diff --git a/internal/worker/vulncheck_enqueue_test.go b/internal/worker/vulncheck_enqueue_test.go
index 8707d06..ad17ea3 100644
--- a/internal/worker/vulncheck_enqueue_test.go
+++ b/internal/worker/vulncheck_enqueue_test.go
@@ -80,7 +80,7 @@
 	}
 	wantTasks = nil
 	// cfg.BinaryBucket is empty, so no binary-mode tasks are created.
-	for _, mode := range []string{ModeImports, ModeVTA, ModeVTAStacks} {
+	for _, mode := range []string{ModeGovulncheck, ModeImports, ModeVTA, ModeVTAStacks} {
 		wantTasks = append(wantTasks,
 			vreq("github.com/pkg/errors", "v0.9.1", mode, 10),
 			vreq("golang.org/x/net", "v0.4.0", mode, 20))
diff --git a/internal/worker/vulncheck_scan.go b/internal/worker/vulncheck_scan.go
index 066446b..2d1cbc1 100644
--- a/internal/worker/vulncheck_scan.go
+++ b/internal/worker/vulncheck_scan.go
@@ -52,14 +52,18 @@
 
 	// ModeBinary runs vulncheck.Binary
 	ModeBinary string = "BINARY"
+
+	// Modegovulncheck runs the govulncheck binary
+	ModeGovulncheck = "GOVULNCHECK"
 )
 
 // modes is a set of supported vulncheck modes
 var modes = map[string]bool{
-	ModeImports:   true,
-	ModeVTA:       true,
-	ModeVTAStacks: true,
-	ModeBinary:    true,
+	ModeImports:     true,
+	ModeVTA:         true,
+	ModeVTAStacks:   true,
+	ModeBinary:      true,
+	ModeGovulncheck: true,
 }
 
 func IsValidVulncheckMode(mode string) bool {
@@ -211,6 +215,12 @@
 	row.PkgsMemory = int64(stats.pkgsMemory)
 	row.Workers = config.GetEnvInt("CLOUD_RUN_CONCURRENCY", "0", -1)
 	if err != nil {
+		// If an error occurred, wrap it accordingly
+		if isVulnDBConnection(err) {
+			err = fmt.Errorf("%v: %w", err, derrors.ScanModuleVulncheckDBConnectionError)
+		} else if !errors.Is(err, derrors.ScanModuleMemoryLimitExceeded) {
+			err = fmt.Errorf("%v: %w", err, derrors.ScanModuleVulncheckError)
+		}
 		row.AddError(err)
 		log.Infof(ctx, "scanner.runScanModule return error for %s (%v)", sreq.Path(), err)
 	} else {
@@ -269,24 +279,33 @@
 		}
 	}()
 
-	var vulns []*vulncheck.Vuln
-	if s.insecure {
-		vulns, err = s.runScanModuleInsecure(ctx, modulePath, version, binaryDir, mode, stats)
-	} else {
-		vulns, err = s.runScanModuleSandbox(ctx, modulePath, version, binaryDir, mode, stats)
-	}
-
-	// If an error occurred, wrap it accordingly.
-	if err != nil {
-		if isVulnDBConnection(err) {
-			err = fmt.Errorf("%v: %w", err, derrors.ScanModuleVulncheckDBConnectionError)
-		} else if !errors.Is(err, derrors.ScanModuleMemoryLimitExceeded) {
-			err = fmt.Errorf("%v: %w", err, derrors.ScanModuleVulncheckError)
+	if mode != ModeGovulncheck {
+		var vulns []*vulncheck.Vuln
+		if s.insecure {
+			vulns, err = s.runScanModuleInsecure(ctx, modulePath, version, binaryDir, mode, stats)
+		} else {
+			vulns, err = s.runScanModuleSandbox(ctx, modulePath, version, binaryDir, mode, stats)
 		}
-		return nil, err
-	}
-	for _, v := range vulns {
-		bvulns = append(bvulns, convertVuln(v))
+
+		if err != nil {
+			return nil, err
+		}
+		for _, v := range vulns {
+			bvulns = append(bvulns, convertVuln(v))
+		}
+	} else { // Govulncheck mode
+		var vulns []*govulncheck.Vuln
+		if s.insecure {
+			vulns, err = s.runGoVulncheckScanInsecure(ctx, modulePath, version, stats)
+		} else {
+			return nil, errors.New("Govulncheck scan is currently unsupported in sandbox mode")
+		}
+		if err != nil {
+			return nil, err
+		}
+		for _, v := range vulns {
+			bvulns = append(bvulns, convertGovulncheckOutput(v)...)
+		}
 	}
 	return bvulns, nil
 }
@@ -398,6 +417,64 @@
 	return &res, nil
 }
 
