diff --git a/src/cmd/go/internal/work/security.go b/src/cmd/go/internal/work/security.go
index 5ceb834c38..687602b3bf 100644
--- a/src/cmd/go/internal/work/security.go
+++ b/src/cmd/go/internal/work/security.go
@@ -236,7 +236,7 @@ var validLinkerFlagsOnDarwin = []*lazyregexp.Regexp{
 	// conjunction with the `-install_name` and `-rpath` linker flags.
 	// Since the GNU linker does not support Mach-O, targeting Darwin
 	// implies not using the GNU linker. Therefore, we allow @ in the linker
-	// flags if and only if cfg.GOOS == "darwin".
+	// flags if and only if cfg.Goos == "darwin".
 	re(`-Wl,-dylib_install_name,@rpath(/[^,]*)?`),
 	re(`-Wl,-install_name,@rpath(/[^,]*)?`),
 	re(`-Wl,-rpath,@(executable_path|loader_path)(/[^,]*)?`),
diff --git a/src/cmd/go/internal/work/security_test.go b/src/cmd/go/internal/work/security_test.go
index befa645422..2c95672214 100644
--- a/src/cmd/go/internal/work/security_test.go
+++ b/src/cmd/go/internal/work/security_test.go
@@ -5,10 +5,11 @@
 package work
 
 import (
-	"internal/cfg"
 	"os"
 	"strings"
 	"testing"
+
+	"cmd/go/internal/cfg"
 )
 
 var goodCompilerFlags = [][]string{
@@ -300,7 +301,7 @@ func TestCheckLinkerFlags(t *testing.T) {
 		}
 	}
 
-	goos = cfg.Goos
+	cfg.Goos = goos
 }
 
 func TestCheckFlagAllowDisallow(t *testing.T) {