diff --git a/.circleci/Makefile b/.circleci/Makefile
index db2b3d7581..6d27afccb6 100644
--- a/.circleci/Makefile
+++ b/.circleci/Makefile
@@ -1,36 +1,66 @@
-.PHONY: default
-default: ci-config
+SHELL       := /usr/bin/env bash
+.SHELLFLAGS := -euo pipefail -c
 
-.PHONY: check-circleci-installed
-check-circleci-installed:
-	@command -v circleci > /dev/null 2>&1 || { \
-		echo "Please install circleci-cli, see https://circleci.com/docs/2.0/local-cli/#installation"; \
-		exit 1; }
+# CONFIG is the name of the make target someone
+# would invoke to update the main config file (config.yml).
+CONFIG ?= ci-config
+# VERIFY is the name of the make target someone
+# would invoke to verify the config file.
+VERIFY ?= ci-verify
 
-.PHONY: ci-config
-# ci-config is just an alias for config.yml for now
-ci-config: config.yml
+CIRCLECI := circleci --skip-update-check
 
-CONFIG_SOURCE_DIR := config/
-CONFIG_SOURCE     := $(shell find config/) Makefile
-OUT               := config.yml
-TMP               := .tmp/config.yml.tmp
-CONFIG_21         := .tmp/config.2.1.tmp
+CCI_INSTALL_LINK := https://circleci.com/docs/2.0/local-cli/\#installation
+CCI_INSTALL_MSG := Please install CircleCI CLI. See $(CCI_INSTALL_LINK)
+CCI_VERSION := $(shell $(CIRCLECI) version 2> /dev/null)
+ifeq ($(CCI_VERSION),)
+# Attempting to use the CLI fails with installation instructions.
+CIRCLECI := echo '$(CCI_INSTALL_MSG)'; exit 1; \#
+endif
 
-# Ensure the .tmp dir exists.
+SOURCE_DIR     := config
+SOURCE_YML     := $(shell [ ! -d $(SOURCE_DIR) ] || find $(SOURCE_DIR) -name '*.yml')
+CONFIG_SOURCE  := Makefile $(SOURCE_YML) | $(SOURCE_DIR)
+OUT            := config.yml
+TMP            := .tmp/config-processed
+CONFIG_PACKED  := .tmp/config-packed
+
+default: help
+
+help:
+	@echo "Usage:"
+	@echo "  make $(CONFIG): recompile config.yml from $(SOURCE_DIR)/"
+	@echo "  make $(VERIFY): verify that config.yml is a true mapping from $(SOURCE_DIR)/"
+	@echo
+	@echo "Diagnostics:"
+	@[ -z "$(CCI_VERSION)" ] || echo "  circleci-cli version $(CCI_VERSION)"
+	@[ -n "$(CCI_VERSION)" ] || echo "  $(CCI_INSTALL_MSG)"
+
+$(SOURCE_DIR):
+	@echo Source directory $(SOURCE_DIR)/ not found.; exit 1
+
+# Make sure our .tmp dir exists.
 $(shell [ -d .tmp ] || mkdir .tmp)
 
+.PHONY: $(CONFIG)
+$(CONFIG): $(OUT)
+
+.PHONY: $(VERIFY)
+$(VERIFY): config-up-to-date
+	@$(CIRCLECI) config validate $(OUT)
+
+GENERATED_FILE_HEADER := \#\#\# Generated by 'make $(CONFIG)' do not manually edit this file. 
 define GEN_CONFIG
-	@circleci config pack $(CONFIG_SOURCE_DIR) > $(CONFIG_21)
-	@echo "### Generated by 'make ci-config' do not manually edit this file." > $@
-	@circleci config process $(CONFIG_21) >> $@
+	@$(CIRCLECI) config pack $(SOURCE_DIR) > $(CONFIG_PACKED)
+	@echo "$(GENERATED_FILE_HEADER)" > $@
+	@$(CIRCLECI) config process $(CONFIG_PACKED) >> $@
 endef
 
