diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9c657000..50657e46 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -47,7 +47,6 @@ jobs:
       run: |
         DCO_VERBOSITY=-q script/validate/dco
         GO111MODULE=on script/setup/install-dev-tools
-        script/validate/vendor
         go build -i .
         make check
         make build
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
new file mode 100644
index 00000000..a5b3df8f
--- /dev/null
+++ b/.github/workflows/validate.yml
@@ -0,0 +1,29 @@
+name: validate
+
+on:
+  push:
+    branches:
+      - 'main'
+      - 'release/*'
+    tags:
+      - 'v*'
+  pull_request:
+    branches:
+      - '*'
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          - validate-vendor
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Run
+        run: |
+          make ${{ matrix.target }}
diff --git a/Makefile b/Makefile
index 677d63b7..d30459a2 100644
--- a/Makefile
+++ b/Makefile
@@ -38,7 +38,7 @@ BINARIES=$(addprefix bin/,$(COMMANDS))
 TESTFLAGS ?= -v $(TESTFLAGS_RACE)
 TESTFLAGS_PARALLEL ?= 8
 
-.PHONY: all build binaries check clean test test-race test-full integration coverage
+.PHONY: all build binaries check clean test test-race test-full integration coverage validate-vendor vendor mod-outdated
 .DEFAULT: all
 
 all: binaries
@@ -100,3 +100,16 @@ build:
 clean: ## clean up binaries
 	@echo "$(WHALE) $@"
 	@rm -f $(BINARIES)
+
+validate-vendor: ## validate vendor
+	docker buildx bake validate-vendor
+
+vendor: ## update vendor
+	$(eval $@_TMP_OUT := $(shell mktemp -d -t buildx-output.XXXXXXXXXX))
+	docker buildx bake --set "*.output=$($@_TMP_OUT)" update-vendor
+	rm -rf ./vendor
+	cp -R "$($@_TMP_OUT)"/out/* .
+	rm -rf $($@_TMP_OUT)/*
+
+mod-outdated: ## check outdated dependencies
+	docker buildx bake mod-outdated
diff --git a/docker-bake.hcl b/docker-bake.hcl
index 4dd5a100..fb80a424 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -19,6 +19,33 @@ target "docker-metadata-action" {
   tags = ["registry:local"]
 }
 
+group "validate" {
+  targets = ["validate-vendor"]
+}
+
+target "validate-vendor" {
+  dockerfile = "./dockerfiles/vendor.Dockerfile"
+  target = "validate"
+  output = ["type=cacheonly"]
+}
+
+target "update-vendor" {
+  dockerfile = "./dockerfiles/vendor.Dockerfile"
+  target = "update"
+  output = ["."]
+}
+
+target "mod-outdated" {
+  dockerfile = "./dockerfiles/vendor.Dockerfile"
+  target = "outdated"
+  args = {
+    // used to invalidate cache for outdated run stage
+    // can be dropped when https://github.com/moby/buildkit/issues/1213 fixed
+    _RANDOM = uuidv4()
+  }
+  output = ["type=cacheonly"]
+}
+
 target "binary" {
   inherits = ["_common"]
   target = "binary"
diff --git a/dockerfiles/vendor.Dockerfile b/dockerfiles/vendor.Dockerfile
new file mode 100644
index 00000000..9bd43986
--- /dev/null
+++ b/dockerfiles/vendor.Dockerfile
@@ -0,0 +1,46 @@
+# syntax=docker/dockerfile:1
+
+ARG GO_VERSION=1.17
+ARG MODOUTDATED_VERSION=v0.8.0
+
+FROM golang:${GO_VERSION}-alpine AS base
+RUN apk add --no-cache git rsync
+WORKDIR /src
+
+FROM base AS vendored
+RUN --mount=target=/context \
+  --mount=target=.,type=tmpfs  \
+  --mount=target=/go/pkg/mod,type=cache <<EOT
+set -e
+rsync -a /context/. .
+go mod tidy
+go mod vendor
+mkdir /out
+cp -r go.mod go.sum vendor /out
+EOT
+
+FROM scratch AS update
+COPY --from=vendored /out /out
+
+FROM vendored AS validate
+RUN --mount=target=/context \
+  --mount=target=.,type=tmpfs <<EOT
+set -e
+rsync -a /context/. .
+git add -A
+rm -rf vendor
+cp -rf /out/* .
+if [ -n "$(git status --porcelain -- go.mod go.sum vendor)" ]; then
+  echo >&2 'ERROR: Vendor result differs. Please vendor your package with "make vendor"'
+  git status --porcelain -- go.mod go.sum vendor
+  exit 1
+fi
+EOT
+
+FROM psampaz/go-mod-outdated:${MODOUTDATED_VERSION} AS go-mod-outdated
+FROM base AS outdated
+ARG _RANDOM
+RUN --mount=target=.,ro \
+  --mount=target=/go/pkg/mod,type=cache \
+  --mount=from=go-mod-outdated,source=/home/go-mod-outdated,target=/usr/bin/go-mod-outdated \
+  go list -mod=readonly -u -m -json all | go-mod-outdated -update -direct
diff --git a/script/validate/vendor b/script/validate/vendor
deleted file mode 100755
index 3c04ed58..00000000
--- a/script/validate/vendor
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-
-set -eu -o pipefail
-
-echo "- Checking for any unused/missing packages in go.mod..."
-GO111MODULE=on go mod tidy
-echo "- Checking for unused packages in vendor..."
-GO111MODULE=on go mod vendor
-git diff --exit-code -- go.sum go.mod vendor/
-
-untracked=$(git ls-files --others vendor | wc -l | awk '{ print $1 }')
-[[ "${untracked}" == "0" ]]