b/crates/socket-patch-core/src/hosted/engine.rs
index 6a17717f5..f214e686d 100644
--- a/crates/socket-patch-core/src/hosted/engine.rs
+++ b/crates/socket-patch-core/src/hosted/engine.rs
@@ -487,15 +487,15 @@ async fn read_advisory(
 /// The Go workspace in effect for the project, handed to the golang
 /// rewriter under [`crate::patch::redirect::GO_WORKSPACE_KEY`]. On disk it is
 /// the one go resolves (`GOWORK`, else a go.work at or above the root, with
-/// members anywhere); in memory a root `go.work` and its in-root members.
-/// A root go.work and go.work.sum are candidate files the rewriter writes.
+/// members anywhere, plus a `-modfile` that GOFLAGS sets); in memory a root
+/// `go.work` and its in-root members. A root go.work and go.work.sum are candidate files the rewriter writes.
 async fn read_go_workspace(
     view: &ProjectView<'_>,
     unreadable: &BTreeSet<String>,
     out: &mut CandidateFiles,
 ) {
     use crate::vendor::go_workspace::{self, GoWorkspace, Loaded, Member};
-    let (root, loaded) = match view {
+    let (root, loaded, modfile) = match view {
         ProjectView::Memory(_) => 'memory: {
             let Some(work) = read_advisory(view, unreadable, "go.work").await else {
                 return;
@@ -507,6 +507,7 @@ async fn read_go_workspace(
                 break 'memory (
                     std::path::PathBuf::new(),
                     Loaded::Invalid(format!("go.work: {problem}, so go refuses to build")),
+                    None,
                 );
             }
             let mut members = Vec::new();
@@ -539,7 +540,7 @@ async fn read_go_workspace(
                 members,
                 graph: None,
             };
-            (std::path::PathBuf::new(), Loaded::Workspace(ws))
+            (std::path::PathBuf::new(), Loaded::Workspace(ws), None)
         }
         ProjectView::Disk(_) | ProjectView::Snapshot(_) => {
             let Some(root) = view.disk_root_reading(std::iter::empty::<&std::path::Path>()) else {
@@ -560,13 +561,19 @@ async fn read_go_workspace(
                 }
             }
             view.disk_root_reading(&touched);
-            (root, loaded)
+            // `-modfile` in GOFLAGS sends the build to another go.mod (#1799).
+            let modfile = go_workspace::modfile_setting(&root);
+            (root, loaded, modfile)
         }
     };
-    if loaded == Loaded::None {
+    if loaded == Loaded::None && modfile.is_none() {
         return;
     }
-    let hosted = crate::patch::redirect::HostedGoWorkspace { root, loaded };
+    let hosted = crate::patch::redirect::HostedGoWorkspace {
+        root,
+        loaded,
+        modfile,
+    };
     if let Ok(json) = serde_json::to_string(&hosted) {
         out.files
             .insert(crate::patch::redirect::GO_WORKSPACE_KEY.to_string(), json);
diff --git a/crates/socket-patch-core/src/patch/redirect/mod.rs b/crates/socket-patch-core/src/patch/redirect/mod.rs
index 6e854c3a7..43277e15c 100644
--- a/crates/socket-patch-core/src/patch/redirect/mod.rs
+++ b/crates/socket-patch-core/src/patch/redirect/mod.rs
@@ -9311,6 +9311,10 @@ pub const GO_WORKSPACE_KEY: &str = "<socket-patch:go-workspace>";
 pub struct HostedGoWorkspace {
     pub root: std::path::PathBuf,
     pub loaded: crate::vendor::go_workspace::Loaded,
+    /// `GOFLAGS`' `-modfile` keeping the replace from the build, as
+    /// [`crate::vendor::go_workspace::modfile_setting`] words it (#1799).
