diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 242f70b3..7c4b25c8 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,6 +14,25 @@ env:
   GO_VERSION: 1.16.7
 
 jobs:
+  validate:
+    runs-on: ubuntu-20.04
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          - validate-vendor
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+      -
+        name: Run
+        run: |
+          make ${{ matrix.target }}
+
   test:
     runs-on: ${{ matrix.os }}
     strategy:
diff --git a/Dockerfile b/Dockerfile
index 11f889c2..85845fdb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -14,11 +14,40 @@ FROM crazymax/osxcross:${OSXCROSS_VERSION} AS osxcross
 
 FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS gobase
 COPY --from=xx / /
-RUN apk add --no-cache clang file git lld llvm pkgconf
+RUN apk add --no-cache clang file git lld llvm pkgconf rsync
 ENV GOFLAGS="-mod=vendor"
 ENV CGO_ENABLED="1"
 WORKDIR /src
 
+FROM gobase AS vendored
+RUN --mount=target=/context \
+    --mount=target=.,type=tmpfs  \
+    --mount=target=/go/pkg/mod,type=cache <<EOT
+  set -e
+  rsync -a /context/. .
+  go mod tidy
+  go mod vendor
+  mkdir /out
+  cp -r go.mod go.sum vendor /out
+EOT
+
+FROM scratch AS vendor-update
+COPY --from=vendored /out /
+
+FROM vendored AS vendor-validate
+RUN --mount=type=bind,target=.,rw <<EOT
+  set -e
+  rsync -a /context/. .
+  git add -A
+  rm -rf vendor
+  cp -rf /out/* .
+  if [ -n "$(git status --porcelain -- go.mod go.sum vendor)" ]; then
+    echo >&2 'ERROR: Vendor result differs. Please vendor your package with "make vendor"'
+    git status --porcelain -- go.mod go.sum vendor
+    exit 1
+  fi
+EOT
+
 FROM gobase AS version
 ARG PKG
 RUN --mount=target=. \
diff --git a/Makefile b/Makefile
index 6eda46d3..2f29c749 100644
--- a/Makefile
+++ b/Makefile
@@ -83,3 +83,15 @@ deb:
 		.
 	docker run --rm --net=none $(BUILDIMG) tar cf - /release | tar xf -
 	docker rmi $(BUILDIMG)
+
+.PHONY: vendor
+vendor:
+	$(eval $@_TMP_OUT := $(shell mktemp -d -t docker-output.XXXXXXXXXX))
+	docker buildx bake --set "*.output=type=local,dest=$($@_TMP_OUT)" vendor
+	rm -rf ./vendor
+	cp -R "$($@_TMP_OUT)"/* .
+	rm -rf "$($@_TMP_OUT)"
+
+.PHONY: validate-vendor
+validate-vendor:
+	docker buildx bake vendor-validate
diff --git a/docker-bake.hcl b/docker-bake.hcl
index 28655855..fbe7704f 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -21,6 +21,20 @@ group "default" {
   targets = ["binaries"]
 }
 
+group "validate" {
+  targets = ["vendor-validate"]
+}
+
+target "vendor-validate" {
+  target = "vendor-validate"
+  output = ["type=cacheonly"]
+}
+
+target "vendor" {
+  target = "vendor-update"
+  output = ["."]
+}
+
 target "test" {
   inherits = ["_common"]
   target = "test-coverage"