diff --git a/pkg/languages/golang/analyzer.go b/pkg/languages/golang/analyzer.go
index 0dcf2b6..dafdd19 100644
--- a/pkg/languages/golang/analyzer.go
+++ b/pkg/languages/golang/analyzer.go
@@ -205,7 +205,14 @@ func (ga *GolangAnalyzer) analyzeWorkspace(ctx context.Context, projectPath, wor
 
 	// Add module information to dependencies
 	for depName, modules := range depModules {
-		result.Dependencies[depName].Metadata["foundInModules"] = modules
+		dep := result.Dependencies[depName]
+		if dep == nil {
+			continue
+		}
+		if dep.Metadata == nil {
+			dep.Metadata = make(map[string]any)
+		}
+		dep.Metadata["foundInModules"] = modules
 	}
 
 	log.Infof("Workspace analysis complete: found %d unique dependencies across %d modules",
diff --git a/pkg/languages/golang/golang.go b/pkg/languages/golang/golang.go
index 4b88fd0..d2e5728 100644
--- a/pkg/languages/golang/golang.go
+++ b/pkg/languages/golang/golang.go
@@ -305,7 +305,7 @@ func getOptionBool(options map[string]any, key string, defaultValue bool) bool {
 // given module path on the left (Old) side.
 func hasReplaceDirective(modFile *modfile.File, packageName string) bool {
 	for _, r := range modFile.Replace {
-		if r.Old.Path == packageName {
+		if r != nil && r.Old.Path == packageName {
 			return true
 		}
 	}
diff --git a/pkg/languages/golang/indirect_resolver.go b/pkg/languages/golang/indirect_resolver.go
index c7f74ca..c18f948 100644
--- a/pkg/languages/golang/indirect_resolver.go
+++ b/pkg/languages/golang/indirect_resolver.go
@@ -100,6 +100,19 @@ func ResolveIndirectDependency(
 		return &IndirectResolution{IsIndirect: false}, nil
 	}
 
+	// Check if the dependency has a replace directive
+	// If it does, we should NOT try to resolve via parents because:
+	// - Replace directives are intentional (compatibility, forks, etc.)
+	// - Auto-updating would bypass the replace directive
+	// - CVE bot skips these for the same reason
+	if hasReplaceDirective(modFile, indirectPkg) {
+		log.Info("Package has replace directive - skipping parent resolution", "package", indirectPkg)
+		return &IndirectResolution{
+			IsIndirect:      true,
+			FallbackAllowed: false, // Don't allow direct bump either - respect the replace
+		}, nil
+	}
+
 	log.Info("Package is indirect - analyzing resolution options", "package", indirectPkg)
 
 	result := &IndirectResolution{
@@ -129,7 +142,8 @@ func ResolveIndirectDependency(
 			parent.Package,
 			parent.CurrentVersion,
 			indirectPkg,
-			targetVersion)
+			targetVersion,
+			modFile)
 		if err != nil {
 			log.Debug("Parent cannot provide fix", "parent", parent.Package, "error", err)
 			continue
@@ -252,12 +266,14 @@ func FindDirectParents(ctx context.Context, modRoot, indirectPkg string) ([]Dire
 
 // CheckIfDirectParentHasFix checks if updating a direct parent would bring in the target version.
 // It searches through newer versions of the parent to find one that has the required indirect version.
+// Also checks that the parent version won't conflict with existing replace directives.
 func CheckIfDirectParentHasFix(
 	ctx context.Context,
 	directDep string,
 	currentVersion string,
 	indirectPkg string,
 	targetVersion string,
+	modFile *modfile.File,
 ) (*ParentFixInfo, error) {
 	log := clog.FromContext(ctx)
 
@@ -269,10 +285,11 @@ func CheckIfDirectParentHasFix(
 
 	log.Debug("Checking versions for fix", "count", len(versions), "direct_dep", directDep)
 
