diff --git a/pkgs/by-name/go/goose-cli/fetchers.nix b/pkgs/by-name/go/goose-cli/fetchers.nix
new file mode 100644
index 000000000000..5fa6745ed073
--- /dev/null
+++ b/pkgs/by-name/go/goose-cli/fetchers.nix
@@ -0,0 +1,21 @@
+# not a stable interface, do not reference outside the goose-cli package but make a
+# copy if you need
+{
+  lib,
+  stdenv,
+  fetchurl,
+}:
+
+{
+  fetchLibrustyV8 =
+    args:
+    fetchurl {
+      name = "librusty_v8-${args.version}";
+      url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${stdenv.hostPlatform.rust.rustcTarget}.a.gz";
+      sha256 = args.shas.${stdenv.hostPlatform.system};
+      meta = {
+        inherit (args) version;
+        sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+      };
+    };
+}
diff --git a/pkgs/by-name/go/goose-cli/librusty_v8.nix b/pkgs/by-name/go/goose-cli/librusty_v8.nix
new file mode 100644
index 000000000000..3ace8f706ca8
--- /dev/null
+++ b/pkgs/by-name/go/goose-cli/librusty_v8.nix
@@ -0,0 +1,12 @@
+# auto-generated file -- DO NOT EDIT!
+{ fetchLibrustyV8 }:
+
+fetchLibrustyV8 {
+  version = "145.0.0"; # From source's Cargo.lock
+  shas = {
+    x86_64-linux = "sha256-chV1PAx40UH3Ute5k3lLrgfhih39Rm3KqE+mTna6ysE=";
+    aarch64-linux = "sha256-4IivYskhUSsMLZY97+g23UtUYh4p5jk7CzhMbMyqXyY=";
+    x86_64-darwin = "sha256-1jUuC+z7saQfPYILNyRJanD4+zOOhXU2ac/LFoytwho=";
+    aarch64-darwin = "sha256-yHa1eydVCrfYGgrZANbzgmmf25p7ui1VMas2A7BhG6k=";
+  };
+}
diff --git a/pkgs/by-name/go/goose-cli/package.nix b/pkgs/by-name/go/goose-cli/package.nix
index acc6820fa763..d0ca81708564 100644
--- a/pkgs/by-name/go/goose-cli/package.nix
+++ b/pkgs/by-name/go/goose-cli/package.nix
@@ -1,17 +1,37 @@
 {
   lib,
   stdenv,
+  callPackage,
   fetchFromGitHub,
   fetchurl,
   rustPlatform,
+  cmake,
   dbus,
   libxcb,
   pkg-config,
   protobuf,
   openssl,
+  cacert,
   writableTmpDirAsHomeHook,
+  versionCheckHook,
   nix-update-script,
   llvmPackages,
+  makeWrapper,
+  librusty_v8 ? callPackage ./librusty_v8.nix {
+    inherit (callPackage ./fetchers.nix { }) fetchLibrustyV8;
+  },
+
+  # Extension(s) Dependencies
+  python3,
+  bash,
+  # X11
+  xdotool,
+  wmctrl,
+  xclip,
+  xwininfo,
+  # Wayland
+  wtype,
+  wl-clipboard,
 }:
 
 let
@@ -28,16 +48,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "goose-cli";
-  version = "1.23.2";
+  version = "1.28.0";
 
   src = fetchFromGitHub {
     owner = "block";
     repo = "goose";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Zwb3y9XhtmKxJG6XOIHl49YVZMBsYtOPePM7heJfEvE=";
+    hash = "sha256-/1TtsnNiLoTkvyeFR282qSpo+Jt3pvFxduJ7lyzsTXI=";
   };
 
-  cargoHash = "sha256-G6Jok2OfSlOVlkF62gxivrKM0VlGqWFNdR0pQh79A0Q=";
+  cargoHash = "sha256-bhnbSjGqyWbQd5PjZ116JH91vjVy6R/+iBlNKL6debg=";
 
   cargoBuildFlags = [
     "--bin"
@@ -47,8 +67,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   nativeBuildInputs = [
+    cmake
     pkg-config
     protobuf
+    rustPlatform.bindgenHook
+    makeWrapper
   ];
 
   buildInputs = [
@@ -57,7 +80,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [ libxcb ];
 
-  env.LIBCLANG_PATH = "${lib.getLib llvmPackages.libclang}/lib";
+  env = {
+    LIBCLANG_PATH = "${lib.getLib llvmPackages.libclang}/lib";
+    RUSTY_V8_ARCHIVE = librusty_v8;
+  };
 
   preBuild = ''
     mkdir -p tokenizer_files/Xenova--gpt-4o tokenizer_files/Xenova--claude-tokenizer
@@ -65,7 +91,32 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ln -s ${claude-tokenizer} tokenizer_files/Xenova--claude-tokenizer/tokenizer.json
   '';
 
-  nativeCheckInputs = [ writableTmpDirAsHomeHook ];
+  postFixup = ''
+    wrapProgram $out/bin/goose \
+      --prefix PATH : ${
+        lib.makeBinPath (
+          [
+            bash
+            python3
+          ]
+          ++ lib.optionals stdenv.hostPlatform.isLinux [
+            # X11
+            xdotool
+            wmctrl
+            xclip
+            xwininfo
+            # Wayland
+            wtype
+            wl-clipboard
+          ]
+        )
+      }
+  '';
+
+  nativeCheckInputs = [
+    writableTmpDirAsHomeHook
+    cacert
+  ];
 
   __darwinAllowLocalNetworking = true;
 
@@ -108,6 +159,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=context_mgmt::auto_compact::tests::test_auto_compact_respects_config"
     "--skip=scheduler::tests::test_scheduled_session_has_schedule_id"
   ]
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+    # Broken on aarch64-linux: request capture races across session_id_propagation_test cases
+    "--skip=test_session_id_matches_across_calls"
+    "--skip=test_session_id_propagation_to_llm"
+  ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     "--skip=logging::tests::test_log_file_name_no_session"
     "--skip=recipes::extract_from_cli::tests::test_extract_recipe_info_from_cli_basic"
@@ -117,6 +173,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=test_session_id_propagation_to_llm"
   ];
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
   passthru.updateScript = nix-update-script { };
 
   meta = {
@@ -128,6 +188,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
       cloudripper
       thardin
       brittonr
+      miniharinn
+      caniko
     ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };