Is there a flag for go get or go install to force those to use the cache, even if the cache is very old / ancient? We are using docker images / multi-stage build to cache deps, and those original files might be weeks or months old.
go.mod may record concrete versions or commits you depend on. If you need old versions of your deps, state them explicitly in your go.mod and you get reproducible builds even if your dependencies evolve.
Use go get foo@123456 if you need the 123456 commit of your foo dependency.
Use go get foo@v0.1.2 if you need the v0.1.2 version of your dependency. These will get recorded in go.mod, and no matter where / when you build your module, it will always use these versions.
For details, see Go Wiki: Modules: How to Upgrade and Downgrade Dependencies.