diff --git a/Makefile b/Makefile
index 1b7625e4..f3489602 100644
--- a/Makefile
+++ b/Makefile
@@ -15,7 +15,7 @@ include tools/tools.mk
 
 cross: bin/macadam-darwin-amd64 bin/macadam-darwin-arm64 bin/macadam-linux-amd64 bin/macadam-linux-arm64 bin/macadam-windows-amd64
 
-check: lint test
+check: lint vendorcheck test
 
 test: build
 	@go test -v ./pkg/...
@@ -52,6 +52,15 @@ bin/macadam-windows-amd64: force-build
 lint: $(TOOLS_BINDIR)/golangci-lint
 	@"$(TOOLS_BINDIR)"/golangci-lint run
 
+.PHONY: vendor
+vendor:
+	go mod tidy
+	go mod vendor
+
+.PHONY: vendorcheck
+vendorcheck:
+	./build-scripts/verify-vendor.sh
+
 # the go compiler is doing a good job at not rebuilding unchanged files
 # this phony target ensures bin/macadam-* are always considered out of date
 # and rebuilt. If the code was unchanged, go won't rebuild anything so that's
diff --git a/build-scripts/verify-vendor.sh b/build-scripts/verify-vendor.sh
new file mode 100755
index 00000000..df07d6e5
--- /dev/null
+++ b/build-scripts/verify-vendor.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+if [[ -n $(git status -s vendor/) ]]; then
+        echo 'vendor/ directory has uncommitted changes, please check `git status vendor`'
+        exit 1
+fi
+
+make vendor
+
+go mod verify
+
+echo "Diffing $(pwd)"
+git diff --exit-code vendor go.mod go.sum
+
+if [[ $? -eq 0 ]]
+then
+  echo "$(pwd) is up to date."
+else
+  echo "$(pwd) is out of date. Please run make vendor"
+  exit 1
+fi