diff --git a/internal/bzlmod/go_deps.bzl b/internal/bzlmod/go_deps.bzl
index 49abc1862..dcd0db37c 100644
--- a/internal/bzlmod/go_deps.bzl
+++ b/internal/bzlmod/go_deps.bzl
@@ -632,11 +632,16 @@ def _go_deps_impl(module_ctx):
                 "local_path": module.local_path,
             })
         else:
-            go_repository_args.update({
-                "sum": _get_sum_from_module(path, module, sums),
+            repo_args = {
                 "replace": getattr(module, "replace", None),
                 "version": "v" + module.raw_version,
-            })
+            }
+
+            sum = _get_sum_from_module(path, module, sums)
+            if sum:
+                repo_args["sum"] = sum
+
+            go_repository_args.update(repo_args)
 
         go_repository(**go_repository_args)
 
@@ -689,7 +694,10 @@ def _get_sum_from_module(path, module, sums):
             # replacement have no sums, so we can skip this
             return None
         elif module.local_path == None:
-            fail("No sum for {}@{} from {} found. You may need to run: bazel run @rules_go//go -- mod tidy".format(path, module.raw_version, "parent-label-todo"))  #module.parent_label))
+            # When updating a dependency, its sum may not be in go.sum and we can't hard fail here
+            # since we need Bazel to tidy the module
+            print("No sum for {}@{} found, run bazel run @rules_go//go -- mod tidy to generate it".format(path, module.raw_version))
+            return None
 
     return sums[entry]
 
diff --git a/internal/go_repository.bzl b/internal/go_repository.bzl
index afb044229..8e8027d45 100644
--- a/internal/go_repository.bzl
+++ b/internal/go_repository.bzl
@@ -123,6 +123,8 @@ def _go_repository_impl(ctx):
     fetch_repo_args = None
     gazelle_path = None
 
+    is_module_extension_repo = bool(ctx.attr.internal_only_do_not_use_apparent_name)
+
     # Declare Label dependencies at the top of function to avoid unnecessary fetching:
     # https://docs.bazel.build/versions/main/skylark/repository_rules.html#when-is-the-implementation-function-executed
     go_env_cache = str(ctx.path(Label("@bazel_gazelle_go_repository_cache//:go.env")))
@@ -188,8 +190,11 @@ def _go_repository_impl(ctx):
         for key in ("urls", "strip_prefix", "type", "sha256", "commit", "tag", "vcs", "remote"):
             if getattr(ctx.attr, key):
                 fail("cannot specify both version and %s" % key)
-        if ctx.attr.version and not ctx.attr.sum:
-            fail("if version is specified, sum must also be")
+        if not ctx.attr.sum:
+            if is_module_extension_repo:
+                fail("No sum for {}@{} found, run bazel run @rules_go//go -- mod tidy to generate it".format(ctx.attr.importpath, ctx.attr.version))
+            else:
+                fail("if version is specified, sum must also be")
 
         fetch_path = ctx.attr.replace if ctx.attr.replace else ctx.attr.importpath
         fetch_repo_args = [
@@ -305,10 +310,6 @@ def _go_repository_impl(ctx):
         if gazelle_path == None:
             gazelle_path = ctx.path(Label(_gazelle))
 
-        # ctx.attr.name is the canonical name of this repository, which contains a '~' if and only
-        # if this repository is generated by a module extension rather than an invocation in
-        # WORKSPACE.
-        is_module_extension_repo = ctx.attr.internal_only_do_not_use_apparent_name
         if is_module_extension_repo:
             # This repository is generated by the 'go_deps' extension. Since as of Bazel 7.2.0 there
             # is no API that constructs a label referencing a sibling repo from within a repo rule,