diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index ec680691..83b5f8c0 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -19,6 +19,7 @@ jobs:
       matrix:
         target:
           - validate-license
+          - validate-vendor
     steps:
       -
         name: Checkout
diff --git a/Makefile b/Makefile
index 9b7607eb..ca550030 100644
--- a/Makefile
+++ b/Makefile
@@ -1,9 +1,18 @@
-.PHONY: all dev examples
-
+.PHONY: all
 all:
 
+.PHONY: dev
 dev:
 	IMAGE_LOCAL=$(IMAGE) docker buildx bake --push
 
+.PHONY: examples
 examples:
 	./hack/check-example.sh $(IMAGE) ./examples/*
+
+.PHONY: vendor
+vendor:
+	$(eval $@_TMP_OUT := $(shell mktemp -d -t buildkit-output.XXXXXXXXXX))
+	docker buildx bake --set "*.output=type=local,dest=$($@_TMP_OUT)" update-vendor
+	rm -rf ./vendor
+	cp -R "$($@_TMP_OUT)"/out/* .
+	rm -rf "$($@_TMP_OUT)"/
diff --git a/docker-bake.hcl b/docker-bake.hcl
index c12d2500..6598d70a 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -73,3 +73,17 @@ target "update-license" {
   target = "update"
   output = ["."]
 }
+
+target "validate-vendor" {
+  inherits = ["_common"]
+  dockerfile = "./hack/dockerfiles/vendor.Dockerfile"
+  target = "validate"
+  output = ["type=cacheonly"]
+}
+
+target "update-vendor" {
+  inherits = ["_common"]
+  dockerfile = "./hack/dockerfiles/vendor.Dockerfile"
+  target = "update"
+  output = ["."]
+}
\ No newline at end of file
diff --git a/hack/dockerfiles/vendor.Dockerfile b/hack/dockerfiles/vendor.Dockerfile
new file mode 100644
index 00000000..a72228b6
--- /dev/null
+++ b/hack/dockerfiles/vendor.Dockerfile
@@ -0,0 +1,53 @@
+# syntax=docker/dockerfile:1
+
+# Copyright 2022 buildkit authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# upstream at https://github.com/moby/buildkit/blob/master/hack/dockerfiles/vendor.Dockerfile
+
+ARG GO_VERSION=1.20
+
+FROM golang:${GO_VERSION}-alpine AS base
+RUN apk add --no-cache git rsync
+WORKDIR /src
+
+FROM base AS vendored
+RUN --mount=target=/context \
+    --mount=target=.,type=tmpfs  \
+    --mount=target=/go/pkg/mod,type=cache <<EOT
+  set -e
+  rsync -a /context/. .
+  go mod tidy
+  go mod vendor
+  mkdir /out
+  cp -r go.mod go.sum vendor /out
+EOT
+
+FROM scratch AS update
+COPY --from=vendored /out /out
+
+FROM vendored AS validate
+RUN --mount=target=/context \
+    --mount=target=.,type=tmpfs <<EOT
+  set -e
+  rsync -a /context/. .
+  git add -A
+  rm -rf vendor
+  cp -rf /out/* .
+  if [ -n "$(git status --porcelain -- go.mod go.sum vendor)" ]; then
+    echo >&2 'ERROR: Vendor result differs. Please vendor your package with "make vendor"'
+    git status --porcelain -- go.mod go.sum vendor
+    exit 1
+  fi
+EOT