diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
deleted file mode 100644
index b2e0ece5..00000000
--- a/.github/workflows/govulncheck.yml
+++ /dev/null
@@ -1,38 +0,0 @@
-name: govulncheck
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-
-permissions: {}
-
-jobs:
-  govulncheck:
-    name: Run on Ubuntu
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - name: Clone the code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-        with:
-          # Fetch full history so git worktree can check out the base branch.
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
-        with:
-          go-version-file: go.mod
-
-      - name: Install govulncheck
-        run: go install golang.org/x/vuln/cmd/govulncheck@d1f380186385b4f64e00313f31743df8e4b89a77 # v1.1.4
-
-      - name: Run govulncheck
-        # NRC_VERIFY_GIT_BRANCH tells the script which branch to use as the
-        # base for comparison.
-        env:
-          NRC_VERIFY_GIT_BRANCH: ${{ github.base_ref || 'main' }}
-        run: hack/verify-govulncheck.sh
diff --git a/Makefile b/Makefile
index 4f6e4953..22d26205 100644
--- a/Makefile
+++ b/Makefile
@@ -66,7 +66,7 @@ CONTROLLER_GEN_BIN := controller-gen
 CONTROLLER_GEN := $(abspath $(TOOLS_BIN_DIR)/$(CONTROLLER_GEN_BIN)-$(CONTROLLER_GEN_VER))
 CONTROLLER_GEN_PKG := sigs.k8s.io/controller-tools/cmd/controller-gen
 
-GOVULNCHECK_VER := v1.1.4
+GOVULNCHECK_VER := v1.7.0
 GOVULNCHECK_BIN := govulncheck
 GOVULNCHECK := $(abspath $(TOOLS_BIN_DIR)/$(GOVULNCHECK_BIN)-$(GOVULNCHECK_VER))
 GOVULNCHECK_PKG := golang.org/x/vuln/cmd/govulncheck
@@ -178,9 +178,9 @@ lint-api-fix: $(GOLANGCI_LINT_KAL)
 lint-config: $(GOLANGCI_LINT) ## Verify golangci-lint linter configuration
 	$(GOLANGCI_LINT) config verify
 
-.PHONY: govulncheck
-govulncheck: $(GOVULNCHECK) ## Run govulncheck to detect known vulnerabilities.
-	$(GOVULNCHECK) -scan package ./...
+.PHONY: verify-govulncheck
+verify-govulncheck: $(GOVULNCHECK) ## Run govulncheck verification
+	$(GOVULNCHECK) -C $(ROOT_DIR) -show verbose ./...
 
 .PHONY: verify
 verify: ## Run all verification scripts.
@@ -449,6 +449,9 @@ $(GOLANGCI_LINT_BIN): $(GOLANGCI_LINT) ## Build a local copy of golangci-lint.
 .PHONY: $(KIND_BIN)
 $(KIND_BIN): $(KIND) ## Build a local copy of kind.
 
+.PHONY: $(GOVULNCHECK_BIN)
+$(GOVULNCHECK_BIN): $(GOVULNCHECK) ## Build a local copy of govulncheck.
+
 $(KUSTOMIZE): # Build kustomize from tools folder.
 	CGO_ENABLED=0 GOBIN=$(TOOLS_BIN_DIR) $(GO_INSTALL) $(KUSTOMIZE_PKG) $(KUSTOMIZE_BIN) $(KUSTOMIZE_VER)
 
diff --git a/hack/verify-all.sh b/hack/verify-all.sh
index e4665373..481b01d6 100755
--- a/hack/verify-all.sh
+++ b/hack/verify-all.sh
@@ -22,4 +22,3 @@ set -o pipefail
 hack/verify-boilerplate.sh
 hack/verify-chart-drift.sh
 hack/verify-links.sh
-hack/verify-govulncheck.sh
diff --git a/hack/verify-govulncheck.sh b/hack/verify-govulncheck.sh
deleted file mode 100755
index d2cc2590..00000000
--- a/hack/verify-govulncheck.sh
+++ /dev/null
@@ -1,60 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-set -o errexit
-set -o nounset
-set -o pipefail
-
-GOVULNCHECK_VERSION="${GOVULNCHECK_VERSION:-v1.1.4}"
-
-# Install govulncheck if not already present.
-if ! command -v govulncheck &>/dev/null; then
-  echo "Installing govulncheck@${GOVULNCHECK_VERSION}..."
-  go install "golang.org/x/vuln/cmd/govulncheck@${GOVULNCHECK_VERSION}"
-fi
-
-# NRC_VERIFY_GIT_BRANCH is populated in verify CI jobs (e.g. GITHUB_BASE_REF
-# for GitHub Actions, PULL_BASE_REF for Prow).
-BRANCH="${NRC_VERIFY_GIT_BRANCH:-${PULL_BASE_REF:-main}}"
-
-# Prow (and other shallow/single-branch checkouts) may not have the base
-# branch available as a local ref, so fetch it if needed.
-if ! git show-ref --verify --quiet "refs/heads/${BRANCH}"; then
-  git fetch --quiet origin "${BRANCH}:${BRANCH}"
-fi
-
-# Create a temp directory and clean it up on exit.
-TMPDIR="$(mktemp -d)"
-trap 'rm -rf "${TMPDIR}"' EXIT
-
-WORKTREE="${TMPDIR}/worktree"
-
-echo "Creating worktree for base branch '${BRANCH}'..."
-git worktree add -f -q "${WORKTREE}" "${BRANCH}"
-trap 'git worktree remove -f "${WORKTREE}"; rm -rf "${TMPDIR}"' EXIT
-
-echo "Running govulncheck on HEAD (PR branch)..."
-govulncheck -scan package ./... > "${TMPDIR}/head.txt" || true
-
-echo "Running govulncheck on base branch '${BRANCH}'..."
-pushd "${WORKTREE}" >/dev/null
-  govulncheck -scan package ./... > "${TMPDIR}/pr-base.txt" || true
-popd >/dev/null
-
-echo -e "\n=== HEAD (PR branch) ===\n$(cat "${TMPDIR}/head.txt")"
-echo -e "\n=== BASE (${BRANCH}) ===\n$(cat "${TMPDIR}/pr-base.txt")"
-
-diff -s -u --ignore-all-space "${TMPDIR}/pr-base.txt" "${TMPDIR}/head.txt" || true