diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 76ea30ed..4c705c94 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -15,6 +15,17 @@ jobs:
           path: "/home/runner/.cache/bazel"
           key: bazel
 
+      - name: Gazelle
+        run: |
+          bazel run //:gazelle-update-repos
+          bazel run //:gazelle_check
+          if git diff --exit-code snapshots/dependencies.bzl ; then
+              echo "Gazelle repos are up to date."
+          else
+              echo "Gazelle repos aren't up to date. Run 'bazel run //:gazelle-update-repos' locally, and commit the changes."
+              exit 1
+          fi
+
       - name: Build
         run: |
           bazel build //...
diff --git a/BUILD.bazel b/BUILD.bazel
index 0e06f769..1bf79997 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -4,6 +4,16 @@ load("@bazel_gazelle//:def.bzl", "gazelle")
 # gazelle:proto disable_global
 gazelle(name = "gazelle")
 
+# Gazelle check: exits with 1 if gazelle wants to make changes.
+#
+# Usage:
+#   bazel run gazelle_check
+gazelle(
+    name = "gazelle_check",
+    command = "update",
+    extra_args = ["-mode=diff"],
+)
+
 gazelle(
     name = "gazelle-update-repos",
     args = [