diff --git a/src/config.ts b/src/config.ts
index 93ca127..9203e7c 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -11,14 +11,14 @@
 	'goroot', 'gopath', 'toolsGopath', 'alternateTools', 'inferGopath'
 ];
 
-let defaultConfig: Configuration = null;
-
 // Initialize the singleton defaultConfig and register related commands.
 // Prompt if workspace configuration was found but had to be ignored until
 // the user has to explicitly opt in to trust the workspace.
 export async function initConfig(ctx: vscode.ExtensionContext) {
 	const isTrusted = getFromWorkspaceState(WORKSPACE_IS_TRUSTED_KEY, false);
-	defaultConfig = new Configuration(isTrusted, vscode.workspace.getConfiguration);
+	if (isTrusted !== defaultConfig.workspaceIsTrusted) {
+		defaultConfig.toggleWorkspaceIsTrusted();
+	}
 	ctx.subscriptions.push(
 		vscode.commands.registerCommand('go.workspace.isTrusted.toggle', toggleWorkspaceIsTrusted)
 	);
@@ -66,24 +66,35 @@
 // Go extension configuration for a workspace.
 export class Configuration {
 	constructor(
-		private workspaceIsTrusted = false,
+		private _workspaceIsTrusted = false,
 		private getConfiguration = vscode.workspace.getConfiguration) { }
 
 	public toggleWorkspaceIsTrusted() {
-		this.workspaceIsTrusted = !this.workspaceIsTrusted;
-		return this.workspaceIsTrusted;
+		this._workspaceIsTrusted = !this._workspaceIsTrusted;
+		return this._workspaceIsTrusted;
 	}
 
 	// returns a Proxied vscode.WorkspaceConfiguration, which prevents
 	// from using the workspace configuration if the workspace is untrusted.
 	public get<T>(section: string, uri?: vscode.Uri): vscode.WorkspaceConfiguration {
 		const cfg = this.getConfiguration(section, uri);
-		if (section !== 'go' || this.workspaceIsTrusted) {
+		if (section !== 'go' || this._workspaceIsTrusted) {
 			return cfg;
 		}
 
 		return new WrappedConfiguration(cfg);
 	}
+
+	public workspaceIsTrusted(): boolean {
+		return this._workspaceIsTrusted;
+	}
+}
+
+const defaultConfig = new Configuration();
+
+// Returns the workspace Configuration used by the extension.
+export function DefaultConfig() {
+	return defaultConfig;
 }
 
 // wrappedConfiguration wraps vscode.WorkspaceConfiguration.
@@ -141,5 +152,5 @@
 			uri = null;
 		}
 	}
-	return defaultConfig ? defaultConfig.get(section, uri) : new Configuration().get(section, uri);
+	return defaultConfig.get(section, uri);
 }
diff --git a/src/util.ts b/src/util.ts
index 4ac4f69..04a7369 100644
--- a/src/util.ts
+++ b/src/util.ts
@@ -11,7 +11,7 @@
 import util = require('util');
 import vscode = require('vscode');
 import { NearestNeighborDict, Node } from './avlTree';
-import { getGoConfig } from './config';
+import { DefaultConfig, getGoConfig } from './config';
 import { extensionId } from './const';
 import { toolExecutionEnvironment } from './goEnv';
 import { languageClient } from './goLanguageServer';
@@ -478,7 +478,11 @@
 		return toolsGopathForWorkspace;
 	}
 
-	// If any of the folders in multi root have toolsGopath set, use it.
+	if (DefaultConfig().workspaceIsTrusted() === false) {
+		return toolsGopathForWorkspace;
+	}
+
+	// If any of the folders in multi root have toolsGopath set and the workspace is trusted, use it.
 	for (const folder of vscode.workspace.workspaceFolders) {
 		let toolsGopathFromConfig = <string>getGoConfig(folder.uri).inspect('toolsGopath').workspaceFolderValue;
 		toolsGopathFromConfig = resolvePath(toolsGopathFromConfig, folder.uri.fsPath);
@@ -486,6 +490,7 @@
 			return toolsGopathFromConfig;
 		}
 	}
+	return toolsGopathForWorkspace;
 }
 
 // getBinPath returns the path to the tool.