diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index a68fb66..835e295 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - run: git submodule update --init --recursive go.mk
+      - run: make go.mk
       - uses: ./go.mk/.github/actions/setup
 
       - uses: ./go.mk/.github/actions/pre-check
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f41487e..1c1737e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,7 +18,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - run: git submodule update --init --recursive go.mk
+      - run: make go.mk
         shell: bash
 
       - name: Import GPG key
diff --git a/.gitignore b/.gitignore
index 1efb091..9881f9b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
+/go.mk
 dist/
 bin/
 /release
diff --git a/.gitmodules b/.gitmodules
deleted file mode 100644
index 31cdf10..0000000
--- a/.gitmodules
+++ /dev/null
@@ -1,3 +0,0 @@
-[submodule "go.mk"]
-	path = go.mk
-	url = https://github.com/exoscale/go.mk.git
diff --git a/Makefile b/Makefile
index 85a4128..0e72151 100644
--- a/Makefile
+++ b/Makefile
@@ -1,12 +1,43 @@
+GO_MK_REF := v1.0.0
+
+# make go.mk a dependency for all targets
+.EXTRA_PREREQS = go.mk
+
+ifndef MAKE_RESTARTS
+# This section will be processed the first time that make reads this file.
+
+# This causes make to re-read the Makefile and all included
+# makefiles after go.mk has been cloned.
+Makefile:
+	@touch Makefile
+endif
+
+.PHONY: go.mk
+.ONESHELL:
+go.mk:
+	@if [ ! -d "go.mk" ]; then
+		git clone https://github.com/exoscale/go.mk.git
+	fi
+	@cd go.mk
+	@if ! git show-ref --quiet --verify "refs/heads/${GO_MK_REF}"; then
+		git fetch
+	fi
+	@if ! git show-ref --quiet --verify "refs/tags/${GO_MK_REF}"; then
+		git fetch --tags
+	fi
+	git checkout --quiet ${GO_MK_REF}
+
 PACKAGE := github.com/exoscale/vault-plugin-secrets-exoscale
 PROJECT_URL := https://$(PACKAGE)
 GO_MAIN_PKG_PATH := ./cmd/vault-plugin-secrets-exoscale
 
 
+go.mk/init.mk:
 include go.mk/init.mk
 
 GO_LD_FLAGS := -ldflags "-s -w -X $(PACKAGE)/version.Version=${VERSION} -X $(PACKAGE)/version.Commit=${GIT_REVISION}"
 
+go.mk/public.mk:
 include go.mk/public.mk
 
 ifeq ($(VERSION), dev)
diff --git a/go.mk b/go.mk
deleted file mode 160000
index c5d585d..0000000
--- a/go.mk
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit c5d585d8148af3ddd76dc58c59ce662243c7c8c8