+    #[serde(default)]
+    pub modfile: Option<String>,
 }
 
 fn rewrite_golang(
@@ -9450,10 +9454,14 @@ fn rewrite_golang(
                 rhs_version: Some(rhs_version.clone()),
                 owner: Some(go_mod_edit::ReplaceOwner::Hosted),
             };
-            if let Some(conflict) =
+            let modfile = ws
+                .modfile
+                .clone()
+                .map(|setting| crate::vendor::go_workspace::WorkspaceConflict::ModFile { setting });
+            if let Some(conflict) = modfile.or_else(|| {
                 ws.loaded
                     .host_conflict(host, &ws.root, &fname, &dep.version, &ours)
-            {
+            }) {
                 result.warnings.push(RewriteWarning {
                     code: "redirect_golang_workspace_conflict".into(),
                     detail: format!(
@@ -23578,6 +23586,7 @@ packages:
                         .collect(),
                 ),
             }),
+            modfile: None,
         };
         (
             GO_WORKSPACE_KEY.to_string(),
@@ -23799,6 +23808,7 @@ packages:
                 ],
                 graph: None,
             }),
+            modfile: None,
         };
         again.insert(
             GO_WORKSPACE_KEY.to_string(),
@@ -23815,6 +23825,34 @@ packages:
         );
     }
 
+    /// #1799: `-modfile` in GOFLAGS sends the build to another go.mod, so
+    /// the hosted pin is refused, nothing written or confirmed.
+    #[test]
+    fn golang_goflags_modfile_refuses_the_pin() {
+        use crate::vendor::go_workspace::Loaded;
+        let ovr = golang_override();
+        let mut files = golang_files();
+        let hosted = HostedGoWorkspace {
+            root: std::path::PathBuf::new(),
+            loaded: Loaded::None,
+            modfile: Some("GOFLAGS sets -modfile=go.alt.mod, so go builds from go.alt.mod".into()),
+        };
+        files.insert(
+            GO_WORKSPACE_KEY.to_string(),
+            serde_json::to_string(&hosted).unwrap(),
+        );
+        let out = rewrite_registry_redirect(&files, std::slice::from_ref(&ovr));
+        assert!(out.files.is_empty(), "{:?}", out.files);
+        assert!(out.confirmed_golang_uuids.is_empty());
+        assert_eq!(out.warnings.len(), 1, "{:?}", out.warnings);
+        assert_eq!(out.warnings[0].code, "redirect_golang_workspace_conflict");
+        assert!(
+            out.warnings[0].detail.contains("-modfile=go.alt.mod"),
+            "{:?}",
+            out.warnings
+        );
+    }
+
     /// A go.work root whose member replaces every version of the module
     /// elsewhere: the go.work pin would silently override it, so nothing
     /// is written.
diff --git a/crates/socket-patch-core/src/utils/go_env.rs b/crates/socket-patch-core/src/utils/go_env.rs
index 73955a4b1..7e3832475 100644
--- a/crates/socket-patch-core/src/utils/go_env.rs
+++ b/crates/socket-patch-core/src/utils/go_env.rs
@@ -37,6 +37,74 @@ pub(crate) fn go_env_with(key: &str, env: impl Fn(&str) -> Option<String>) -> Op
     lookup_in_env_file(&text, key).filter(|v| !v.is_empty())
 }
 
+/// What a `GOFLAGS` setting makes go do about `-modfile`.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum GoflagsModfile {
+    /// go reads the module's own go.mod: no `-modfile`, or an empty one.
+    Default,
+    /// go reads this file instead (the last `-modfile` wins).
+    File(String),
+    /// go refuses the setting, so no go command runs: why.
+    Refused(String),
+}
+
+/// `-modfile` in a `GOFLAGS` setting, read as go reads it
+/// (`cmd/go/internal/base.InitGOFLAGS`): fields split by
+/// [`split_goflags`], each `-flag` or `--flag` (anything else makes go
+/// fail: "non-flag"), the last `-modfile` winning, and a bare `-modfile`
+/// refused for want of a value.
