diff --git a/go.mod b/go.mod
index 18b0acab3..800a02734 100644
--- a/go.mod
+++ b/go.mod
@@ -38,8 +38,21 @@ require (
 	golang.org/x/crypto v0.0.0-20210817164053-32db794688a5
 	golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45
 	google.golang.org/api v0.0.0-20160322025152-9bf6e6e569ff
+	// when updating google.golang.org/cloud, update (or remove) the replace
+	// rule for google.golang.org/grpc accordingly.
 	google.golang.org/cloud v0.0.0-20151119220103-975617b05ea8
 	google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a // indirect
 	gopkg.in/check.v1 v1.0.0-20141024133853-64131543e789
 	gopkg.in/yaml.v2 v2.4.0
 )
+
+// Prevent unwanted updates of grpc. In our codebase, it's a dependency of
+// google.golang.org/cloud. However, github.com/spf13/viper (which is an indirect
+// dependency of github.com/spf13/cobra) declares a more recent version. Viper
+// is not used in the codebase, but go modules uses the go.mod of *all* dependen-
+// cies to determine the minimum version of a module, but does *not* check if that
+// depdendency's code using the dependency is actually used.
+//
+// In our case, github.com/spf13/viper occurs as a dependency, but is unused,
+// so we can ignore the minimum versions of grpc and jwt-go that it specifies.
+replace google.golang.org/grpc => google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 3ad968345..c02ce1255 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -238,7 +238,7 @@ google.golang.org/cloud
 google.golang.org/cloud/internal
 google.golang.org/cloud/internal/opts
 google.golang.org/cloud/storage
-# google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a
+# google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a => google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a
 ## explicit
 google.golang.org/grpc
 google.golang.org/grpc/codes
@@ -255,3 +255,4 @@ gopkg.in/check.v1
 # gopkg.in/yaml.v2 v2.4.0
 ## explicit
 gopkg.in/yaml.v2
+# google.golang.org/grpc => google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a