diff --git a/go/private/sdk.bzl b/go/private/sdk.bzl
--- a/go/private/sdk.bzl
+++ b/go/private/sdk.bzl
@@ -130,6 +130,8 @@ def _go_download_sdk_impl(ctx):
             "sdks": ctx.attr.sdks,
             "urls": ctx.attr.urls,
             "version": version,
+            "patch": ctx.attr.patch,
+            "patch_strip": ctx.attr.patch_strip,
             "strip_prefix": ctx.attr.strip_prefix,
         }
     return None
@@ -145,6 +147,8 @@ go_download_sdk_rule = repository_rule(
         ),
         "urls": attr.string_list(default = ["https://dl.google.com/go/{}"]),
         "version": attr.string(),
+        "patch": attr.label(default = None),
+        "patch_strip": attr.int(default = 0),
         "strip_prefix": attr.string(default = "go"),
         "_sdk_build_file": attr.label(
             default = Label("//go/private:BUILD.sdk.bazel"),
@@ -440,6 +444,8 @@ def _remote_sdk(ctx, urls, strip_prefix, sha256):
         res = ctx.execute(["tar", "-xf", "go_sdk.tar.gz", "--strip-components=1"])
         if res.return_code:
             fail("error extracting Go SDK:\n" + res.stdout + res.stderr)
+        if ctx.attr.patch:
+            ctx.patch(ctx.attr.patch, strip=ctx.attr.patch_strip)
         ctx.delete("go_sdk.tar.gz")
     elif (urls[0].endswith(".zip") and
           host_goos != "windows" and