+pub(crate) fn goflags_modfile(goflags: &str) -> GoflagsModfile {
+    let Some(fields) = split_goflags(goflags) else {
+        return GoflagsModfile::Refused("GOFLAGS has an unterminated quote".into());
+    };
+    // `Some(None)`: a bare `-modfile`.
+    let mut modfile: Option<Option<&str>> = None;
+    for field in &fields {
+        let name = field
+            .strip_prefix("--")
+            .or_else(|| field.strip_prefix('-'))
+            .filter(|n| !n.is_empty() && !n.starts_with(['-', '=']));
+        let Some(name) = name else {
+            return GoflagsModfile::Refused(format!("GOFLAGS has the non-flag \"{field}\""));
+        };
+        match name.split_once('=') {
+            Some(("modfile", value)) => modfile = Some(Some(value)),
+            None if name == "modfile" => modfile = Some(None),
+            _ => {}
+        }
+    }
+    match modfile {
+        None | Some(Some("")) => GoflagsModfile::Default,
+        Some(None) => GoflagsModfile::Refused("GOFLAGS sets -modfile without a value".into()),
+        Some(Some(value)) => GoflagsModfile::File(value.to_string()),
+    }
+}
+
+/// Go's `cmd/internal/quoted.Split`: whitespace-separated fields, a field
+/// that opens with `'` or `"` running to the same quote (the next field
+/// starts right after it). `None` when a quote is unterminated.
+fn split_goflags(s: &str) -> Option<Vec<String>> {
+    let is_space = |c: char| matches!(c, ' ' | '\t' | '\n' | '\r');
+    let mut fields = Vec::new();
+    let mut rest = s.trim_start_matches(is_space);
+    while !rest.is_empty() {
+        let quote = rest.chars().next().filter(|c| *c == '\'' || *c == '"');
+        let (field, after) = match quote {
+            Some(q) => {
+                let end = rest[1..].find(q)? + 1;
+                (&rest[1..end], &rest[end + 1..])
+            }
+            None => {
+                let end = rest.find(is_space).unwrap_or(rest.len());
+                (&rest[..end], &rest[end..])
+            }
+        };
+        fields.push(field.to_string());
+        rest = after.trim_start_matches(is_space);
+    }
+    Some(fields)
+}
+
 /// The Go environment file go would read, or `None` when `GOENV=off` or no
 /// user config directory resolves.
 fn go_env_file(env: &impl Fn(&str) -> Option<String>) -> Option<PathBuf> {
@@ -116,6 +184,42 @@ mod tests {
         assert_eq!(lookup_in_env_file(text, "GONOPROXY"), None);
     }
 
+    /// `-modfile` read from GOFLAGS as go reads it (#1799).
+    #[test]
+    fn goflags_modfile_reads_the_last_modfile() {
+        use GoflagsModfile::*;
+        let file = |f: &str| File(f.to_string());
+        let refused = |s: &str| matches!(goflags_modfile(s), Refused(_));
+        assert_eq!(goflags_modfile(""), Default);
+        assert_eq!(goflags_modfile("-mod=mod -tags=a=b"), Default);
+        assert_eq!(goflags_modfile("-modfiles=a.mod"), Default);
+        assert_eq!(goflags_modfile("-modfile=alt.mod"), file("alt.mod"));
+        assert_eq!(
+            goflags_modfile("  --modfile=alt.mod\t-mod=mod "),
+            file("alt.mod")
+        );
+        assert_eq!(
+            goflags_modfile("-modfile=a.mod -modfile=b.mod"),
+            file("b.mod")
+        );
+        assert_eq!(goflags_modfile("-modfile=a.mod -modfile="), Default);
+        assert_eq!(goflags_modfile("'-modfile=a b.mod'"), file("a b.mod"));
+        assert_eq!(goflags_modfile("\"-mod=mod\"-modfile=a.mod"), file("a.mod"));
+        // go rejects these settings outright.
