diff --git a/Makefile b/Makefile
index 1ac28d6bd556..8b936492994b 100644
--- a/Makefile
+++ b/Makefile
@@ -24,7 +24,7 @@ KIC_VERSION ?= $(shell grep -E "Version =" pkg/drivers/kic/types.go | cut -d \"
 HUGO_VERSION ?= $(shell grep -E "HUGO_VERSION = \"" netlify.toml | cut -d \" -f2)
 
 # Default to .0 for higher cache hit rates, as build increments typically don't require new ISO versions
-ISO_VERSION ?= v1.38.0
+ISO_VERSION ?= v1.38.0-1776626127-22862
 
 # Dashes are valid in semver, but not Linux packaging. Use ~ to delimit alpha/beta
 DEB_VERSION ?= $(subst -,~,$(RAW_VERSION))
@@ -292,6 +292,11 @@ buildroot:
 	if [ ! -d $(BUILD_DIR)/buildroot ]; then \
 		mkdir -p $(BUILD_DIR); \
 		git clone --depth=1 --branch=$(BUILDROOT_BRANCH) https://github.com/buildroot/buildroot $(BUILD_DIR)/buildroot; \
+		for p in $(CURDIR)/deploy/iso/minikube-iso/patches/buildroot/*.patch; do \
+			[ -f "$$p" ] || continue; \
+			echo "Applying buildroot patch: $$p"; \
+			(cd $(BUILD_DIR)/buildroot && patch -p1 -i "$$p") || exit 1; \
+		done; \
 	fi;
 
 # Change buildroot configuration for the minikube ISO
diff --git a/deploy/iso/minikube-iso/patches/buildroot/0001-host-go-aarch64-stage1.patch b/deploy/iso/minikube-iso/patches/buildroot/0001-host-go-aarch64-stage1.patch
new file mode 100644
index 000000000000..c7d2e8d172a1
--- /dev/null
+++ b/deploy/iso/minikube-iso/patches/buildroot/0001-host-go-aarch64-stage1.patch
@@ -0,0 +1,29 @@
+Add aarch64 as a supported host arch for the Go bootstrap stage 1.
+
+The stage1 gate in the upstream buildroot config only default-y's for
+x86, x86_64 and arm hosts. On an aarch64 host this leaves
+BR2_PACKAGE_HOST_GO_BOOTSTRAP_STAGE1_ARCH_SUPPORTS unset, which in
+turn leaves BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS unset, which
+silently drops every Go-target package (cri-dockerd, cni-plugins,
+podman, crio-bin, ...) from the build. The resulting arm64 minikube
+ISO is ~80 MB short and the provisioner fails at the docker.service
+restart step because no docker.service file was ever installed.
+
+The gate is correct for host-go-src (source bootstrap of Go has real
+host arch restrictions), but minikube resolves host-go via
+host-go-bin (PROVIDES_HOST_GO="host-go-bin"), and prebuilt Go binaries
+support aarch64 natively. Allow aarch64 in the stage1 default list so
+Go-target packages build correctly when the buildroot host is aarch64
+(e.g. Colima on an Apple Silicon Mac).
+
+This is a local patch; the proper fix belongs upstream in buildroot.
+
+Signed-off-by: Jon Williams <jon@jonwilliams.org.uk>
+
+--- a/package/go/go-bootstrap-stage1/Config.in.host
++++ b/package/go/go-bootstrap-stage1/Config.in.host
+@@ -4,3 +4,4 @@ config BR2_PACKAGE_HOST_GO_BOOTSTRAP_STAGE1_ARCH_SUPPORTS
+ 	default y if BR2_HOSTARCH = "x86"
+ 	default y if BR2_HOSTARCH = "x86_64"
+ 	default y if BR2_HOSTARCH = "arm"
++	default y if BR2_HOSTARCH = "aarch64"
diff --git a/pkg/minikube/download/iso.go b/pkg/minikube/download/iso.go
index 09b858c2a2b4..623d12796b36 100644
--- a/pkg/minikube/download/iso.go
+++ b/pkg/minikube/download/iso.go
@@ -41,7 +41,7 @@ const fileScheme = "file"
 // DefaultISOURLs returns a list of ISO URL's to consult by default, in priority order
 func DefaultISOURLs() []string {
 	v := version.GetISOVersion()
-	isoBucket := "minikube/iso"
+	isoBucket := "minikube-builds/iso/22862"
 
 	return []string{
 		fmt.Sprintf("https://storage.googleapis.com/%s/minikube-%s-%s.iso", isoBucket, v, runtime.GOARCH),