-$(OUT): $(CONFIG_SOURCE) check-circleci-installed
+$(OUT): $(CONFIG_SOURCE) 
 	$(GEN_CONFIG)
 	@echo "$@ updated"
 
-$(TMP): $(CONFIG_SOURCE) check-circleci-installed
+$(TMP): $(CONFIG_SOURCE) 
 	$(GEN_CONFIG)
 
 .PHONY: config-up-to-date
@@ -38,10 +68,6 @@ config-up-to-date: $(TMP) # Note this must not depend on $(OUT)!
 	@if diff config.yml $<; then \
 		echo "Generated $(OUT) is up to date!"; \
 	else \
-		echo "Generated $(OUT) is out of date, run make ci-config to update."; \
+		echo "Generated $(OUT) is out of date, run make $(CONFIG) to update."; \
 		exit 1; \
 	fi
-
-.PHONY: ci-verify
-ci-verify: config-up-to-date
-	@circleci config validate config.yml
diff --git a/.circleci/config.yml b/.circleci/config.yml
index 6cceda575f..d68832ddec 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -1,6 +1,35 @@
-### Generated by 'make ci-config' do not manually edit this file.
+### Generated by 'make ci-config' do not manually edit this file. 
 version: 2
 jobs:
+  pre-flight-checks:
+    docker:
+    - image: circleci/buildpack-deps
+    environment:
+    - CCI_VERSION: 0.1.5691
+    shell: /usr/bin/env bash -euo pipefail
+    steps:
+    - checkout
+    - run:
+        command: |
+          export CCI_PATH=/tmp/circleci-cli/$CCI_VERSION
+          mkdir -p $CCI_PATH
+          NAME=circleci-cli_${CCI_VERSION}_${ARCH}
+          URL=$BASE/v${CCI_VERSION}/${NAME}.tar.gz
+          curl -sSL $URL \
+            | tar --overwrite --strip-components=1 -xz -C $CCI_PATH "${NAME}/circleci"
+          # Add circleci to the path for subsequent steps.
+          echo "export PATH=$CCI_PATH:\$PATH" >> $BASH_ENV
+          # Done, print some debug info.
+          set -x
+          . $BASH_ENV
+          which circleci
+          circleci version
+        environment:
+          ARCH: linux_amd64
+          BASE: https://github.com/CircleCI-Public/circleci-cli/releases/download
+        name: Install CircleCI CLI
+    - run:
+        command: make ci-verify
   install-ui-dependencies:
     docker:
     - image: node:10-stretch
@@ -250,8 +279,13 @@ jobs:
 workflows:
   ci:
     jobs:
-    - install-ui-dependencies
-    - go-mod-download
+    - pre-flight-checks
+    - install-ui-dependencies:
+        requires:
+        - pre-flight-checks
+    - go-mod-download:
+        requires:
+        - pre-flight-checks
     - build-go-dev:
         requires:
         - go-mod-download
@@ -413,6 +447,35 @@ workflows:
 #           npm rebuild node-sass
 #         name: Install UI dependencies
 #     - save_yarn_cache
+#   pre-flight-checks:
+#     description: Ensures nothing obvious is broken for faster failures.
+#     docker:
+#     - image: circleci/buildpack-deps
+#     environment:
+#       CCI_VERSION: 0.1.5691
+#     shell: /usr/bin/env bash -euo pipefail
+#     steps:
+#     - checkout
+#     - run:
+#         command: |
+#           export CCI_PATH=/tmp/circleci-cli/$CCI_VERSION
+#           mkdir -p $CCI_PATH
+#           NAME=circleci-cli_${CCI_VERSION}_${ARCH}
+#           URL=$BASE/v${CCI_VERSION}/${NAME}.tar.gz
+#           curl -sSL $URL \\