+        for s in [
+            "-modfile",
+            "-modfile=a.mod -modfile",
+            "'-modfile=a.mod",
+            "modfile=a.mod",
+            "---modfile=a.mod",
+            "-mod=mod -",
+            "--",
+            "-=x",
+        ] {
+            assert!(refused(s), "{s}");
+        }
+    }
+
     /// env (non-empty) → `$GOENV` file → `None`; an empty env var falls
     /// through to the file and `GOENV=off` disables it.
     #[test]
diff --git a/crates/socket-patch-core/src/vendor/go_consumer_sync.rs b/crates/socket-patch-core/src/vendor/go_consumer_sync.rs
index 0347f1175..10fd9e2f0 100644
--- a/crates/socket-patch-core/src/vendor/go_consumer_sync.rs
+++ b/crates/socket-patch-core/src/vendor/go_consumer_sync.rs
@@ -86,6 +86,8 @@ pub enum GoSyncIssue {
     Workspace {
         module: String,
         version: String,
+        /// The file holding the replace: `go.mod`, or the root `go.work`.
+        file: &'static str,
         conflict: WorkspaceConflict,
     },
 }
@@ -157,10 +159,11 @@ impl std::fmt::Display for GoSyncIssue {
             GoSyncIssue::Workspace {
                 module,
                 version,
+                file,
                 conflict,
             } => write!(
                 f,
-                "the go.mod `replace` for {module} {version} {}",
+                "the {file} `replace` for {module} {version} {}",
                 conflict.consequence(module, version)
             ),
         }
@@ -188,6 +191,7 @@ pub async fn audit(
         found.extend(audit_module(&root, pristine_go_mods).await);
     }
     found.extend(audit_work(project_root, pristine_go_mods).await);
+    found.extend(work_modfile_issues(project_root).await);
     for issue in found {
         if !issues.contains(&issue) {
             issues.push(issue);
@@ -196,6 +200,33 @@ pub async fn audit(
     issues
 }
 
+/// A [`GoSyncIssue::Workspace`] for each Socket replace in the `go.work`
+/// at the project root while `-modfile` in GOFLAGS makes go refuse the
+/// workspace (#1799). The go.mod replaces are [`workspace_issues`]'.
+async fn work_modfile_issues(project_root: &Path) -> Vec<GoSyncIssue> {
+    let Some(conflict) = go_workspace::modfile_conflict(project_root) else {
+        return Vec::new();
+    };
+    let Some(work) = go_workspace::root_work_file(project_root) else {
+        return Vec::new();
+    };
+    let Ok(text) = read_regular_to_string(&work).await else {
+        return Vec::new();
+    };
+    go_mod_edit::parse_replace_entries(&text)
+        .into_iter()
+        .filter(ReplaceEntry::socket_owned)
+        .filter_map(|e| {
+            Some(GoSyncIssue::Workspace {
+                version: e.version?,
+                module: e.module,
+                file: "go.work",
+                conflict: conflict.clone(),
+            })
+        })
+        .collect()
+}
+
 /// The Socket replaces in the `go.work` at the project root: `go work
 /// vendor` must record them in the workspace's `vendor/modules.txt`, and
 /// the workspace's members must list what their patched copies require.
@@ -335,6 +366,7 @@ pub async fn workspace_audit(project_root: &Path) -> Vec<GoSyncIssue> {
             );
         }
     }
+    issues.extend(work_modfile_issues(project_root).await);
     issues
 }
 
@@ -410,7 +442,9 @@ pub async fn replace_refusal(
             ));
         }
     }
-    let conflict = ws.host_conflict(host, project_root, module, version, &ours)?;
+    // `-modfile` in GOFLAGS sends the build to another go.mod (#1799).
+    let conflict = go_workspace::modfile_conflict(project_root)
+        .or_else(|| ws.host_conflict(host, project_root, module, version, &ours))?;
     Some(format!(
         "refusing to write `replace {module} {version} => {target}` to {}: it {}",
         host.file_name(),
@@ -425,15 +459,20 @@ async fn workspace_issues(project_root: &Path, replaces: &[ReplaceEntry]) -> Vec
         return Vec::new();
     }
     let ws = go_workspace::load(project_root).await;
+    let modfile = go_workspace::modfile_conflict(project_root);
     let mut issues = Vec::new();
     for entry in replaces.iter().filter(|e| e.socket_owned()) {
         let Some(version) = entry.version.as_deref() else {
             continue;
         };
-        if let Some(conflict) = ws.conflict(project_root, &entry.module, version, entry) {
+        let conflict = modfile
+            .clone()
+            .or_else(|| ws.conflict(project_root, &entry.module, version, entry));
+        if let Some(conflict) = conflict {
             issues.push(GoSyncIssue::Workspace {
                 module: entry.module.clone(),
                 version: version.to_string(),
+                file: "go.mod",
                 conflict,
             });
         }
diff --git a/crates/socket-patch-core/src/vendor/go_workspace.rs b/crates/socket-patch-core/src/vendor/go_workspace.rs
index 50e3baf86..7257b1c4e 100644
--- a/crates/socket-patch-core/src/vendor/go_workspace.rs
+++ b/crates/socket-patch-core/src/vendor/go_workspace.rs
@@ -86,6 +86,60 @@ pub fn resolve_with(project_root: &Path, gowork: Option<&str>) -> GoWork {
     }
 }
 
+/// Why the `GOFLAGS` in effect (the environment, then the `go env -w`
+/// file) keeps a Socket replace in `project_root`'s go.mod or go.work from
+/// reaching the build, as a [`WorkspaceConflict::ModFile`]; `None` when go
+/// reads that go.mod (#1799).
+pub fn modfile_conflict(project_root: &Path) -> Option<WorkspaceConflict> {
+    modfile_setting(project_root).map(|setting| WorkspaceConflict::ModFile { setting })
+}
+
+/// [`modfile_conflict`]'s `setting`.
+pub fn modfile_setting(project_root: &Path) -> Option<String> {
+    use crate::utils::go_env::go_env;
+    modfile_setting_with(
+        project_root,
+        go_env("GOFLAGS").as_deref(),
+        go_env("GOWORK").as_deref(),
+    )
+}
+
+/// [`modfile_setting`] for explicit `GOFLAGS` and `GOWORK` values.
+///
+/// A relative `-modfile` is resolved against `project_root`, where go is
+/// taken to run. Any `-modfile` other than that go.mod makes go read
+/// another file (and its `.sum`); with a `go.work` in effect go refuses
+/// `-modfile` outright ("-modfile cannot be used in workspace mode"), and a
+/// `GOFLAGS` go cannot parse stops every go command.
+pub fn modfile_setting_with(
+    project_root: &Path,
+    goflags: Option<&str>,
+    gowork: Option<&str>,
+) -> Option<String> {
+    use crate::utils::go_env::{goflags_modfile, GoflagsModfile};
+    let modfile = match goflags_modfile(goflags?) {
+        GoflagsModfile::Default => return None,
+        GoflagsModfile::Refused(why) => return Some(format!("{why}, so go refuses to run")),
+        GoflagsModfile::File(file) => file,
+    };
+    // An invalid GOWORK is its own refusal; only a go.work go loads is
+    // workspace mode.
+    if matches!(resolve_with(project_root, gowork), GoWork::File(_)) {
+        return Some(format!(
+            "GOFLAGS sets -modfile={modfile}, which go refuses in workspace mode \
+             (\"-modfile cannot be used in workspace mode\"), so go refuses to build"
+        ));
+    }
+    let own = same_dir_key(&project_root.join("go.mod"));
+    if same_dir_key(&project_root.join(&modfile)) == own {
+        return None;
+    }
+    Some(format!(
+        "GOFLAGS sets -modfile={modfile}, so go builds from {modfile} instead of go.mod \
+         and ignores go.mod's replaces"
+    ))
+}
+
 /// The workspace go builds a project in, read once.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct GoWorkspace {
@@ -299,6 +353,10 @@ pub enum WorkspaceConflict {
     NoModule { work_file: String, members: String },
     /// go refuses to load the workspace at all.