-	return findVersionWithIndirectDep(ctx, versions, currentVersion, directDep, indirectPkg, targetVersion)
+	return findVersionWithIndirectDep(ctx, versions, currentVersion, directDep, indirectPkg, targetVersion, modFile)
 }
 
 // findVersionWithIndirectDep searches through versions to find one that has the required indirect dependency.
+// Also checks that the version won't conflict with existing replace directives in userModFile.
 func findVersionWithIndirectDep(
 	ctx context.Context,
 	versions []string,
@@ -280,9 +297,18 @@ func findVersionWithIndirectDep(
 	directDep string,
 	indirectPkg string,
 	targetVersion string,
+	userModFile *modfile.File,
 ) (*ParentFixInfo, error) {
 	log := clog.FromContext(ctx)
 
+	// Build map of replace directives from user's go.mod
+	replaceMap := make(map[string]string, len(userModFile.Replace))
+	for _, repl := range userModFile.Replace {
+		if repl != nil {
+			replaceMap[repl.Old.Path] = repl.New.Version
+		}
+	}
+
 	// Check each version newer than current
 	for _, ver := range versions {
 		// Skip older or equal versions
@@ -291,14 +317,22 @@ func findVersionWithIndirectDep(
 		}
 
 		// Fetch this version's go.mod
-		modFile, err := fetchGoModForPackage(ctx, directDep, ver)
+		parentModFile, err := fetchGoModForPackage(ctx, directDep, ver)
 		if err != nil {
 			log.Debug("Could not fetch version", "package", directDep, "version", ver, "error", err)
 			continue
 		}
 
