diff --git a/go.mod b/go.mod
index 4fc36e4fab..f2260bbbea 100644
--- a/go.mod
+++ b/go.mod
@@ -141,4 +141,11 @@ require (
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )
 
+// Envoy is not used by hcsshim's packages; generation-tool dependencies
+// pull this version into the module graph.
+// This version was retagged and fails checksum verification with GOPROXY=direct.
+// Other versions remain available if Envoy packages are needed later.
+// See https://github.com/envoyproxy/go-control-plane/issues/1083.
+exclude github.com/envoyproxy/go-control-plane/envoy v1.32.3
+
 replace google.golang.org/genproto => google.golang.org/genproto v0.0.0-20250428153025-10db94c68c34
diff --git a/go.sum b/go.sum
index a2b6914244..86b0695885 100644
--- a/go.sum
+++ b/go.sum
@@ -516,7 +516,6 @@ github.com/envoyproxy/go-control-plane v0.13.0/go.mod h1:GRaKG3dwvFoTg4nj7aXdZnv
 github.com/envoyproxy/go-control-plane v0.13.1/go.mod h1:X45hY0mufo6Fd0KW3rqsGvQMw58jvjymeCzBU3mWyHw=
 github.com/envoyproxy/go-control-plane v0.13.4/go.mod h1:kDfuBlDVsSj2MjrLEtRWtHlsWIFcGyB2RMO44Dc5GZA=
 github.com/envoyproxy/go-control-plane/envoy v1.32.2/go.mod h1:eR2SOX2IedqlPvmiKjUH7Wu//S602JKI7HPC/L3SRq8=
-github.com/envoyproxy/go-control-plane/envoy v1.32.3/go.mod h1:F6hWupPfh75TBXGKA++MCT/CZHFq5r9/uwt/kQYkZfE=
 github.com/envoyproxy/go-control-plane/envoy v1.32.4/go.mod h1:Gzjc5k8JcJswLjAx1Zm+wSYE20UrLtt7JZMWiWQXQEw=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=