diff --git a/.gitignore b/.gitignore
index 6a04f52..3a200e6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,4 @@
 /go-rpm-macros-3.2.0.tar.gz
 /go-rpm-macros-3.6.0.tar.gz
 /golist-0.10.4.tar.gz
+/golist-0.10.4-vendor.tar.xz
diff --git a/go-rpm-macros.spec b/go-rpm-macros.spec
index 607d10b..d0f2e71 100644
--- a/go-rpm-macros.spec
+++ b/go-rpm-macros.spec
@@ -45,6 +45,11 @@ URL:       %{forgeurl}
 Source0:   %{forgesource}
 %if 0%{?bundle_golist}
 Source1:   https://pagure.io/golist/archive/v%{golist_version}/golist-%{golist_version}.tar.gz
+# vendored dependency tarball, to create:
+# tar xf golist-%%{golist_version}.tar.gz ; pushd golist-%%{golist_version} ; \
+# go mod init %%{golist_goipath} && go mod tidy && go mod vendor && \
+# tar Jcf ../golist-%%{golist_version}-vendor.tar.xz go.mod go.sum vendor/ ; popd
+Source2:   golist-%{golist_version}-vendor.tar.xz
 %endif
 
 Requires:  go-srpm-macros = %{version}-%{release}
@@ -74,9 +79,9 @@ Obsoletes: go-compilers-gcc-go-compiler < %{version}-%{release}
 # Replace golang-github-urfave-cli with a minimal
 # command line parser backend to bootstrap golist
 # without dependencies.
-Patch1: golist-bootstrap-cli-no-vendor.patch
+#Patch1: golist-bootstrap-cli-no-vendor.patch
 # Add libexec to PATH in order to launch golist in every script
-Patch2: 0001-Add-libexec-to-path-for-EPEL9-golist.patch
+#Patch2: 0001-Add-libexec-to-path-for-EPEL9-golist.patch
 
 # RHEL 8 only provides the macros.go-srpm file which includes gobuild and gotest.
 # C9S also only provides the macros.go-srpm file but it also follows upstream which includes gobuild and gotest in the macros.go-compilers-gcc.
@@ -84,10 +89,10 @@ Patch2: 0001-Add-libexec-to-path-for-EPEL9-golist.patch
 # This also sets the GOAMD64 variable to v2
 # Resolves: rhbz#1965292
 # Resolves: RHEL-5529
-Patch3: add-gobuild-and-gotest.patch
+#Patch3: add-gobuild-and-gotest.patch
 
 # Remove when rpm >= 4.17.0
-Patch4: remove-isdefined-function.patch
+#Patch4: remove-isdefined-function.patch
 
 %description
 This package provides build-stage rpm automation to simplify the creation of Go
@@ -143,22 +148,22 @@ done
 # unpack golist and patch
 %if 0%{?bundle_golist}
 # Add libexec to PATH
-%patch2 -p1
+#patch2 -p1
 tar -xf %{SOURCE1}
+tar -C %{golist_builddir} -xf %{SOURCE2}
 pushd %{golist_builddir}
-%patch1 -p1
+#patch1 -p1
 popd
 cp %{golist_builddir}/LICENSE LICENSE-golist
 %endif
 
-%patch3 -p1
-%patch4 -p1
+#patch3 -p1
+#patch4 -p1
 
 %build
 # build golist
 %if 0%{?bundle_golist}
 pushd %{golist_builddir}
-go mod init %{golist_goipath} && go mod tidy
 for cmd in cmd/* ; do
   %gobuild -o bin/$(basename $cmd) ./$cmd
 done
@@ -226,7 +231,7 @@ sed -i "s,golist ,%{golist_execdir}/golist ,g" \
 %files
 %license LICENSE.txt
 %if %{defined bundle_golist}
-%license LICENSE-golist
+%license LICENSE-golist %{golist_builddir}/vendor/modules.txt
 %endif
 %doc README.md
 %{_bindir}/*
diff --git a/sources b/sources
index 015d5b4..013ad8a 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,3 @@
 SHA512 (go-rpm-macros-3.6.0.tar.gz) = 904406180a1bedb70dd0bacc3794dee7f1ff8e4329230750ef903338f22c2beb995e23f1d647191a4e094860b31933ae7b3acfa35d6ca67aed8c591bdd45c3bb
 SHA512 (golist-0.10.4.tar.gz) = 81fc9cdc4cb0fa1b78ade56c60cb2ac0070dcb11130a333e61053a266e2312b03e64a6705415d6d20883ae4f8cd0be57722c93835c3efffdfaeb9330f4cc12ea
+SHA512 (golist-0.10.4-vendor.tar.xz) = 53efe2d344d5eeb7954dd7c18a1142c67c1e7009b4d34b503372e010a6380a2218bceccff4925b513c8a80a3c3de8290c244d338f1da00c438d00f9affd8b363