diff --git a/Makefile b/Makefile
index 05078f428f..3a5d9a4d7c 100644
--- a/Makefile
+++ b/Makefile
@@ -15,6 +15,7 @@ GOFMT_FILES?=$$(find . -name '*.go' | grep -v pb.go | grep -v vendor)
 
 
 GO_VERSION_MIN=1.19.1
+PROTOC_VERSION_MIN=3.21.5
 GO_CMD?=go
 CGO_ENABLED?=0
 ifneq ($(FDB_ENABLED), )
@@ -170,6 +171,7 @@ static-dist: ember-dist
 static-dist-dev: ember-dist-dev
 
 proto: bootstrap
+	@sh -c "'$(CURDIR)/scripts/protocversioncheck.sh' '$(PROTOC_VERSION_MIN)'"
 	protoc --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative vault/*.proto
 	protoc --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative vault/activity/activity_log.proto
 	protoc --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative helper/storagepacker/types.proto
diff --git a/scripts/protocversioncheck.sh b/scripts/protocversioncheck.sh
new file mode 100755
index 0000000000..4b08167480
--- /dev/null
+++ b/scripts/protocversioncheck.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+PROTOC_CMD=${PROTOC_CMD:-protoc}
+PROTOC_VERSION_EXACT="$1"
+echo "==> Checking that protoc is at version $1..."
+
+PROTOC_VERSION=$($PROTOC_CMD --version | grep -o '[0-9]\+\.[0-9]\+\.[0-9]\+')
+
+if [ "$PROTOC_VERSION" == "$PROTOC_VERSION_EXACT" ]; then
+  echo "Using protoc version $PROTOC_VERSION"
+else
+  echo "protoc should be at $PROTOC_VERSION_EXACT; found $PROTOC_VERSION."
+  echo "If your version is higher than the version this script is looking for, updating the Makefile with the newer version."
+  exit 1
+fi