+		// Check if this version would conflict with replace directives
+		if hasReplaceConflicts(ctx, parentModFile, replaceMap) {
+			log.Debug("Skipping version due to replace conflicts",
+				"package", directDep,
+				"version", ver)
+			continue
+		}
+
 		// Check if this version has the target indirect dependency version
-		fixInfo := checkModFileForIndirectDep(modFile, directDep, currentVersion, ver, indirectPkg, targetVersion)
+		fixInfo := checkModFileForIndirectDep(parentModFile, directDep, currentVersion, ver, indirectPkg, targetVersion)
 		if fixInfo != nil {
 			log.Info("Found fix in version",
 				"direct_dep", directDep,
@@ -453,3 +487,55 @@ func extractModuleVersion(moduleWithVersion string) string {
 	}
 	return moduleWithVersion[idx+1:]
 }
+
+// hasReplaceConflicts checks if a parent's dependencies would conflict with replace directives.
+// Returns true if there are conflicts (i.e., parent requires a version that would be replaced).
+func hasReplaceConflicts(ctx context.Context, parentModFile *modfile.File, replaceMap map[string]string) bool {
+	// Check each requirement in the parent's go.mod
+	for _, req := range parentModFile.Require {
+		if req == nil {
+			continue
+		}
+
+		replacedVersion, hasReplace := replaceMap[req.Mod.Path]
+		if !hasReplace {
+			continue
+		}
+
+		clog.DebugContext(ctx, "Checking replace conflict",
+			"package", req.Mod.Path,
+			"parent_requires", req.Mod.Version,
+			"replaced_with", replacedVersion)
+
+		// A local path replace (e.g. replace foo => ../local) has no version string.
+		// Any parent requiring a specific version of such a dep is incompatible.
+		if replacedVersion == "" {
+			clog.DebugContext(ctx, "Replace conflict: user has local path replace for package",
+				"package", req.Mod.Path,
+				"parent_requires", req.Mod.Version)
+			return true
+		}
+
+		// v0.0.0 indicates the parent uses internal replace directives
+		// (like k8s.io/kubernetes which replaces k8s.io/* with ./staging/...)
+		// These won't work when the parent is imported as a dependency.
+		if req.Mod.Version == "v0.0.0" {
+			clog.DebugContext(ctx, "Replace conflict: parent uses v0.0.0 placeholder (internal replace)",
+				"package", req.Mod.Path,
+				"replaced_with", replacedVersion)
+			return true
+		}
+
+		// If parent requires newer than what's replaced, it's a conflict.
+		// Example: parent requires k8s.io/api@v0.35.2, but user replaces with v0.32.11
+		if semver.Compare(req.Mod.Version, replacedVersion) > 0 {
+			clog.DebugContext(ctx, "Replace conflict detected",
+				"package", req.Mod.Path,
+				"parent_requires", req.Mod.Version,
+				"replaced_with", replacedVersion)
+			return true
+		}
+	}
+
+	return false
+}
diff --git a/pkg/languages/golang/indirect_resolver_replace_test.go b/pkg/languages/golang/indirect_resolver_replace_test.go
new file mode 100644
index 0000000..2ab5893
--- /dev/null
+++ b/pkg/languages/golang/indirect_resolver_replace_test.go
@@ -0,0 +1,260 @@
+/*
+Copyright 2026 Chainguard, Inc.
+SPDX-License-Identifier: Apache-2.0
+*/
+
+package golang
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/mod/modfile"
+)
+
+// TestResolveIndirectDependency_WithReplaceDirective tests that indirect resolution
+// is skipped when the dependency has a replace directive.
+func TestResolveIndirectDependency_WithReplaceDirective(t *testing.T) {
+	ctx := t.Context()
+	tmpDir := t.TempDir()
+
+	// Create go.mod with replace directive for indirect dependency
+	goModContent := `module test
+
+go 1.21
+
+require (
+	github.com/example/parent v1.0.0
+)
+
+require (
+	github.com/example/indirect v1.0.0 // indirect
+)
+
+replace github.com/example/indirect => github.com/example/indirect v1.0.0
+`
+
+	err := os.WriteFile(filepath.Join(tmpDir, "go.mod"), []byte(goModContent), 0o600)
+	require.NoError(t, err)
+
+	// Try to resolve the indirect dependency that has a replace directive
+	resolution, err := ResolveIndirectDependency(ctx, tmpDir, "github.com/example/indirect", "v1.2.0")
+	require.NoError(t, err)
+
+	// Should detect it's indirect but NOT allow resolution
+	assert.True(t, resolution.IsIndirect)
+	assert.False(t, resolution.FallbackAllowed, "Should not allow fallback when replace directive exists")
+	assert.Empty(t, resolution.PossibleBumps, "Should not find parent bumps when replace directive exists")
+}
+
+// TestHasReplaceDirective tests the hasReplaceDirective helper function.
+func TestHasReplaceDirective(t *testing.T) {
+	tests := []struct {
+		name         string
+		goModContent string
+		packageName  string
+		expected     bool
+	}{
+		{
+			name: "has replace directive",
+			goModContent: `module test
+
+replace github.com/example/pkg => github.com/example/pkg v1.0.0
+`,
+			packageName: "github.com/example/pkg",
+			expected:    true,
+		},
+		{
+			name: "no replace directive",
+			goModContent: `module test
+
+require github.com/example/pkg v1.0.0
+`,
+			packageName: "github.com/example/pkg",
+			expected:    false,
+		},
+		{
+			name: "replace different package",
+			goModContent: `module test
+
+replace github.com/example/other => github.com/example/other v1.0.0
+`,
+			packageName: "github.com/example/pkg",
+			expected:    false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			modFile, err := modfile.Parse("go.mod", []byte(tt.goModContent), nil)
+			require.NoError(t, err)
+
+			result := hasReplaceDirective(modFile, tt.packageName)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestHasReplaceConflicts tests the hasReplaceConflicts helper function.
+func TestHasReplaceConflicts(t *testing.T) {
+	ctx := t.Context()
+
+	tests := []struct {
+		name             string
+		parentGoMod      string
+		userReplaceMap   map[string]string
+		expectedConflict bool
+	}{
+		{
+			name: "no conflict - parent requires same or older version",
+			parentGoMod: `module parent
+
+require (
+	k8s.io/api v0.32.0
+)
+`,
+			userReplaceMap: map[string]string{
+				"k8s.io/api": "v0.32.11",
+			},
+			expectedConflict: false,
+		},
+		{
+			name: "conflict - parent requires newer version than replace",
+			parentGoMod: `module parent
+
+require (
+	k8s.io/api v0.35.2
+)
+`,
+			userReplaceMap: map[string]string{
+				"k8s.io/api": "v0.32.11",
+			},
+			expectedConflict: true,
+		},
+		{
+			name: "no conflict - no overlapping dependencies",
+			parentGoMod: `module parent
+
+require (
+	github.com/example/pkg v1.0.0
+)
+`,
+			userReplaceMap: map[string]string{
+				"k8s.io/api": "v0.32.11",
+			},
+			expectedConflict: false,
+		},
+		{
+			name: "multiple conflicts",
+			parentGoMod: `module parent
+
+require (
+	k8s.io/api v0.35.2
+	k8s.io/apimachinery v0.35.2
+)
+`,
+			userReplaceMap: map[string]string{
+				"k8s.io/api":          "v0.32.11",
+				"k8s.io/apimachinery": "v0.32.11",
+			},
+			expectedConflict: true,
+		},
+		{
+			name: "conflict - user has local path replace",
+			parentGoMod: `module parent
+
+require (
+	github.com/example/fork v1.0.0
+)
+`,
+			userReplaceMap: map[string]string{
+				"github.com/example/fork": "", // local path replace has no version
+			},
+			expectedConflict: true,
+		},
+		{
+			name: "conflict - parent uses v0.0.0 placeholder (k8s.io/kubernetes case)",
+			parentGoMod: `module k8s.io/kubernetes
+
+require (
+	k8s.io/api v0.0.0
+	k8s.io/apimachinery v0.0.0
+	k8s.io/client-go v0.0.0
+)
+
+replace (
+	k8s.io/api => ./staging/src/k8s.io/api
+	k8s.io/apimachinery => ./staging/src/k8s.io/apimachinery
+	k8s.io/client-go => ./staging/src/k8s.io/client-go
+)
+`,
+			userReplaceMap: map[string]string{
+				"k8s.io/api":          "v0.32.11",
+				"k8s.io/apimachinery": "v0.32.11",
+				"k8s.io/client-go":    "v0.32.11",
+			},
+			expectedConflict: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			parentModFile, err := modfile.Parse("go.mod", []byte(tt.parentGoMod), nil)
+			require.NoError(t, err)
+
+			result := hasReplaceConflicts(ctx, parentModFile, tt.userReplaceMap)
+			assert.Equal(t, tt.expectedConflict, result)
+		})
+	}
+}
+
+// TestResolveIndirectDependency_SkipsParentsWithReplaceConflicts tests that
+// parent versions with replace conflicts are skipped.
+func TestResolveIndirectDependency_SkipsParentsWithReplaceConflicts(t *testing.T) {
+	t.Skip("Integration test - requires real packages from proxy")
+
+	ctx := t.Context()
+	tmpDir := t.TempDir()
+
+	// Simulate calico's go.mod with k8s replace directives
+	goModContent := `module github.com/projectcalico/calico
+
+go 1.21
+
+require (
+	k8s.io/kubernetes v1.32.11
+)
+
+require (
+	go.opentelemetry.io/otel/sdk v1.34.0 // indirect
+)
+
+// Pin k8s deps to v0.32.11
+replace k8s.io/api => k8s.io/api v0.32.11
+replace k8s.io/apimachinery => k8s.io/apimachinery v0.32.11
+replace k8s.io/client-go => k8s.io/client-go v0.32.11
+`
+
+	err := os.WriteFile(filepath.Join(tmpDir, "go.mod"), []byte(goModContent), 0o600)
+	require.NoError(t, err)
+
+	// Try to resolve otel/sdk@v1.40.0
+	// Should find that k8s.io/kubernetes v1.36.0-alpha.2 has it
+	// But should skip it due to replace conflicts
+	resolution, err := ResolveIndirectDependency(ctx, tmpDir, "go.opentelemetry.io/otel/sdk", "v1.40.0")
+	require.NoError(t, err)
+
+	// Should NOT recommend k8s.io/kubernetes bump due to replace conflicts
+	assert.True(t, resolution.IsIndirect)
+	// Either no bumps found, or the bumps don't include problematic versions
+	if len(resolution.PossibleBumps) > 0 {
+		// Verify none of the bumps would conflict
+		for _, bump := range resolution.PossibleBumps {
+			// Would need to fetch and verify - this is just a structure test
+			t.Logf("Found bump: %s %s -> %s", bump.Package, bump.FromVersion, bump.ToVersion)
+		}
+	}
+}
diff --git a/pkg/languages/golang/indirect_resolver_test.go b/pkg/languages/golang/indirect_resolver_test.go
index 5e6253d..3740ed7 100644
--- a/pkg/languages/golang/indirect_resolver_test.go
+++ b/pkg/languages/golang/indirect_resolver_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/mod/modfile"
+	"golang.org/x/mod/module"
 	"golang.org/x/mod/semver"
 )
 