+func unmarshalGovulncheckOutput(output []byte) (*govulncheck.Result, error) {
+	var e struct {
+		Error string
+	}
+	if err := json.Unmarshal(output, &e); err != nil {
+		return nil, err
+	}
+	if e.Error != "" {
+		return nil, errors.New(e.Error)
+	}
+	var res govulncheck.Result
+	if err := json.Unmarshal(output, &res); err != nil {
+		return nil, err
+	}
+	return &res, nil
+}
+
+func (s *scanner) runGoVulncheckScanInsecure(ctx context.Context, modulePath, version string, stats *vulncheckStats) (_ []*govulncheck.Vuln, err error) {
+	tempDir, err := os.MkdirTemp("", "runGoVulncheckScan")
+	if err != nil {
+		return nil, err
+	}
+
+	defer func() {
+		err1 := os.RemoveAll(tempDir)
+		if err == nil {
+			err = err1
+		}
+	}()
+
+	log.Debugf(ctx, "fetching module zip: %s@%s", modulePath, version)
+	if err := modules.Download(ctx, modulePath, version, tempDir, s.proxyClient, true); err != nil {
+		return nil, err
+	}
+	start := time.Now()
+	vulns, err := runGovulncheckCmd(ctx, modulePath, tempDir, stats)
+	if err != nil {
+		return nil, err
+	}
+	stats.scanSeconds = time.Since(start).Seconds()
+
+	return vulns, nil
+}
+
+func runGovulncheckCmd(ctx context.Context, modulePath, tempDir string, stats *vulncheckStats) ([]*govulncheck.Vuln, error) {
+	govulncheckCmd := exec.Command("govulncheck", "-json", "./...")
+	govulncheckCmd.Dir = tempDir
+	output, err := govulncheckCmd.Output()
+	if err != nil {
+		return nil, err
+	}
+	res, err := unmarshalGovulncheckOutput(output)
+	if err != nil {
+		return nil, err
+	}
+	return res.Vulns, nil
+}
+
 func (s *scanner) runScanModuleInsecure(ctx context.Context, modulePath, version, binaryDir, mode string, stats *vulncheckStats) (_ []*vulncheck.Vuln, err error) {
 	tempDir, err := os.MkdirTemp("", "runScanModule")
 	if err != nil {
@@ -623,7 +700,7 @@
 	}
 }
 
-func convertGoVulncheckOutput(v *govulncheck.Vuln) (vulns []*bigquery.Vuln) {
+func convertGovulncheckOutput(v *govulncheck.Vuln) (vulns []*bigquery.Vuln) {
 	for _, module := range v.Modules {
 		for pkgNum, pkg := range module.Packages {
 			addedSymbols := make(map[string]bool)
diff --git a/internal/worker/vulncheck_scan_test.go b/internal/worker/vulncheck_scan_test.go
index 794fcc7..90603a5 100644
--- a/internal/worker/vulncheck_scan_test.go
+++ b/internal/worker/vulncheck_scan_test.go
@@ -107,6 +107,30 @@
 			t.Errorf("got %d vulns, want %d", g, w)
 		}
 	})
+	t.Run("govulncheck", func(t *testing.T) {
+		s := &scanner{proxyClient: proxyClient, dbClient: dbClient, insecure: true}
+		stats := &vulncheckStats{}
+		vulns, err := s.runScanModule(ctx,
+			"golang.org/x/exp/event", "v0.0.0-20220929112958-4a82f8963a65",
+			"", ModeGovulncheck, stats)
+		if err != nil {
+			t.Fatal(err)
+		}
+		wantID := "GO-2022-0493"
+		found := false
+		for _, v := range vulns {
+			if v.ID == wantID {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Errorf("want %s, did not find it in %d vulns", wantID, len(vulns))
+		}
+		if got := stats.scanSeconds; got <= 0 {
+			t.Errorf("scan time not collected or negative: %v", got)
+		}
+	})
 }
 
 func TestParseGoMemLimit(t *testing.T) {
@@ -149,7 +173,7 @@
 	}
 }
 
-func TestConvertGoVulncheckOutput(t *testing.T) {
+func TestConvertGovulncheckOutput(t *testing.T) {
 	var (
 		osvEntry = &osv.Entry{
 			ID: "GO-YYYY-1234",
@@ -265,7 +289,7 @@
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if diff := cmp.Diff(convertGoVulncheckOutput(tt.vuln), tt.wantVulns, cmpopts.EquateEmpty()); diff != "" {
+			if diff := cmp.Diff(convertGovulncheckOutput(tt.vuln), tt.wantVulns, cmpopts.EquateEmpty()); diff != "" {
 				t.Errorf("mismatch (-got, +want): %s", diff)
 			}
 		})