diff --git a/.github/workflows/protos-up-to-date.yaml b/.github/workflows/protos-up-to-date.yaml
new file mode 100644
index 00000000000..981642e2d53
--- /dev/null
+++ b/.github/workflows/protos-up-to-date.yaml
@@ -0,0 +1,30 @@
+name: Protobufs up to date
+run-name: make protos-up-to-date
+on:
+  push:
+    branches:
+      - master
+
+  # These are required for the check to run on PRs.
+  pull_request:
+  merge_group:
+
+jobs:
+  protos-up-to-date:
+    if: ${{ !startsWith(github.head_ref, 'dependabot/') }}
+    name: Protobufs up to date
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    container:
+      image: ghcr.io/gravitational/teleport-buildbox:teleport13
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Check if protobufs are up to date
+        # We have to add the current directory as a safe directory or else git commands will not work as expected.
+        run: git config --global --add safe.directory $(realpath .) && make protos-up-to-date/host
diff --git a/Makefile b/Makefile
index 29c0328632f..f17b6c596ea 100644
--- a/Makefile
+++ b/Makefile
@@ -29,6 +29,7 @@ BINDIR ?= /usr/local/bin
 DATADIR ?= /usr/local/share/teleport
 ADDFLAGS ?=
 PWD ?= `pwd`
+GIT ?= git
 TELEPORT_DEBUG ?= false
 GITTAG=v$(VERSION)
 CGOFLAG ?= CGO_ENABLED=1
@@ -1044,6 +1045,28 @@ grpc:
 grpc/host: protos/all
 	@build.assets/genproto.sh
 
+# protos-up-to-date checks if the generated GRPC stubs are up to date.
+# This target runs in the buildbox container.
+.PHONY: protos-up-to-date
+protos-up-to-date:
+	$(MAKE) -C build.assets protos-up-to-date
+
+# protos-up-to-date/host checks if the generated GRPC stubs are up to date.
+# Unlike protos-up-to-date, this target runs locally.
+.PHONY: protos-up-to-date/host
+protos-up-to-date/host: must-start-clean/host grpc/host
+	@if ! $(GIT) diff --quiet; then \
+		echo 'Please run make grpc.'; \
+		exit 1; \
+	fi
+
+.PHONY: must-start-clean/host
+must-start-clean/host:
+	@if ! $(GIT) diff --quiet; then \
+		echo 'This must be run from a repo with no unstaged commits.'; \
+		exit 1; \
+	fi
+
 print/env:
 	env
 
diff --git a/build.assets/Makefile b/build.assets/Makefile
index 644826a06f3..d908dda2403 100644
--- a/build.assets/Makefile
+++ b/build.assets/Makefile
@@ -247,6 +247,13 @@ grpc: buildbox
 		$(DOCKERFLAGS) -t $(BUILDBOX) \
 		make -C /go/src/github.com/gravitational/teleport grpc/host
 
+# protos-up-to-date checks if GRPC stubs are up to date from inside the buildbox
+.PHONY: protos-up-to-date
+protos-up-to-date: buildbox
+	docker run \
+		$(DOCKERFLAGS) -t $(BUILDBOX) \
+		make -C /go/src/github.com/gravitational/teleport protos-up-to-date/host
+
 # fix-imports runs GCI to sort and re-order Go imports in a deterministic way.
 .PHONY: fix-imports
 fix-imports: buildbox