@@ -259,7 +260,7 @@ func TestCheckIfDirectParentHasFix(t *testing.T) {
 		checkFunc      func(*testing.T, *ParentFixInfo)
 	}{
 		{
-			name:           "libp2p v0.47.0 has webtransport-go v0.10.0",
+			name:           "libp2p v0.48.0 has webtransport-go v0.10.0",
 			directDep:      "github.com/libp2p/go-libp2p",
 			currentVersion: "v0.46.0",
 			indirectPkg:    "github.com/quic-go/webtransport-go",
@@ -268,7 +269,7 @@ func TestCheckIfDirectParentHasFix(t *testing.T) {
 			checkFunc: func(t *testing.T, info *ParentFixInfo) {
 				assert.Equal(t, "github.com/libp2p/go-libp2p", info.DirectDep)
 				assert.Equal(t, "v0.46.0", info.CurrentVersion)
-				assert.Equal(t, "v0.47.0", info.FixVersion)
+				assert.Equal(t, "v0.48.0", info.FixVersion)
 				assert.Equal(t, "github.com/quic-go/webtransport-go", info.IndirectPkg)
 				assert.Equal(t, "v0.10.0", info.IndirectVersionIn)
 			},
@@ -283,13 +284,19 @@ func TestCheckIfDirectParentHasFix(t *testing.T) {
 		},
 	}
 
