diff --git a/recipes/incoming-go/bom.toml b/recipes/incoming-go/bom.toml
index 5278a268..129b9161 100644
--- a/recipes/incoming-go/bom.toml
+++ b/recipes/incoming-go/bom.toml
@@ -11,7 +11,7 @@ commit = "1ab6284ac5e118267414f2ac3874bb08a701e9ad"
 compiler = "zig-cc"
 target   = "x86_64-linux-musl"
 link     = "static"
-flags    = []
+flags    = ["./cmd/bom"]
 
 [deps]
 build = ["go"]
diff --git a/tandas/staged-fallidos-go-20260705/README.md b/tandas/staged-fallidos-go-20260705/README.md
index f79fd85e..b895d132 100644
--- a/tandas/staged-fallidos-go-20260705/README.md
+++ b/tandas/staged-fallidos-go-20260705/README.md
@@ -49,3 +49,8 @@ Los patches de gross/gitlab-runner/woodpecker viajan acá con sus recetas.
 - `dolt` (2026-07-05, post-fix subdir): cgo tira de ICU (unicode/uregex.h vía
   dolthub/go-icu-regex) = CGO contra lib C EXTERNA, no bundled ⇒ frontera; necesita
   receta icu4c en el sandbox.
+- `aws-vault` (2026-07-05): el onepassword-sdk-go vendoreado exige CGO (error
+  deliberado en client_builder_no_cgo.go) ⇒ frontera CGO.
+- `minikube` (2026-07-05): pkg/drivers/kvm importa libvirt.org/go/libvirt (CGO
+  contra libvirt del sistema; nix lo buildea con buildInputs libvirt) ⇒ frontera
+  CGO-lib-externa.
diff --git a/recipes/incoming-go/aws-vault.toml b/tandas/staged-fallidos-go-20260705/aws-vault.toml
similarity index 100%
rename from recipes/incoming-go/aws-vault.toml
rename to tandas/staged-fallidos-go-20260705/aws-vault.toml
diff --git a/recipes/incoming-go/minikube.toml b/tandas/staged-fallidos-go-20260705/minikube.toml
similarity index 100%
rename from recipes/incoming-go/minikube.toml
rename to tandas/staged-fallidos-go-20260705/minikube.toml