diff --git a/pkgs/by-name/gi/git-credential-gopass/package.nix b/pkgs/by-name/gi/git-credential-gopass/package.nix
new file mode 100644
index 000000000000..c5b2ad2852db
--- /dev/null
+++ b/pkgs/by-name/gi/git-credential-gopass/package.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  makeWrapper,
+  writableTmpDirAsHomeHook,
+  gopass,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "git-credential-gopass";
+  version = "1.16.1";
+
+  src = fetchFromGitHub {
+    owner = "gopasspw";
+    repo = "git-credential-gopass";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-IEur3Sw2zRYJxlwAhgpb2OnBt+FcC+OdeT7M/LzJwoY=";
+  };
+
+  vendorHash = "sha256-mtJIm7dH3jP7p0R0KxN0Yf7mi9rkJ73u8biy2Ygvk3k=";
+
+  subPackages = [ "." ];
+
+  nativeBuildInputs = [
+    makeWrapper
+    writableTmpDirAsHomeHook
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${finalAttrs.version}"
+    "-X main.commit=${finalAttrs.src.rev}"
+  ];
+
+  postFixup = ''
+    wrapProgram $out/bin/git-credential-gopass \
+      --prefix PATH : "${gopass.wrapperPath}"
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    gopass
+  ];
+  versionCheckKeepEnvironment = [ "HOME" ];
+  preVersionCheck = ''
+    gopass setup --name "user" --email "user@localhost"
+  '';
+
+  meta = {
+    description = "Manage git credentials using gopass";
+    homepage = "https://github.com/gopasspw/git-credential-gopass";
+    changelog = "https://github.com/gopasspw/git-credential-gopass/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ benneti ];
+    mainProgram = "git-credential-gopass";
+  };
+})
diff --git a/pkgs/tools/security/gopass/hibp.nix b/pkgs/by-name/go/gopass-hibp/package.nix
similarity index 50%
rename from pkgs/tools/security/gopass/hibp.nix
rename to pkgs/by-name/go/gopass-hibp/package.nix
index 6d19f7972909..7b7b54b201c6 100644
--- a/pkgs/tools/security/gopass/hibp.nix
+++ b/pkgs/by-name/go/gopass-hibp/package.nix
@@ -1,23 +1,25 @@
 {
   lib,
-  makeWrapper,
   buildGoModule,
   fetchFromGitHub,
+  makeWrapper,
   gopass,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "gopass-hibp";
-  version = "1.16.0";
+  version = "1.16.1";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "gopass-hibp";
-    rev = "v${version}";
-    hash = "sha256-S4X2DWaktAfoqjLz7yAF5I0v+01bQbQLSgEb/105iCk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-BlZxXN14bOO7LMdjS/ooqVKmRZQTpNYlYp4A4rTew4Q=";
   };
 
-  vendorHash = "sha256-8LC271XuMeDGWZnysMMumoqLwklQpDKr8VF/zyCvwNA=";
+  vendorHash = "sha256-LUmxstDE0paYaNS2Em1Xc6pJmHHWk/IJEjTZXq5qWW8=";
 
   subPackages = [ "." ];
 
@@ -26,13 +28,24 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X main.version=${version}"
-    "-X main.commit=${src.rev}"
+    "-X main.version=${finalAttrs.version}"
+    "-X main.commit=${finalAttrs.src.rev}"
   ];
 
   postFixup = ''
     wrapProgram $out/bin/gopass-hibp \
-      --prefix PATH : "${lib.makeBinPath [ gopass ]}"
+      --prefix PATH : "${gopass.wrapperPath}"
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+    gopass
+  ];
+  versionCheckKeepEnvironment = [ "HOME" ];
+  preVersionCheck = ''
+    gopass setup --name "user" --email "user@localhost"
   '';
 
   __darwinAllowLocalNetworking = true;
@@ -40,9 +53,9 @@ buildGoModule rec {
   meta = {
     description = "Gopass haveibeenpwnd.com integration";
     homepage = "https://github.com/gopasspw/gopass-hibp";
-    changelog = "https://github.com/gopasspw/gopass-hibp/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/gopasspw/gopass-hibp/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sikmir ];
     mainProgram = "gopass-hibp";
   };
-}
+})
diff --git a/pkgs/by-name/go/gopass-jsonapi/package.nix b/pkgs/by-name/go/gopass-jsonapi/package.nix
index de9d0d47098f..e8f18eb1f1f0 100644
--- a/pkgs/by-name/go/gopass-jsonapi/package.nix
+++ b/pkgs/by-name/go/gopass-jsonapi/package.nix
@@ -1,17 +1,17 @@
 {
   lib,
-  stdenv,
   makeWrapper,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
+  writableTmpDirAsHomeHook,
   jq,
   gnupg,
   gopass,
+  versionCheckHook,
 }:
 
