diff --git a/.github/workflows/.windows.yml b/.github/workflows/.windows.yml
index d33152ce11..dddd588ade 100644
--- a/.github/workflows/.windows.yml
+++ b/.github/workflows/.windows.yml
@@ -439,7 +439,6 @@ jobs:
           .\hack\make.ps1 -TestIntegration
         env:
           DOCKER_HOST: npipe:////./pipe/docker_engine
-          GO111MODULE: "off"
           TEST_CLIENT_BINARY: ${{ env.BIN_OUT }}\docker
       -
         name: Test integration-cli
@@ -448,7 +447,6 @@ jobs:
           .\hack\make.ps1 -TestIntegrationCli
         env:
           DOCKER_HOST: npipe:////./pipe/docker_engine
-          GO111MODULE: "off"
           TEST_CLIENT_BINARY: ${{ env.BIN_OUT }}\docker
           INTEGRATION_TESTRUN: ${{ matrix.test }}
       -
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 3b7b43259b..b38982b2c2 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -46,15 +46,6 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 2
-      # CodeQL 2.16.4's auto-build added support for multi-module repositories,
-      # and is trying to be smart by searching for modules in every directory,
-      # including vendor directories. If no module is found, it's creating one
-      # which is ... not what we want, so let's give it a "go.mod".
-      # see: https://github.com/docker/cli/pull/4944#issuecomment-2002034698
-      - name: Create go.mod
-        run: |
-          ln -s vendor.mod go.mod
-          ln -s vendor.sum go.sum
       - name: Update Go
         uses: actions/setup-go@v5
         with:
diff --git a/Dockerfile b/Dockerfile
index 112127c30b..53d8cde86a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -64,7 +64,6 @@ COPY --from=xx / /
 RUN go telemetry off && [ "$(go telemetry)" = "off" ] || { echo "Failed to disable Go telemetry"; exit 1; }
 RUN echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache
 RUN apt-get update && apt-get install --no-install-recommends -y file
-ENV GO111MODULE=off
 ENV GOTOOLCHAIN=local
 
 FROM base AS criu
@@ -95,6 +94,7 @@ RUN git fetch -q --depth 1 origin "${GO_SWAGGER_COMMIT}" && git checkout -q FETC
 FROM base AS swagger
 WORKDIR /go/src/github.com/go-swagger/go-swagger
 ARG TARGETPLATFORM
+ENV GO111MODULE=off
 RUN --mount=from=swagger-src,src=/usr/src/swagger,rw \
     --mount=type=cache,target=/root/.cache/go-build,id=swagger-build-$TARGETPLATFORM \
     --mount=type=cache,target=/go/pkg/mod \
@@ -145,7 +145,7 @@ RUN --mount=from=delve-src,src=/usr/src/delve,rw \
     --mount=type=cache,target=/root/.cache/go-build,id=delve-build-$TARGETPLATFORM \
     --mount=type=cache,target=/go/pkg/mod <<EOT
   set -e
-  GO111MODULE=on xx-go build -o /build/dlv ./cmd/dlv
+  xx-go build -o /build/dlv ./cmd/dlv
   xx-verify /build/dlv
 EOT
 
@@ -157,7 +157,7 @@ FROM base AS gowinres
 ARG GOWINRES_VERSION=v0.3.1
 RUN --mount=type=cache,target=/root/.cache/go-build \
     --mount=type=cache,target=/go/pkg/mod \
-        GOBIN=/build/ GO111MODULE=on go install "github.com/tc-hib/go-winres@${GOWINRES_VERSION}" \
+        GOBIN=/build/ go install "github.com/tc-hib/go-winres@${GOWINRES_VERSION}" \
      && /build/go-winres --help
 
 # containerd
@@ -205,7 +205,7 @@ FROM base AS golangci_lint
 ARG GOLANGCI_LINT_VERSION=v2.1.5
 RUN --mount=type=cache,target=/root/.cache/go-build \
     --mount=type=cache,target=/go/pkg/mod \
-        GOBIN=/build/ GO111MODULE=on go install "github.com/golangci/golangci-lint/v2/cmd/golangci-lint@${GOLANGCI_LINT_VERSION}" \
+        GOBIN=/build/ go install "github.com/golangci/golangci-lint/v2/cmd/golangci-lint@${GOLANGCI_LINT_VERSION}" \
      && /build/golangci-lint --version
 
