diff --git a/pkgs/by-name/go/google-cloud-sdk/cloudsdk-vendored-protobuf-upb.patch b/pkgs/by-name/go/google-cloud-sdk/cloudsdk-vendored-protobuf-upb.patch
new file mode 100644
index 000000000000..819947e767d4
--- /dev/null
+++ b/pkgs/by-name/go/google-cloud-sdk/cloudsdk-vendored-protobuf-upb.patch
@@ -0,0 +1,22 @@
+diff --git a/lib/third_party/cloudsdk/google/protobuf/internal/api_implementation.py b/lib/third_party/cloudsdk/google/protobuf/internal/api_implementation.py
+--- a/lib/third_party/cloudsdk/google/protobuf/internal/api_implementation.py
++++ b/lib/third_party/cloudsdk/google/protobuf/internal/api_implementation.py
+@@ -55,7 +55,7 @@ _implementation_type = 'python'
+ if _implementation_type is None:
+-  if _CanImport('google._upb._message'):
++  if _CanImport('cloudsdk.google._upb._message'):
+     _implementation_type = 'upb'
+-  elif _CanImport('google.protobuf.pyext._message'):
++  elif _CanImport('cloudsdk.google.protobuf.pyext._message'):
+     _implementation_type = 'cpp'
+   else:
+     _implementation_type = 'python'
+@@ -96,7 +96,7 @@ if _implementation_type == 'cpp':
+ if _implementation_type == 'upb':
+   try:
+     # pylint: disable=g-import-not-at-top
+-    from google._upb import _message
++    from cloudsdk.google._upb import _message
+     _c_module = _message
+     del _message
+   except ImportError:
diff --git a/pkgs/by-name/go/google-cloud-sdk/package.nix b/pkgs/by-name/go/google-cloud-sdk/package.nix
index e63b94324735..6e20f2bacb13 100644
--- a/pkgs/by-name/go/google-cloud-sdk/package.nix
+++ b/pkgs/by-name/go/google-cloud-sdk/package.nix
@@ -70,6 +70,9 @@ stdenv.mkDerivation rec {
     ./gcloud-path.patch
     # Disable checking for updates for the package
     ./gsutil-disable-updates.patch
+    # Cloud SDK vendors protobuf under the cloudsdk.google.protobuf namespace.
+    # Keep that vendored runtime from loading external google._upb modules.
+    ./cloudsdk-vendored-protobuf-upb.patch
   ];
 
   installPhase = ''
@@ -185,6 +188,12 @@ stdenv.mkDerivation rec {
     # Avoid trying to write logs to homeless-shelter
     export HOME=$(mktemp -d)
     $out/bin/gcloud version --format json | jq '."Google Cloud SDK"' | grep "${version}"
+    $out/bin/gcloud storage ls --help > /dev/null
+    # Exercises generated clients that use Cloud SDK's vendored protobuf. This
+    # catches regressions where external protobuf/upb is selected instead of the
+    # vendored pure-Python protobuf implementation.
+    $out/bin/gcloud kms asymmetric-sign --help > /dev/null
+    PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=upb $out/bin/gcloud kms asymmetric-sign --help > /dev/null
     $out/bin/gsutil version | grep -w "$(cat platform/gsutil/VERSION)"
   '';