diff --git a/pkgs/by-name/go/golink/darwin-sandbox-fix.patch b/pkgs/by-name/go/golink/darwin-sandbox-fix.patch
new file mode 100644
index 000000000000..b390d492467c
--- /dev/null
+++ b/pkgs/by-name/go/golink/darwin-sandbox-fix.patch
@@ -0,0 +1,20 @@
+--- vendor/modernc.org/libc/honnef.co/go/netdb/netdb.go
++++ vendor/modernc.org/libc/honnef.co/go/netdb/netdb.go
+@@ -696,7 +696,7 @@ func init() {
+ 	// Load protocols
+ 	data, err := ioutil.ReadFile("/etc/protocols")
+ 	if err != nil {
+-		if !os.IsNotExist(err) {
++		if !os.IsNotExist(err) && !os.IsPermission(err) {
+ 			panic(err)
+ 		}
+ 
+@@ -732,7 +732,7 @@ func init() {
+ 	// Load services
+ 	data, err = ioutil.ReadFile("/etc/services")
+ 	if err != nil {
+-		if !os.IsNotExist(err) {
++		if !os.IsNotExist(err) && !os.IsPermission(err) {
+ 			panic(err)
+ 		}
+ 
diff --git a/pkgs/by-name/go/golink/package.nix b/pkgs/by-name/go/golink/package.nix
index 5c10bbdcfebe..0eef3fea4199 100644
--- a/pkgs/by-name/go/golink/package.nix
+++ b/pkgs/by-name/go/golink/package.nix
@@ -1,4 +1,5 @@
 {
+  git,
   lib,
   buildGoModule,
   fetchFromGitHub,
@@ -6,17 +7,23 @@
 
 buildGoModule rec {
   pname = "golink";
-  version = "0-unstable-2024-01-26";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "tailscale";
     repo = "golink";
-    # https://github.com/tailscale/golink/issues/104
-    rev = "d9de913fb174ec2569a15b6e2dbe5cb6e4a0a853";
-    hash = "sha256-w6jRbajEQkOrBqxDnQreSmSB5DNL9flWjloShiIBM+M=";
+    tag = "v${version}";
+    hash = "sha256-cIml0ewF5j2cQySLHkMmV1rl7cVH8wuoPFeFDCARi1A=";
   };
 
-  vendorHash = "sha256-R/o3csZC/M9nm0k5STL7AhbG5J4LtdxqKaVjM/9ggW8=";
+  vendorHash = "sha256-QIAkmqXWH3X2dIoWyVcqFXVHBwzyv1dNPfdkzD5LuSE=";
+
+  overrideModAttrs = old: {
+    # netdb.go allows /etc/protocols and /etc/services to not exist and happily proceeds, but it panic()s if they exist but return permission denied.
+    postBuild = ''
+      patch -p0 < ${./darwin-sandbox-fix.patch}
+    '';
+  };
 
   ldflags = [
     "-s"