+#             | tar --overwrite --strip-components=1 -xz -C $CCI_PATH \"${NAME}/circleci\"
+#           # Add circleci to the path for subsequent steps.
+#           echo \"export PATH=$CCI_PATH:\\$PATH\" >> $BASH_ENV
+#           # Done, print some debug info.
+#           set -x
+#           . $BASH_ENV
+#           which circleci
+#           circleci version
+#         environment:
+#           ARCH: linux_amd64
+#           BASE: https://github.com/CircleCI-Public/circleci-cli/releases/download
+#         name: Install CircleCI CLI
+#     - run: make ci-verify
 #   test-go:
 #     executor: go-machine
 #     parallelism: 2
@@ -494,8 +557,13 @@ workflows:
 # workflows:
 #   ci:
 #     jobs:
-#     - install-ui-dependencies
-#     - go-mod-download
+#     - pre-flight-checks
+#     - install-ui-dependencies:
+#         requires:
+#         - pre-flight-checks
+#     - go-mod-download:
+#         requires:
+#         - pre-flight-checks
 #     - build-go-dev:
 #         requires:
 #         - go-mod-download
diff --git a/.circleci/config/jobs/pre-flight-checks.yml b/.circleci/config/jobs/pre-flight-checks.yml
new file mode 100644
index 0000000000..bbb44b092e
--- /dev/null
+++ b/.circleci/config/jobs/pre-flight-checks.yml
@@ -0,0 +1,28 @@
+description: Ensures nothing obvious is broken for faster failures.
+docker:
+  - image: circleci/buildpack-deps
+shell: /usr/bin/env bash -euo pipefail
+environment:
+  CCI_VERSION: 0.1.5691
+steps:
+  - checkout
+  - run:
+      name: Install CircleCI CLI
+      environment:
+        ARCH: linux_amd64
+        BASE: https://github.com/CircleCI-Public/circleci-cli/releases/download
+      command: |
+        export CCI_PATH=/tmp/circleci-cli/$CCI_VERSION
+        mkdir -p $CCI_PATH
+        NAME=circleci-cli_${CCI_VERSION}_${ARCH}
+        URL=$BASE/v${CCI_VERSION}/${NAME}.tar.gz
+        curl -sSL $URL \
+          | tar --overwrite --strip-components=1 -xz -C $CCI_PATH "${NAME}/circleci"
+        # Add circleci to the path for subsequent steps.
+        echo "export PATH=$CCI_PATH:\$PATH" >> $BASH_ENV
+        # Done, print some debug info.
+        set -x
+        . $BASH_ENV
+        which circleci
+        circleci version
+  - run: make ci-verify
diff --git a/.circleci/config/workflows/ci.yml b/.circleci/config/workflows/ci.yml
index dda98aea45..2d4f65f2f5 100644
--- a/.circleci/config/workflows/ci.yml
+++ b/.circleci/config/workflows/ci.yml
@@ -1,6 +1,11 @@
 jobs:
-  - install-ui-dependencies
-  - go-mod-download
+  - pre-flight-checks
+  - install-ui-dependencies:
+      requires:
+        - pre-flight-checks
+  - go-mod-download:
+      requires:
+        - pre-flight-checks
   - build-go-dev:
       requires:
         - go-mod-download
diff --git a/Makefile b/Makefile
index a2efea43e7..f605c8191f 100644
--- a/Makefile
+++ b/Makefile
@@ -106,8 +106,10 @@ prep: fmtcheck
 	@[ ! -d .git/hooks ] || grep -l '^# husky$$' .git/hooks/* | xargs rm -f
 	@if [ -d .git/hooks ]; then cp .hooks/* .git/hooks/; fi
 
+.PHONY: ci-config
 ci-config:
-	@$(MAKE) -C .circleci
+	@$(MAKE) -C .circleci ci-config
+.PHONY: ci-verify
 ci-verify:
 	@$(MAKE) -C .circleci ci-verify