 let
-
   # https://github.com/gopasspw/gopass-jsonapi/blob/v1.16.0/internal/jsonapi/manifest/manifest_path_linux.go
   manifestPaths = {
     firefox = "$out/lib/mozilla/native-messaging-hosts/com.justwatch.gopass.json";
@@ -22,38 +22,37 @@ let
     iridium = "$out/etc/iridium-browser/native-messaging-hosts/com.justwatch.gopass.json";
     slimjet = "$out/etc/opt/slimjet/native-messaging-hosts/com.justwatch.gopass.json";
   };
-
 in
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "gopass-jsonapi";
-  version = "1.16.0";
+  version = "1.16.1";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "gopass-jsonapi";
-    rev = "v${version}";
-    hash = "sha256-LPGAK/vwcbsAvL3TXX78cPCbNbYXh2++Ta1D8RjbKK4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-JN/SC7lvPVTONNbOUmgu//xK/GaR5Tljxn99Zb1J/kQ=";
   };
 
-  vendorHash = "sha256-TTTjQRUYKqtyE/vFHol0ewbkh+2oGo9Pjr1qTmfXrq4=";
+  vendorHash = "sha256-Ki0gzhDkoUvgTCN4bYrqvN0u3AgdG22MWxcVHIE9lUQ=";
 
   subPackages = [ "." ];
 
   nativeBuildInputs = [
     installShellFiles
     makeWrapper
+    writableTmpDirAsHomeHook
   ];
 
   ldflags = [
     "-s"
     "-w"
-    "-X main.version=${version}"
-    "-X main.commit=${src.rev}"
+    "-X main.version=${finalAttrs.version}"
+    "-X main.commit=${finalAttrs.src.rev}"
   ];
 
   postInstall = ''
     # Generate native messaging manifests for Chrome and Firefox.
-    export HOME=$(mktemp -d)
     ${gnupg}/bin/gpg --batch --passphrase "" --quick-generate-key "user <user@localhost>"
     ${gopass}/bin/gopass setup --name "user" --email "user@localhost"
 
@@ -64,7 +63,7 @@ buildGoModule rec {
       in
       # The options after `--print=false` are of no effect, but if missing
       # `gopass-jsonapi configure` will ask for them. (`--libpath` and `--global`
-      # are overriden by `--manifest-path`. `--libpath` is only used to
+      # are overridden by `--manifest-path`. `--libpath` is only used to
       # compute Firefox's global manifest path. See
       # https://github.com/gopasspw/gopass-jsonapi/blob/v1.16.0/setup_others.go#L33-L46)
       #
@@ -96,10 +95,16 @@ buildGoModule rec {
       --prefix PATH : "${gopass.wrapperPath}"
   '';
 
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckKeepEnvironment = [ "HOME" ];
+
   meta = {
     description = "Enables communication with gopass via JSON messages";
     homepage = "https://github.com/gopasspw/gopass-jsonapi";
-    changelog = "https://github.com/gopasspw/gopass-jsonapi/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/gopasspw/gopass-jsonapi/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       maxhbr
@@ -107,4 +112,4 @@ buildGoModule rec {
     ];
     mainProgram = "gopass-jsonapi";
   };
-}
+})
diff --git a/pkgs/tools/security/gopass/summon.nix b/pkgs/by-name/go/gopass-summon-provider/package.nix
similarity index 50%
rename from pkgs/tools/security/gopass/summon.nix
rename to pkgs/by-name/go/gopass-summon-provider/package.nix
index 70390ec48e4e..599daa4b4bce 100644
--- a/pkgs/tools/security/gopass/summon.nix
+++ b/pkgs/by-name/go/gopass-summon-provider/package.nix
@@ -1,23 +1,25 @@
 {
   lib,
-  makeWrapper,
   buildGoModule,
   fetchFromGitHub,
+  makeWrapper,
   gopass,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "gopass-summon-provider";
-  version = "1.16.0";
+  version = "1.16.1";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "gopass-summon-provider";
-    rev = "v${version}";
-    hash = "sha256-ES+lU0iBwzkomWoVKQrKElOaH9XiumnzpBVRjWbI/cM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-j3N/snUCsw/NlMQO9CoVRf6JCG48DEHqrJnZ7wiVUPk=";
   };
 
-  vendorHash = "sha256-gE8x+81DFzw0TSkxwU5s+OQccSvfRVH6dV+sWhMdBxI=";
+  vendorHash = "sha256-FhS79dSY9FjlScoXd6EbYRRwEBObZLO9g/SXBEXQpjM=";
 
   subPackages = [ "." ];
 