     Invalid { reason: String },
+    /// `GOFLAGS` sets `-modfile`, so go builds from another go.mod (or
+    /// refuses to build): `setting` says which, as [`modfile_setting`]
+    /// words it.
+    ModFile { setting: String },
 }
 
 impl WorkspaceConflict {
@@ -372,6 +430,10 @@ impl WorkspaceConflict {
             WorkspaceConflict::Invalid { reason } => {
                 format!("cannot take effect: {reason}; fix the workspace setting and re-run")
             }
+            WorkspaceConflict::ModFile { setting } => format!(
+                "has no effect on the build of {module}: {setting}; fix GOFLAGS (`go env \
+                 -u GOFLAGS` if `go env -w` set it) and re-run"
+            ),
         }
     }
 }
@@ -1154,6 +1216,48 @@ mod tests {
         assert_eq!(resolve_with(&project, None), GoWork::None);
     }
 
+    /// #1799: `-modfile` keeps a go.mod replace from the build unless it
+    /// names the project's own go.mod; in workspace mode go refuses it.
+    #[test]
+    fn goflags_modfile_conflicts_unless_it_names_the_own_go_mod() {
+        let tmp = tempfile::tempdir().unwrap();
+        let project = tmp.path().join("app");
+        write(tmp.path(), "app/go.mod", "module example.com/app\n");
+        let conflict = |goflags: &str, gowork: Option<&str>| {
+            modfile_setting_with(&project, Some(goflags), gowork)
+        };
+        assert_eq!(modfile_setting_with(&project, None, None), None);
+        let own = project.join("go.mod").to_string_lossy().into_owned();
+        for same in [
+            "".to_string(),
+            "-mod=mod".to_string(),
+            "-modfile=".to_string(),
+            "-modfile=go.mod".to_string(),
+            "-modfile=./go.mod".to_string(),
+            format!("-modfile={own}"),
+        ] {
+            assert_eq!(conflict(&same, None), None, "{same}");
+        }
+        let why = conflict("-modfile=go.alt.mod", None).unwrap();
+        assert!(why.contains("go builds from go.alt.mod"), "{why}");
+        let why = conflict("-modfile", None).unwrap();
+        assert!(why.contains("go refuses to run"), "{why}");
+        // A relative GOWORK is go's own refusal, not workspace mode.
+        let why = conflict("-modfile=go.alt.mod", Some("rel/go.work")).unwrap();
+        assert!(why.contains("go builds from go.alt.mod"), "{why}");
+        assert_eq!(conflict("-modfile=go.mod", Some("rel/go.work")), None);
+
+        // Workspace mode: go refuses any -modfile, its own go.mod included.
+        write(tmp.path(), "go.work", "go 1.22\n\nuse ./app\n");
+        let why = conflict("-modfile=go.mod", None).unwrap();
+        assert!(why.contains("workspace mode"), "{why}");
+        assert_eq!(conflict("-modfile=go.mod", Some("off")), None);
+        assert_eq!(conflict("-modfile=", None), None);
+
+        let consequence = WorkspaceConflict::ModFile { setting: why }.consequence("m", "v1");
+        assert!(consequence.contains("go env -u GOFLAGS"), "{consequence}");
+    }
+
     /// MVS runs over every member's requirements: another member raising
     /// the module makes a replace pinned to the lower version inert.
     /// The workspace with its module graph read from the module cache
diff --git a/crates/socket-patch-core/src/vex/discover/golang.rs b/crates/socket-patch-core/src/vex/discover/golang.rs
index 2d763b8e9..8ffbf2126 100644
--- a/crates/socket-patch-core/src/vex/discover/golang.rs
+++ b/crates/socket-patch-core/src/vex/discover/golang.rs
@@ -123,7 +123,7 @@ use super::{
     DIAG_LOCKFILE_UNPARSEABLE, DIAG_REF_INVALID, DIAG_REF_UNATTRIBUTABLE,
 };
 use crate::patch::path_safety::is_safe_single_segment;
-use crate::utils::go_env::go_env;
+use crate::utils::go_env::{go_env, goflags_modfile, GoflagsModfile};
 use crate::vendor::go_build_list::{self, Selection};
 use crate::vendor::go_mod_edit::{
     self, block_structure_error, hosted_module_uuid, normalize_for_read, ReplaceEntry,
@@ -139,7 +139,52 @@ const GO_WORK: &str = "go.work";
 const GO_WORK_SUM: &str = "go.work.sum";
 
 pub(crate) async fn extract(ctx: &DiscoverCtx<'_>, out: &mut Discovery) {
-    extract_gowork(ctx, out, go_env("GOWORK").as_deref()).await;
+    extract_goenv(
+        ctx,
+        out,
+        go_env("GOWORK").as_deref(),
+        go_env("GOFLAGS").as_deref(),
+    )
+    .await;
+}
+
+/// [`extract`] for explicit `GOWORK` and `GOFLAGS` values.
+async fn extract_goenv(
+    ctx: &DiscoverCtx<'_>,
+    out: &mut Discovery,
+    gowork: Option<&str>,
+    goflags: Option<&str>,
+) {
+    // `-modfile` sends the build to another go.mod, whose replaces (if
+    // any) discovery doesn't read: nothing here is what go builds (#1799).
+    // Only a project on disk is built under this process's GOFLAGS (the
+    // hosted engine reads it for the same views). The probe reads exactly
+    // the go.work candidates, go.mod and the named file, and declares them
+    // so a tracked snapshot keeps recording.
+    let setting = match goflags.map(goflags_modfile) {
+        None | Some(GoflagsModfile::Default) => None,
+        Some(flag) => ctx
+            .disk_root_reading(std::iter::empty::<&Path>())
+            .and_then(|root| {
+                let mut touched: Vec<std::path::PathBuf> =
+                    root.ancestors().map(|dir| dir.join(GO_WORK)).collect();
+                touched.extend(
+                    gowork
+                        .filter(|g| Path::new(g).is_absolute())
+                        .map(Into::into),
+                );
+                touched.push(GO_MOD.into());
+                if let GoflagsModfile::File(file) = flag {
+                    touched.push(file.into());
+                }
+                ctx.disk_root_reading(&touched)?;
+                go_workspace::modfile_setting_with(root, goflags, gowork)
+            }),
+    };
+    if let Some(setting) = setting {
+        return withhold(ctx, out, &setting).await;
+    }
+    extract_gowork(ctx, out, gowork).await;
 }
 
 /// [`extract`] for an explicit `GOWORK` value.
@@ -1855,6 +1900,81 @@ mod tests {
         assert!(out.refs.is_empty() && out.diagnostics.is_empty());
     }
 
+    /// #1799: `-modfile` in GOFLAGS naming another go.mod sends the build
+    /// there, so the root go.mod's replace is diagnosed, never a ref; one
+    /// naming the root's own go.mod (or an empty one) is go's default.
