diff --git a/common/build-style/go.sh b/common/build-style/go.sh
index 33a5dcf3ee8240..6ac4a0eb35e1c2 100644
--- a/common/build-style/go.sh
+++ b/common/build-style/go.sh
@@ -5,7 +5,7 @@
 do_configure() {
 	# $go_import_path must be set, or we can't link $PWD into $GOSRCPATH
 	# nor build from modules
-	if [ -z "$go_import_path" ]; then
+	if [ -z "${go_import_path}" ]; then
 		msg_error "\"\$go_import_path\" not set on $pkgname template.\n"
 	fi
 
@@ -23,13 +23,26 @@ do_configure() {
 
 do_build() {
 	# remove -s and -w from go_ldflags, we should let xbps-src strip binaries itself
-	for wd in $go_ldflags; do
-		if [ "$wd" == "-s" ] || [ "$wd" == "-w" ]; then
-			msg_error "$pkgname: remove -s and -w from go_ldflags\n"
+	for wd in ${go_ldflags}; do
+		if [ "${wd}" == "-s" ] || [ "$wd" == "-w" ]; then
+			msg_error "${pkgname}: remove -s and -w from go_ldflags\n"
 		fi
 	done
 
 	: ${go_package:=$go_import_path}
+	local buildmode
+	if [ -z "${nopie}" ]; then
+		buildmode=-buildmode=pie
+
+		# The linker checks the host sysroot, breaking static PIE musl cross builds
+		if [ -n "${CROSS_BUILD}" ] && [ "${XBPS_TARGET_LIBC}" = "musl" ]; then
+			case "${XBPS_TARGET_MACHINE}" in
+				aarch64*)
+					go_ldflags+=" -I /lib/ld-musl-aarch64.so.1"
+					;;
+			esac
+		fi
+	fi
 	# Build using Go modules if there's a go.mod file
 	if [ "${go_mod_mode}" != "off" ] && [ -f go.mod ]; then
 
@@ -38,7 +51,7 @@ do_build() {
 		fi
 
 		# Check if go_import_path matches module
-		if [ "module $go_import_path" != "$(grep '^module' go.mod | head -n1)" ]; then
+		if [ "module ${go_import_path}" != "$(grep '^module' go.mod | head -n1)" ]; then
 			msg_error "\"\$go_import_path\" doesn't match the one defined in go.mod!\n"
 		fi
 
@@ -50,20 +63,20 @@ do_build() {
 			# default behavior.
 			go_mod_mode=
 		fi
-		go install -p "$XBPS_MAKEJOBS" -mod="${go_mod_mode}" -modcacherw -v -tags "${go_build_tags}" -ldflags "${go_ldflags}" ${go_package}
+		go install -p "${XBPS_MAKEJOBS}" -mod="${go_mod_mode}" ${buildmode} -modcacherw -v -tags "${go_build_tags}" -ldflags "${go_ldflags}" ${go_package}
 		if [[ -n "${_go_mod_path}" ]]; then
 			popd
 		fi
 	else
 		# Otherwise, build using GOPATH
-		go install -p "$XBPS_MAKEJOBS" -v -tags "${go_build_tags}" -ldflags "${go_ldflags}" ${go_package}
+		go install -p "${XBPS_MAKEJOBS}" ${buildmode} -v -tags "${go_build_tags}" -ldflags "${go_ldflags}" ${go_package}
 	fi
 }
 
 do_check() {
 	: ${make_check_target:=./...}
 
-	${make_check_pre} go test -p "$XBPS_MAKEJOBS" -tags "${go_build_tags}" -ldflags "${go_ldflags}" ${make_check_args} ${make_check_target}
+	${make_check_pre} go test -p "${XBPS_MAKEJOBS}" -tags "${go_build_tags}" -ldflags "${go_ldflags}" ${make_check_args} ${make_check_target}
 }
 
 do_install() {
diff --git a/common/environment/build-style/go.sh b/common/environment/build-style/go.sh
index 223bba83ff11b4..92a049411e0fbe 100644
--- a/common/environment/build-style/go.sh
+++ b/common/environment/build-style/go.sh
@@ -4,7 +4,6 @@ if [ -z "$hostmakedepends" -o "${hostmakedepends##*gcc-go-tools*}" ]; then
 		archs="aarch64* armv[567]* i686* x86_64* ppc64le* riscv64*"
 	fi
 	hostmakedepends+=" go"
-	nopie=yes
 else
 	# gccgo compiler
 	if [ -z "$archs" ]; then
diff --git a/srcpkgs/age/template b/srcpkgs/age/template
index ab2c6e4ee0cc4c..7cd49a4a3d1b49 100644
--- a/srcpkgs/age/template
+++ b/srcpkgs/age/template
@@ -1,7 +1,7 @@
 # Template file for 'age'
 pkgname=age
 version=1.3.1
-revision=2
+revision=3
 build_style=go
 go_import_path="filippo.io/age"
 go_package="${go_import_path}/cmd/..."
@@ -19,4 +19,9 @@ post_install() {
 	vman doc/age-inspect.1
 	vman doc/age-keygen.1
 	vman doc/age-plugin-batchpass.1
+
+	# remove, for test only
+	for _f in age age-keygen age-inspect age-plugin-batchpass; do
+		readelf -l ${DESTDIR}/usr/bin/$_f | grep interpreter
+	done
 }
diff --git a/srcpkgs/cni-plugins/template b/srcpkgs/cni-plugins/template
index 1227dacf55aa0d..7733c0c2407952 100644
--- a/srcpkgs/cni-plugins/template
+++ b/srcpkgs/cni-plugins/template
@@ -11,6 +11,7 @@ homepage="https://github.com/containernetworking/plugins"
 changelog="https://github.com/containernetworking/plugins/releases"
 distfiles="https://github.com/containernetworking/plugins/archive/refs/tags/v${version}.tar.gz"
 checksum=95b639f8ccbb714da98e331ef8813f790d447fce5417f2f8a575f3c62bfb1474
+nopie=unverified
 
