diff --git a/.github/workflows/go-autoupdate.yaml b/.github/workflows/go-autoupdate.yaml
index 371e399..c30c828 100644
--- a/.github/workflows/go-autoupdate.yaml
+++ b/.github/workflows/go-autoupdate.yaml
@@ -54,12 +54,26 @@ jobs:
         uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version }}
+          check-latest: true
           cache: true
 
       - name: Update dependencies
+        shell: bash
         run: |
-          go get -u ./...
-          go mod tidy
+          # Indirect modules can move ahead of their parents (for example
+          # kube-openapi ahead of apimachinery), which breaks the build.
+          update_all() { go get -u ./... && go mod tidy && go build ./...; }
+          update_direct() {
+            local mods=()
+            while IFS= read -r m; do mods+=("$m"); done < <(go list -m -f '{{if and (not .Indirect) (not .Main)}}{{.Path}}@latest{{end}}' all)
+            if [ "${#mods[@]}" -gt 0 ]; then go get "${mods[@]}"; fi
+            go mod tidy
+          }
+          if ! update_all; then
+            echo "::warning title=Full update failed::Falling back to direct dependencies only"
+            git checkout -- go.mod go.sum
+            update_direct
+          fi
 
       - name: Run tests
         run: go test -race -cover ./...