diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
new file mode 100644
index 000000000..a5b3df8f5
--- /dev/null
+++ b/.github/workflows/validate.yml
@@ -0,0 +1,29 @@
+name: validate
+
+on:
+  push:
+    branches:
+      - 'main'
+      - 'release/*'
+    tags:
+      - 'v*'
+  pull_request:
+    branches:
+      - '*'
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          - validate-vendor
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Run
+        run: |
+          make ${{ matrix.target }}
diff --git a/Makefile b/Makefile
index 677d63b73..19c1bf0c4 100644
--- a/Makefile
+++ b/Makefile
@@ -38,7 +38,7 @@ BINARIES=$(addprefix bin/,$(COMMANDS))
 TESTFLAGS ?= -v $(TESTFLAGS_RACE)
 TESTFLAGS_PARALLEL ?= 8
 
-.PHONY: all build binaries check clean test test-race test-full integration coverage
+.PHONY: all build binaries check clean test test-race test-full integration coverage validate-vendor vendor
 .DEFAULT: all
 
 all: binaries
@@ -100,3 +100,13 @@ build:
 clean: ## clean up binaries
 	@echo "$(WHALE) $@"
 	@rm -f $(BINARIES)
+
+validate-vendor: ## validate vendor
+	docker buildx bake validate-vendor
+
+vendor: ## update vendor
+	$(eval $@_TMP_OUT := $(shell mktemp -d -t buildx-output.XXXXXXXXXX))
+	docker buildx bake --set "*.output=$($@_TMP_OUT)" update-vendor
+	rm -rf ./vendor
+	cp -R "$($@_TMP_OUT)"/out/* .
+	rm -rf $($@_TMP_OUT)/*
diff --git a/docker-bake.hcl b/docker-bake.hcl
index 4dd5a100c..476a3124e 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -19,6 +19,22 @@ target "docker-metadata-action" {
   tags = ["registry:local"]
 }
 
+group "validate" {
+  targets = ["validate-vendor"]
+}
+
+target "validate-vendor" {
+  dockerfile = "./dockerfiles/vendor.Dockerfile"
+  target = "validate"
+  output = ["type=cacheonly"]
+}
+
+target "update-vendor" {
+  dockerfile = "./dockerfiles/vendor.Dockerfile"
+  target = "update"
+  output = ["."]
+}
+
 target "binary" {
   inherits = ["_common"]
   target = "binary"
diff --git a/dockerfiles/vendor.Dockerfile b/dockerfiles/vendor.Dockerfile
new file mode 100644
index 000000000..55006773e
--- /dev/null
+++ b/dockerfiles/vendor.Dockerfile
@@ -0,0 +1,37 @@
+# syntax=docker/dockerfile:1
+
+ARG GO_VERSION=1.17
+
+FROM golang:${GO_VERSION}-alpine AS base
+RUN apk add --no-cache git rsync
+WORKDIR /src
+
+FROM base AS vendored
+RUN --mount=target=/context \
+  --mount=target=.,type=tmpfs  \
+  --mount=target=/go/pkg/mod,type=cache <<EOT
+set -e
+rsync -a /context/. .
+go mod tidy
+go mod vendor
+mkdir /out
+cp -r go.mod go.sum vendor /out
+EOT
+
+FROM scratch AS update
+COPY --from=vendored /out /out
+
+FROM vendored AS validate
+RUN --mount=target=/context \
+  --mount=target=.,type=tmpfs <<EOT
+set -e
+rsync -a /context/. .
+git add -A
+rm -rf vendor
+cp -rf /out/* .
+if [ -n "$(git status --porcelain -- go.mod go.sum vendor)" ]; then
+  echo >&2 'ERROR: Vendor result differs. Please vendor your package with "make vendor"'
+  git status --porcelain -- go.mod go.sum vendor
+  exit 1
+fi
+EOT