 FROM base AS gotestsum
@@ -213,20 +213,20 @@ FROM base AS gotestsum
 ARG GOTESTSUM_VERSION=v1.12.3
 RUN --mount=type=cache,target=/root/.cache/go-build \
     --mount=type=cache,target=/go/pkg/mod \
-        GOBIN=/build/ GO111MODULE=on go install "gotest.tools/gotestsum@${GOTESTSUM_VERSION}" \
+        GOBIN=/build/ go install "gotest.tools/gotestsum@${GOTESTSUM_VERSION}" \
      && /build/gotestsum --version
 
 FROM base AS shfmt
 ARG SHFMT_VERSION=v3.8.0
 RUN --mount=type=cache,target=/root/.cache/go-build \
     --mount=type=cache,target=/go/pkg/mod \
-        GOBIN=/build/ GO111MODULE=on go install "mvdan.cc/sh/v3/cmd/shfmt@${SHFMT_VERSION}" \
+        GOBIN=/build/ go install "mvdan.cc/sh/v3/cmd/shfmt@${SHFMT_VERSION}" \
      && /build/shfmt --version
 
 FROM base AS gopls
 RUN --mount=type=cache,target=/root/.cache/go-build \
     --mount=type=cache,target=/go/pkg/mod \
-        GOBIN=/build/ GO111MODULE=on go install "golang.org/x/tools/gopls@latest" \
+        GOBIN=/build/ go install "golang.org/x/tools/gopls@latest" \
      && /build/gopls version
 
 FROM base AS dockercli
@@ -342,7 +342,6 @@ RUN --mount=type=cache,sharing=locked,id=moby-rootlesskit-aptlib,target=/var/lib
             gcc \
             libc6-dev \
             pkg-config
-ENV GO111MODULE=on
 ARG DOCKER_STATIC
 RUN --mount=from=rootlesskit-src,src=/usr/src/rootlesskit,rw \
     --mount=type=cache,target=/go/pkg/mod \
@@ -543,7 +542,6 @@ COPY --link --from=dockercli-integration /build/ /usr/local/cli-integration
 FROM base AS build
 COPY --from=gowinres /build/ /usr/local/bin/
 WORKDIR /go/src/github.com/docker/docker
-ENV GO111MODULE=off
 ENV CGO_ENABLED=1
 RUN --mount=type=cache,sharing=locked,id=moby-build-aptlib,target=/var/lib/apt \
     --mount=type=cache,sharing=locked,id=moby-build-aptcache,target=/var/cache/apt \
diff --git a/Dockerfile.simple b/Dockerfile.simple
index 05e08a857f..fc785fa195 100644
--- a/Dockerfile.simple
+++ b/Dockerfile.simple
@@ -11,7 +11,6 @@ ARG BASE_DEBIAN_DISTRO="bookworm"
 ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}"
 
 FROM ${GOLANG_IMAGE}
-ENV GO111MODULE=off
 ENV GOTOOLCHAIN=local
 
 # Compile and runtime deps
diff --git a/Dockerfile.windows b/Dockerfile.windows
index 4e8184d7d2..9437b54617 100644
--- a/Dockerfile.windows
+++ b/Dockerfile.windows
@@ -178,7 +178,6 @@ ENV GO_VERSION=${GO_VERSION} `
     CONTAINERD_VERSION=${CONTAINERD_VERSION} `
     GIT_VERSION=2.11.1 `
     GOPATH=C:\gopath `
-    GO111MODULE=off `
     GOTOOLCHAIN=local `
     FROM_DOCKERFILE=1 `
     GOTESTSUM_VERSION=${GOTESTSUM_VERSION} `
@@ -278,13 +277,11 @@ RUN `
 
 RUN `
   Function Install-GoTestSum() { `
-    $Env:GO111MODULE = 'on'; `
     $tmpGobin = "${Env:GOBIN_TMP}"; `
     $Env:GOBIN = """${Env:GOPATH}`\bin"""; `
     Write-Host "INFO: Installing gotestsum version $Env:GOTESTSUM_VERSION in $Env:GOBIN"; `
     &go install "gotest.tools/gotestsum@${Env:GOTESTSUM_VERSION}"; `
     $Env:GOBIN = "${tmpGobin}"; `
-    $Env:GO111MODULE = 'off'; `
     if ($LASTEXITCODE -ne 0) {  `
       Throw '"gotestsum install failed..."'; `
     } `
@@ -294,13 +291,11 @@ RUN `
 
 RUN `
   Function Install-GoWinres() { `
-    $Env:GO111MODULE = 'on'; `
     $tmpGobin = "${Env:GOBIN_TMP}"; `
     $Env:GOBIN = """${Env:GOPATH}`\bin"""; `
     Write-Host "INFO: Installing go-winres version $Env:GOWINRES_VERSION in $Env:GOBIN"; `
     &go install "github.com/tc-hib/go-winres@${Env:GOWINRES_VERSION}"; `
     $Env:GOBIN = "${tmpGobin}"; `
-    $Env:GO111MODULE = 'off'; `
     if ($LASTEXITCODE -ne 0) {  `
       Throw '"go-winres install failed..."'; `
     } `
diff --git a/hack/buildkit-ref b/hack/buildkit-ref
index 71ece62c54..d889f753ea 100755
--- a/hack/buildkit-ref
+++ b/hack/buildkit-ref
@@ -8,8 +8,8 @@
 buildkit_pkg=github.com/moby/buildkit
 
 # get buildkit version from vendor.mod
-buildkit_ref=$(./hack/with-go-mod.sh go list -mod=mod -modfile=vendor.mod -u -m -f '{{if .Replace}}{{.Replace.Version}}{{else}}{{.Version}}{{end}}' "$buildkit_pkg")
-buildkit_repo=$(./hack/with-go-mod.sh go list -mod=mod -modfile=vendor.mod -u -m -f '{{if .Replace}}{{.Replace.Path}}{{else}}{{.Path}}{{end}}' "$buildkit_pkg")
+buildkit_ref=$(go list -mod=mod -u -m -f '{{if .Replace}}{{.Replace.Version}}{{else}}{{.Version}}{{end}}' "$buildkit_pkg")
+buildkit_repo=$(go list -mod=mod -u -m -f '{{if .Replace}}{{.Replace.Path}}{{else}}{{.Path}}{{end}}' "$buildkit_pkg")
 buildkit_repo=${buildkit_repo#github.com/}
 
 if [[ "${buildkit_ref}" == *-*-* ]]; then
diff --git a/hack/dockerfile/install/rootlesskit.installer b/hack/dockerfile/install/rootlesskit.installer
index e8bfc9c9cb..ad1269de6b 100755
--- a/hack/dockerfile/install/rootlesskit.installer
+++ b/hack/dockerfile/install/rootlesskit.installer
@@ -27,5 +27,5 @@ install_rootlesskit_dynamic() {
 