 do_build() {
 	./build_linux.sh \
diff --git a/srcpkgs/coyim/template b/srcpkgs/coyim/template
index 03d6d4f05cc905..6053f2a60082e4 100644
--- a/srcpkgs/coyim/template
+++ b/srcpkgs/coyim/template
@@ -12,6 +12,7 @@ license="GPL-3.0-only"
 homepage="https://coy.im"
 distfiles="https://github.com/coyim/coyim/archive/v${version}.tar.gz"
 checksum=f2bf1e73562fbcc3a0b264a30f92dfe427dffe2046e9f44459087ecac5890098
+nopie=unverified
 
 case "$XBPS_TARGET_MACHINE" in
 	x86_64*) ;;
diff --git a/srcpkgs/gofumpt/template b/srcpkgs/gofumpt/template
index 12dce0ec5bde73..e2f96727350f26 100644
--- a/srcpkgs/gofumpt/template
+++ b/srcpkgs/gofumpt/template
@@ -10,7 +10,7 @@ license="BSD-3-Clause"
 homepage="https://github.com/mvdan/gofumpt"
 distfiles="https://github.com/mvdan/gofumpt/archive/refs/tags/v${version}.tar.gz"
 checksum=acff9518cf4ad3550ca910b9254fc8a706494d6a105fe2e92948fedc52a42a5b
-
+nopie=unverified
 export CGO_ENABLED=0
 
 post_install() {
diff --git a/srcpkgs/grafana/template b/srcpkgs/grafana/template
index f44ea57bbe2e75..a556d733ffe948 100644
--- a/srcpkgs/grafana/template
+++ b/srcpkgs/grafana/template
@@ -29,6 +29,7 @@ make_dirs="/var/log/grafana 0755 _grafana _grafana
 conf_files="/etc/grafana/grafana.ini"
 
 go_ldflags="-X main.version=${version}"
+nopie=unverified
 
 post_extract() {
 	# remove prebuilt binaries
diff --git a/srcpkgs/kubernetes/template b/srcpkgs/kubernetes/template
index 91c744f8cb2d0f..5df80a65f3439b 100644
--- a/srcpkgs/kubernetes/template
+++ b/srcpkgs/kubernetes/template
@@ -17,6 +17,7 @@ nocross=yes
 system_accounts="kube"
 make_dirs="/var/lib/kubelet 0755 kube kube"
 conf_files="/etc/kubernetes/*"
+nopie=unverified
 
 do_build() {
 	make
diff --git a/srcpkgs/kubo/template b/srcpkgs/kubo/template
index b4b7f390041da8..3fb04b2a1f40b0 100644
--- a/srcpkgs/kubo/template
+++ b/srcpkgs/kubo/template
@@ -17,6 +17,7 @@ distfiles="https://github.com/ipfs/kubo/archive/v${version}.tar.gz"
 checksum=eb46fd70743049384a1b3ea8b07fa9c80db10811bc0bc64f0ba7e52d6c9d60bf
 export GOFLAGS="-mod=readonly -trimpath"
 make_check=no # some tests fail
+nopie=unverified
 
 system_accounts="_ipfs"
 make_dirs="/var/lib/ipfs 0700 _ipfs _ipfs"
diff --git a/srcpkgs/moby/template b/srcpkgs/moby/template
index 25b8ba782cc6e5..75e6751482c30f 100644
--- a/srcpkgs/moby/template
+++ b/srcpkgs/moby/template
@@ -17,6 +17,7 @@ distfiles="https://github.com/moby/moby/archive/v${version}.tar.gz"
 checksum=0e450c03c536a1304ba8fd26ca4c4ff96fac62182fd042fec90ffdf4a0969d40
 system_groups="docker"
 make_check=no # no other tests are available
+nopie=unverified
 
 do_build() {
 	export AUTO_GOPATH=1
diff --git a/srcpkgs/nncp/template b/srcpkgs/nncp/template
index 788d9c4a0d4bb2..ea537719a7d74d 100644
--- a/srcpkgs/nncp/template
+++ b/srcpkgs/nncp/template
@@ -10,7 +10,8 @@ license="GPL-3.0-only"
 homepage="http://www.nncpgo.org/"
 distfiles="http://www.nncpgo.org/download/${pkgname}-${version}.tar.xz"
 checksum=8ce3680e98005198d8975e031760b3a9b33be6d2d61844c799f778ca233d05f4
-make_check=no
+make_check=no # cannot find packages
+nopie=unverified
 
 do_build() {
 	./build
diff --git a/srcpkgs/rclone/template b/srcpkgs/rclone/template
index 3cba10cf96934b..fe06082ffa2ffa 100644
--- a/srcpkgs/rclone/template
+++ b/srcpkgs/rclone/template
@@ -17,6 +17,7 @@ changelog="https://raw.githubusercontent.com/rclone/rclone/master/docs/content/c
 distfiles="https://downloads.rclone.org/v${version}/rclone-v${version}.tar.gz"
 checksum=227b84024e7e72056f716ee520c4db8b88ec5f80dc83f0899b431b2ce2b25f9b
 make_check_pre="env RCLONE_CONFIG=/notfound CI=1"
+nopie=unverified
 
 pre_build() {
 	if [ "$CROSS_BUILD" ] && [ "$XBPS_TARGET_LIBC" = musl ]; then