@@ -26,21 +28,32 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X main.version=${version}"
-    "-X main.commit=${src.rev}"
+    "-X main.version=${finalAttrs.version}"
+    "-X main.commit=${finalAttrs.src.rev}"
   ];
 
   postFixup = ''
     wrapProgram $out/bin/gopass-summon-provider \
-      --prefix PATH : "${lib.makeBinPath [ gopass ]}"
+      --prefix PATH : "${gopass.wrapperPath}"
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+    gopass
+  ];
+  versionCheckKeepEnvironment = [ "HOME" ];
+  preVersionCheck = ''
+    gopass setup --name "user" --email "user@localhost"
   '';
 
   meta = {
     description = "Gopass Summon Provider";
     homepage = "https://github.com/gopasspw/gopass-summon-provider";
-    changelog = "https://github.com/gopasspw/gopass-summon-provider/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/gopasspw/gopass-summon-provider/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sikmir ];
     mainProgram = "gopass-summon-provider";
   };
-}
+})
diff --git a/pkgs/tools/security/gopass/default.nix b/pkgs/by-name/go/gopass/package.nix
similarity index 95%
rename from pkgs/tools/security/gopass/default.nix
rename to pkgs/by-name/go/gopass/package.nix
index 1e5cdadde472..7f9bbea39498 100644
--- a/pkgs/tools/security/gopass/default.nix
+++ b/pkgs/by-name/go/gopass/package.nix
@@ -28,7 +28,7 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "gopass";
-  version = "1.16.0";
+  version = "1.16.1";
 
   nativeBuildInputs = [
     installShellFiles
@@ -39,7 +39,7 @@ buildGoModule (finalAttrs: {
     owner = "gopasspw";
     repo = "gopass";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JBa/PhVj0cKr9Btz9KzhGgsL4APAfZ/ixHGHWzd2TfA=";
+    hash = "sha256-Yr66+LUEoONNkSQUQhIWtLvxN0a5YtRVbn/nJRLqn+E=";
   };
 
   vendorHash = "sha256-ebnnnAD7SQJrSVOPborHUWd8ThOstIgihEIUjrnCztQ=";
@@ -75,7 +75,6 @@ buildGoModule (finalAttrs: {
     versionCheckHook
     gitMinimal
   ];
-  versionCheckProgramArg = "--version";
 
   passthru = {
     inherit wrapperPath;
@@ -90,6 +89,7 @@ buildGoModule (finalAttrs: {
     maintainers = with lib.maintainers; [
       rvolosatovs
       sikmir
+      yzx9
     ];
     changelog = "https://github.com/gopasspw/gopass/blob/v${finalAttrs.version}/CHANGELOG.md";
 
diff --git a/pkgs/tools/security/gopass/git-credential.nix b/pkgs/tools/security/gopass/git-credential.nix
deleted file mode 100644
index 47664681bbc8..000000000000
--- a/pkgs/tools/security/gopass/git-credential.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-  lib,
-  makeWrapper,
-  buildGoModule,
-  fetchFromGitHub,
-  gopass,
-}:
-
-buildGoModule rec {
-  pname = "git-credential-gopass";
-  version = "1.16.0";
-
-  src = fetchFromGitHub {
-    owner = "gopasspw";
-    repo = "git-credential-gopass";
-    rev = "v${version}";
-    hash = "sha256-1045Ui8/WKNkAi6iSpJ1nsryA9J3U5KMAElYwN6Dho8=";
-  };
-
-  vendorHash = "sha256-JDrC0h4+ltdMHOR36BDkVpcFDDaHGv6IDnW0O4QvWVI=";
-
-  subPackages = [ "." ];
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  ldflags = [
-    "-s"
-    "-w"
-    "-X main.version=${version}"
-    "-X main.commit=${src.rev}"
-  ];
-
-  postFixup = ''
-    wrapProgram $out/bin/git-credential-gopass \
-      --prefix PATH : "${lib.makeBinPath [ gopass ]}"
-  '';
-
-  meta = {
-    description = "Manage git credentials using gopass";
-    homepage = "https://github.com/gopasspw/git-credential-gopass";
-    changelog = "https://github.com/gopasspw/git-credential-gopass/blob/v${version}/CHANGELOG.md";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ benneti ];
-    mainProgram = "git-credential-gopass";
-  };
-}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 71c663a2b846..877b8af45494 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1624,14 +1624,6 @@ with pkgs;
 
   passExtensions = recurseIntoAttrs pass.extensions;
 
-  gopass = callPackage ../tools/security/gopass { };
-
-  gopass-hibp = callPackage ../tools/security/gopass/hibp.nix { };
-
-  git-credential-gopass = callPackage ../tools/security/gopass/git-credential.nix { };
-
-  gopass-summon-provider = callPackage ../tools/security/gopass/summon.nix { };
-
   kerf = kerf_1; # kerf2 is WIP
   kerf_1 = callPackage ../development/interpreters/kerf {
     stdenv = clangStdenv;