+	// Create an empty modfile for testing (no replace directives)
+	emptyModFile := &modfile.File{
+		Module: &modfile.Module{Mod: module.Version{Path: "test"}},
+	}
+
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			info, err := CheckIfDirectParentHasFix(ctx,
 				tt.directDep,
 				tt.currentVersion,
 				tt.indirectPkg,
-				tt.targetVersion)
+				tt.targetVersion,
+				emptyModFile)
 
 			if tt.expectError {
 				assert.Error(t, err)
@@ -496,13 +503,13 @@ func TestResolveIndirectDependency_K3S_Integration(t *testing.T) {
 	// Should find multiple possible bumps (libp2p and boxo at minimum)
 	assert.GreaterOrEqual(t, len(resolution.PossibleBumps), 1, "Should find at least one parent bump")
 
-	// Should include libp2p@v0.47.0
+	// Should include libp2p@v0.48.0
 	foundLibp2pBump := false
 	for _, bump := range resolution.PossibleBumps {
 		if bump.Package == "github.com/libp2p/go-libp2p" {
 			foundLibp2pBump = true
 			assert.Equal(t, "v0.46.0", bump.FromVersion)
-			assert.Equal(t, "v0.47.0", bump.ToVersion)
+			assert.Equal(t, "v0.48.0", bump.ToVersion)
 			assert.Equal(t, "github.com/quic-go/webtransport-go", bump.WillBringIn)
 			assert.Equal(t, "v0.10.0", bump.WillBringInVersion)
 			break