+    #[tokio::test]
+    async fn goflags_modfile_naming_another_go_mod_attests_nothing() {
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        let p = Project::new();
+        p.write(
+            "go.mod",
+            format!(
+                "module example.com/app\n\ngo 1.21\n\nrequire {MODULE} {VERSION}\n\n\
+                 replace {MODULE} {VERSION} => {m} {sver}\n"
+            ),
+        )
+        .write("go.sum", go_sum_for(UUID_A, sver));
+        let extract = |goflags: &'static str| {
+            let p = &p;
+            async move {
+                let ctx = p.ctx();
+                let mut out = Discovery::default();
+                super::extract_goenv(&ctx, &mut out, None, Some(goflags)).await;
+                out
+            }
+        };
+        let own = p.root().join("go.mod").to_string_lossy().into_owned();
+        let own: &'static str = Box::leak(format!("-mod=mod --modfile={own}").into_boxed_str());
+        for goflags in ["", "-mod=mod", "-modfile=", "-modfile=go.mod", own] {
+            let out = extract(goflags).await;
+            assert_eq!(out.refs.len(), 1, "{goflags}: {:?}", out.diagnostics);
+        }
+        for goflags in [
+            "-modfile=go.alt.mod",
+            "-modfile=go.mod \"-modfile=alt dir/go.mod\"",
+            "-modfile",
+        ] {
+            let out = extract(goflags).await;
+            assert!(out.refs.is_empty(), "{goflags}");
+            assert_eq!(out.diagnostics.len(), 1, "{goflags}: {:?}", out.diagnostics);
+            assert_eq!(out.diagnostics[0].code, DIAG_REF_INVALID);
+            assert!(
+                out.diagnostics[0].detail.contains("-modfile"),
+                "{goflags}: {:?}",
+                out.diagnostics
+            );
+        }
+    }
+
+    /// The `-modfile` probe declares what it reads: a tracked snapshot
+    /// keeps recording whether or not it withholds (#1799).
+    #[tokio::test]
+    async fn goflags_modfile_probe_keeps_a_snapshot_recording() {
+        use crate::vendor::lock_inventory::{DiskSnapshot, ProjectView};
+        let m = gopatch(UUID_A);
+        let sver = "v1.4.2-socketpatch.1";
+        let p = Project::new();
+        p.write(
+            "go.mod",
+            format!(
+                "module example.com/app\n\ngo 1.21\n\nrequire {MODULE} {VERSION}\n\n\
+                 replace {MODULE} {VERSION} => {m} {sver}\n"
+            ),
+        )
+        .write("go.sum", go_sum_for(UUID_A, sver));
+        for (goflags, refs) in [("-modfile=go.mod", 1), ("-modfile=go.alt.mod", 0)] {
+            let snap = DiskSnapshot::tracked(p.root());
+            snap.begin_recording();
+            let ctx = DiscoverCtx::over(ProjectView::Snapshot(&snap), &[]);
+            let mut out = Discovery::default();
+            super::extract_goenv(&ctx, &mut out, None, Some(goflags)).await;
+            assert_eq!(out.refs.len(), refs, "{goflags}: {:?}", out.diagnostics);
+            assert!(snap.end_recording().is_some(), "{goflags}");
+        }
+    }
+
     /// In a workspace the socket module's zip line does not prove the
     /// replaced version is built: another member requiring a higher one
     /// makes the pin inert, as for a `/go.mod`-only pin.
diff --git a/docs/ecosystems.md b/docs/ecosystems.md
index feb2028eb..843935448 100644
--- a/docs/ecosystems.md
+++ b/docs/ecosystems.md
@@ -1507,6 +1507,16 @@ it and attests nothing. `vex` reads only the project's own `go.work`: when
 `GOWORK` names any other file, it attests none of the project's Go patches
 and reports each as `patched_ref_invalid`.
 
+`GOFLAGS` is read the same way (the environment, then the `go env -w`
+file). A `-modfile` in it that names any file other than the project's
+`go.mod` makes go build from that file and its `.sum` and ignore `go.mod`'s
+replaces, and in workspace mode go refuses `-modfile` outright. socket-patch
+then writes no replace, `apply --check` and `vendor --check` fail on one
+already written, and `vex` attests none of the project's Go patches. A
+relative `-modfile` is taken from the project directory, where go is
+assumed to run. Unset it (`go env -u GOFLAGS` if `go env -w` set it) and
+re-run.
+
 In workspace mode go reads `replace` directives from `go.work` and from the
 `go.mod` of each module it `use`s. Run in the directory holding `go.work`,
 `apply`, `vendor` and `scan --mode hosted` write the `replace` of a module