 _install_rootlesskit() (
 	echo "Install rootlesskit version ${ROOTLESSKIT_VERSION}"
-	GOBIN="${PREFIX}" GO111MODULE=on go install ${BUILD_MODE} -ldflags="$ROOTLESSKIT_LDFLAGS" "github.com/rootless-containers/rootlesskit/v2/cmd/rootlesskit@${ROOTLESSKIT_VERSION}"
+	GOBIN="${PREFIX}" go install ${BUILD_MODE} -ldflags="$ROOTLESSKIT_LDFLAGS" "github.com/rootless-containers/rootlesskit/v2/cmd/rootlesskit@${ROOTLESSKIT_VERSION}"
 )
diff --git a/hack/dockerfiles/generate-files.Dockerfile b/hack/dockerfiles/generate-files.Dockerfile
index f43776ca45..89c46ddb7e 100644
--- a/hack/dockerfiles/generate-files.Dockerfile
+++ b/hack/dockerfiles/generate-files.Dockerfile
@@ -35,12 +35,12 @@ FROM base AS tools
 RUN --mount=from=src,source=/out,target=.,rw \
     --mount=type=cache,target=/root/.cache/go-build <<EOT
   set -ex
-  ./hack/with-go-mod.sh go install -v -mod=vendor -modfile=vendor.mod \
+  go install -v \
     github.com/gogo/protobuf/protoc-gen-gogo \
     github.com/gogo/protobuf/protoc-gen-gogofaster \
     github.com/gogo/protobuf/protoc-gen-gogoslick \
     github.com/golang/protobuf/protoc-gen-go
-  ./hack/with-go-mod.sh go build -v -mod=vendor -modfile=vendor.mod \
+  go build -v \
     -o /usr/bin/pluginrpc-gen \
     ./pkg/plugins/pluginrpc-gen
 EOT
diff --git a/hack/dockerfiles/govulncheck.Dockerfile b/hack/dockerfiles/govulncheck.Dockerfile
index 1452f31458..237d5b1db9 100644
--- a/hack/dockerfiles/govulncheck.Dockerfile
+++ b/hack/dockerfiles/govulncheck.Dockerfile
@@ -17,8 +17,6 @@ ARG FORMAT
 RUN --mount=type=bind,target=.,rw <<EOT
   set -ex
   mkdir /out
-  ln -s vendor.mod go.mod
-  ln -s vendor.sum go.sum
   govulncheck -format ${FORMAT} ./... | tee /out/govulncheck.out
 EOT
 
diff --git a/hack/make/.binary b/hack/make/.binary
index 40c0704511..0d5c931c14 100644
--- a/hack/make/.binary
+++ b/hack/make/.binary
@@ -95,7 +95,7 @@ source "${MAKEDIR}/.go-autogen"
 	if [ -n "$DOCKER_DEBUG" ]; then
 		set -x
 	fi
-	./hack/with-go-mod.sh go build -mod=vendor -modfile=vendor.mod -o "$DEST/$BINARY_FULLNAME" "${BUILDFLAGS[@]}" -ldflags "$LDFLAGS $LDFLAGS_STATIC $DOCKER_LDFLAGS" -gcflags="${GCFLAGS}" "$GO_PACKAGE"
+	go build -o "$DEST/$BINARY_FULLNAME" "${BUILDFLAGS[@]}" -ldflags "$LDFLAGS $LDFLAGS_STATIC $DOCKER_LDFLAGS" -gcflags="${GCFLAGS}" "$GO_PACKAGE"
 
 	# Verify that the built binary contains windows resources
 	if [ "$(go env GOOS)" = "windows" ]; then
diff --git a/hack/make/.integration-test-helpers b/hack/make/.integration-test-helpers
index 449b21b6ad..8dc736e0bb 100644
--- a/hack/make/.integration-test-helpers
+++ b/hack/make/.integration-test-helpers
@@ -203,7 +203,6 @@ test_env() {
 			DOCKER_ROOTLESS="$DOCKER_ROOTLESS" \
 			DOCKER_FIREWALL_BACKEND="$DOCKER_FIREWALL_BACKEND" \
 			GITHUB_ACTIONS="$GITHUB_ACTIONS" \
-			GO111MODULE="$GO111MODULE" \
 			GOCACHE="$GOCACHE" \
 			GOPATH="$GOPATH" \
 			GOTRACEBACK=all \
diff --git a/hack/test/unit b/hack/test/unit
index 91dab88a87..43626f4c9a 100755
--- a/hack/test/unit
+++ b/hack/test/unit
@@ -42,7 +42,7 @@ fi
 
 if [ -n "${api_pkg_list}" ]; then
 	cd api
-	GO111MODULE=on gotestsum --format=standard-quiet --jsonfile=../bundles/go-test-report-api.json --junitfile=../bundles/junit-report-api.xml -- \
+	gotestsum --format=standard-quiet --jsonfile=../bundles/go-test-report-api.json --junitfile=../bundles/junit-report-api.xml -- \
 		"${BUILDFLAGS[@]}" \
 		-cover \
 		-coverprofile=../bundles/coverage-api.out \
@@ -54,7 +54,7 @@ fi
 
