diff --git a/.github/workflows/ensure-committed-go-generate.yaml b/.github/workflows/ensure-committed-go-generate.yaml
new file mode 100644
index 00000000..55d66543
--- /dev/null
+++ b/.github/workflows/ensure-committed-go-generate.yaml
@@ -0,0 +1,33 @@
+name: Ensure all `go generate` files are committed
+
+on:
+  pull_request:
+
+jobs:
+  generated-committed:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: 'privacy-profile-composer/go.mod'
+      - uses: arduino/setup-protoc@v3
+        with:
+          version: "25.x"
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+      - run: |
+          go mod download
+          go install google.golang.org/protobuf/cmd/protoc-gen-go
+          go install google.golang.org/grpc/cmd/protoc-gen-go-grpc
+          go generate ./...
+        working-directory: ./privacy-profile-composer
+      - run: |
+          changes=$(git status --untracked-files=no --porcelain)
+          if [[ -n "$changes" ]]; then
+            echo "=== DETECTED CHANGES ==="
+            echo "$changes"
+
+            git diff
+
+            exit 1
+          fi
diff --git a/docker/istio-proxyv2.Dockerfile b/docker/istio-proxyv2.Dockerfile
index 518c7cf7..548284ac 100644
--- a/docker/istio-proxyv2.Dockerfile
+++ b/docker/istio-proxyv2.Dockerfile
@@ -1,12 +1,10 @@
 FROM golang:1.20 as builder
 
-RUN apt-get update \
-    && apt-get install -y protobuf-compiler \
-    && go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.32.0 \
-    && go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.3.0
-
 WORKDIR /app
 
+COPY ./privacy-profile-composer/go.mod ./privacy-profile-composer/go.sum ./
+RUN go mod download
+
 COPY ./privacy-profile-composer/ ./
 RUN make build-envoy-filter
 
diff --git a/privacy-profile-composer/Makefile b/privacy-profile-composer/Makefile
index 92b236c2..09623eb0 100644
--- a/privacy-profile-composer/Makefile
+++ b/privacy-profile-composer/Makefile
@@ -1,11 +1,5 @@
-build-envoy-filter: proto
+build-envoy-filter:
 	go build -o dist/simple.so -buildmode=c-shared ./cmd/envoy-filter
 
-run-server: proto
+run-server:
 	go run ./cmd/opa-composer-server --policy_file ./pkg/opa/policy-and-logic/policy.rego
-
-proto:
-	protoc \
-		--go_out=. --go_opt=module=privacy-profile-composer \
- 		--go-grpc_out=. --go-grpc_opt=module=privacy-profile-composer \
- 		./pkg/proto/privacy_profiles.proto
diff --git a/privacy-profile-composer/pkg/proto/generator.go b/privacy-profile-composer/pkg/proto/generator.go
new file mode 100644
index 00000000..7abd08d3
--- /dev/null
+++ b/privacy-profile-composer/pkg/proto/generator.go
@@ -0,0 +1,6 @@
+//go:build generate
+// +build generate
+
+package proto
+
+//go:generate protoc --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative ./privacy_profiles.proto