diff --git a/Makefile b/Makefile
index 19fb0b7..e01673d 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-12-05T15:27:03Z by kres 571923f-dirty.
+# Generated on 2025-12-08T15:47:06Z by kres 9fb16fe-dirty.
 
 # common variables
 
@@ -28,10 +28,12 @@ GOLANGCILINT_VERSION ?= v2.7.1
 GOFUMPT_VERSION ?= v0.9.2
 GO_VERSION ?= 1.25.5
 GO_BUILDFLAGS ?=
+GO_BUILDTAGS ?= ,
 GO_LDFLAGS ?=
 CGO_ENABLED ?= 0
 GOTOOLCHAIN ?= local
 GOEXPERIMENT ?=
+GO_BUILDFLAGS := $(GO_BUILDFLAGS) -tags $(GO_BUILDTAGS)
 TESTPKGS ?= ./...
 KRES_IMAGE ?= ghcr.io/siderolabs/kres:latest
 CONFORMANCE_IMAGE ?= ghcr.io/siderolabs/conform:latest
@@ -131,7 +133,7 @@ GO_LDFLAGS += -linkmode=external -extldflags '-static'
 endif
 
 ifneq (, $(filter $(WITH_DEBUG), t true TRUE y yes 1))
-GO_BUILDFLAGS += -tags sidero.debug
+GO_BUILDTAGS := $(GO_BUILDTAGS)sidero.debug,
 else
 GO_LDFLAGS += -s
 endif
diff --git a/internal/output/makefile/group.go b/internal/output/makefile/group.go
index 908b2f1..6c1b0de 100644
--- a/internal/output/makefile/group.go
+++ b/internal/output/makefile/group.go
@@ -30,7 +30,7 @@ type VariableGroup struct {
 // Variable appends variable to the group.
 func (group *VariableGroup) Variable(variable *Variable) *VariableGroup {
 	if slices.ContainsFunc(group.variables, func(item *Variable) bool {
-		return item.name == variable.name
+		return item.name == variable.name && item.operator == variable.operator
 	}) {
 		return group
 	}
diff --git a/internal/project/golang/toolchain.go b/internal/project/golang/toolchain.go
index f5cc2f9..9861025 100644
--- a/internal/project/golang/toolchain.go
+++ b/internal/project/golang/toolchain.go
@@ -48,6 +48,10 @@ type Toolchain struct { //nolint:govet
 	Docker struct {
 		ExtraArgs []string `yaml:"extraArgs"`
 	} `yaml:"docker"`
+	// BuildTags are additional build tags to be optionally enabled:
+	// - Makefile variable `WITH_$TAG`
+	// - If variable is set, the build tag is passed to go build via `-tags` flag
+	BuildTags []string `yaml:"buildTags"`
 }
 
 // NewToolchain builds Toolchain with default values.
@@ -136,6 +140,7 @@ func (toolchain *Toolchain) CompileMakefile(output *makefile.Output) error {
 
 	common := output.VariableGroup(makefile.VariableGroupCommon).
 		Variable(makefile.OverridableVariable("GO_BUILDFLAGS", "")).
+		Variable(makefile.OverridableVariable("GO_BUILDTAGS", ",")).
 		Variable(makefile.OverridableVariable("GO_LDFLAGS", "")).
 		Variable(makefile.OverridableVariable("CGO_ENABLED", "0")).
 		Variable(makefile.OverridableVariable("GOTOOLCHAIN", "local")).
@@ -155,12 +160,24 @@ func (toolchain *Toolchain) CompileMakefile(output *makefile.Output) error {
 
 	output.IfTrueCondition("WITH_DEBUG").
 		Then(
-			makefile.AppendVariable("GO_BUILDFLAGS", "-tags sidero.debug"),
+			makefile.SimpleVariable("GO_BUILDTAGS", "$(GO_BUILDTAGS)sidero.debug,"),
 		).
 		Else(
 			makefile.AppendVariable("GO_LDFLAGS", "-s"),
 		)
 
+	for _, tag := range toolchain.BuildTags {
+		conditionVar := "WITH_" + strings.ToUpper(tag)
+		output.IfTrueCondition(conditionVar).
+			Then(
+				makefile.SimpleVariable("GO_BUILDTAGS", "$(GO_BUILDTAGS)"+tag+","),
+			)
+	}
+
+	common.Variable(
+		makefile.AppendVariable("GO_BUILDFLAGS", "-tags $(GO_BUILDTAGS)"),
+	)
+
 	output.Target("base").
 		Depends(dag.GatherMatchingInputNames(toolchain, dag.Implements[dockerfile.Generator]())...).
 		Description("Prepare base toolchain").