 if [ -n "${client_pkg_list}" ]; then
 	cd client
-	GO111MODULE=on gotestsum --format=standard-quiet --jsonfile=../bundles/go-test-report-client.json --junitfile=../bundles/junit-report-client.xml -- \
+	gotestsum --format=standard-quiet --jsonfile=../bundles/go-test-report-client.json --junitfile=../bundles/junit-report-client.xml -- \
 		"${BUILDFLAGS[@]}" \
 		-cover \
 		-coverprofile=../bundles/coverage-client.out \
diff --git a/hack/validate/no-module b/hack/validate/no-module
deleted file mode 100755
index 917cc3e756..0000000000
--- a/hack/validate/no-module
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-#
-# Check that no one is trying to commit a go.mod.
-
-SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ROOTDIR="$(cd "${SCRIPTDIR}/../.." && pwd)"
-
-if test -e "${ROOTDIR}/go.mod"; then
-	{
-		echo 'FAIL: go.mod found in repository root!'
-		echo
-		echo '      Moby is not a Go module; please delete go.mod and try again.'
-	} >&2
-	exit 1
-else
-	echo 'PASS: No go.mod found in repository root!'
-fi
diff --git a/hack/vendor.sh b/hack/vendor.sh
index 7272eee136..c6123eab5f 100755
--- a/hack/vendor.sh
+++ b/hack/vendor.sh
@@ -10,24 +10,24 @@ SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 tidy() (
 		set -x
-		"${SCRIPTDIR}"/with-go-mod.sh go mod tidy -modfile vendor.mod
+		go mod tidy
 )
 
 vendor() (
 		set -x
-		"${SCRIPTDIR}"/with-go-mod.sh go mod vendor -modfile vendor.mod
+		go mod vendor
 )
 
 replace() (
 	set -x
-	"${SCRIPTDIR}"/with-go-mod.sh go mod edit -modfile vendor.mod -replace=github.com/moby/moby/api=./api -replace=github.com/moby/moby/client=./client
-	"${SCRIPTDIR}"/with-go-mod.sh go mod edit -modfile client/go.mod -replace=github.com/moby/moby/api=../api
+	go mod edit -replace=github.com/moby/moby/api=./api -replace=github.com/moby/moby/client=./client
+	go mod edit -modfile client/go.mod -replace=github.com/moby/moby/api=../api
 )
 
 dropreplace() (
 	set -x
-	"${SCRIPTDIR}"/with-go-mod.sh go mod edit -modfile vendor.mod -dropreplace=github.com/moby/moby/api -dropreplace=github.com/moby/moby/client
-	"${SCRIPTDIR}"/with-go-mod.sh go mod edit -modfile client/go.mod -dropreplace=github.com/moby/moby/api
+	go mod edit -dropreplace=github.com/moby/moby/api -dropreplace=github.com/moby/moby/client
+	go mod edit -modfile client/go.mod -dropreplace=github.com/moby/moby/api
 )
 
 help() {
diff --git a/hack/with-go-mod.sh b/hack/with-go-mod.sh
deleted file mode 100755
index 845855ee9c..0000000000
--- a/hack/with-go-mod.sh
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/usr/bin/env bash
-#
-# This script is used to coerce certain commands which rely on the presence of
-# a go.mod into working with our repository. It works by creating a fake
-# go.mod, running a specified command (passed via arguments), and removing it
-# when the command is finished. This script should be dropped when this
-# repository is a proper Go module with a permanent go.mod.
-
-set -e
-
-SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ROOTDIR="$(cd "${SCRIPTDIR}/.." && pwd)"
-
-if test -e "${ROOTDIR}/go.mod"; then
-	{
-		scriptname=$(basename "$0")
-		cat >&2 <<- EOF
-			$scriptname: WARN: go.mod exists in the repository root!
-			$scriptname: WARN: Using your go.mod instead of our generated version -- this may misbehave!
-		EOF
-	} >&2
-else
-	set -x
-
-	tee "${ROOTDIR}/go.mod" >&2 <<- EOF
-		module github.com/docker/docker
-
-		go 1.23.0
-	EOF
-	trap 'rm -f "${ROOTDIR}/go.mod"' EXIT
-fi
-
-GO111MODULE=on GOTOOLCHAIN=local "$@"