diff --git a/build/dependencies.yaml b/build/dependencies.yaml
index 7edab99463c..2f0a5de394b 100644
--- a/build/dependencies.yaml
+++ b/build/dependencies.yaml
@@ -53,6 +53,13 @@ dependencies:
     - path: cluster/gce/gci/configure.sh
       match: DEFAULT_CRICTL_VERSION=
 
+  # protoc
+  - name: "protoc"
+    version: 3.19.4
+    refPaths:
+    - path: hack/lib/protoc.sh
+      match: PROTOC_VERSION=
+
   # etcd
   - name: "etcd"
     version: 3.5.6
diff --git a/hack/lib/protoc.sh b/hack/lib/protoc.sh
index 1b02310f544..e761012183f 100644
--- a/hack/lib/protoc.sh
+++ b/hack/lib/protoc.sh
@@ -22,6 +22,8 @@ set -o pipefail
 KUBE_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd -P)"
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
+PROTOC_VERSION=3.19.4
+
 # Generates $1/api.pb.go from the protobuf file $1/api.proto
 # and formats it correctly
 # $1: Full path to the directory where the api.proto file is
@@ -36,17 +38,15 @@ function kube::protoc::generate_proto() {
   kube::protoc::format "${package}"
 }
 
-# Checks that the current protoc version is at least version 3.0.0-beta1
+# Checks that the current protoc version matches the required version and
 # exit 1 if it's not the case
 function kube::protoc::check_protoc() {
-  if [[ -z "$(which protoc)" || "$(protoc --version)" != "libprotoc 3."* ]]; then
-    echo "Generating protobuf requires protoc 3.0.0-beta1 or newer. Please download and"
-    echo "install the platform appropriate Protobuf package for your OS: "
-    echo
-    echo "  https://github.com/protocolbuffers/protobuf/releases"
-    echo
-    echo "WARNING: Protobuf changes are not being validated"
-    exit 1
+  if [[ -z "$(which protoc)" || "$(protoc --version)" != "libprotoc ${PROTOC_VERSION}"* ]]; then
+    echo "Generating protobuf requires protoc ${PROTOC_VERSION}."
+    echo "Run hack/install-protoc.sh or download and install the"
+    echo "platform-appropriate Protobuf package for your OS from"
+    echo "https://github.com/protocolbuffers/protobuf/releases"
+    return 1
   fi
 }
 
diff --git a/hack/update-generated-proto-bindings-dockerized.sh b/hack/update-generated-proto-bindings-dockerized.sh
index cd5dab862cb..163143b1af4 100755
--- a/hack/update-generated-proto-bindings-dockerized.sh
+++ b/hack/update-generated-proto-bindings-dockerized.sh
@@ -22,6 +22,7 @@ set -o pipefail
 
 KUBE_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../" && pwd -P)"
 
+source "${KUBE_ROOT}/hack/lib/init.sh"
 source "${KUBE_ROOT}/hack/lib/protoc.sh"
 source "${KUBE_ROOT}/hack/lib/util.sh"
 
@@ -30,6 +31,8 @@ if [ "$#" == 0 ]; then
     exit 1
 fi
 
+kube::protoc::check_protoc
+
 for api; do
     # This can't use `git ls-files` because it runs in a container without the
     # .git dir synced.
diff --git a/hack/update-generated-protobuf-dockerized.sh b/hack/update-generated-protobuf-dockerized.sh
index d56218165c9..64dda03ec5b 100755
--- a/hack/update-generated-protobuf-dockerized.sh
+++ b/hack/update-generated-protobuf-dockerized.sh
@@ -25,22 +25,14 @@ set -o pipefail
 
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
+source "${KUBE_ROOT}/hack/lib/protoc.sh"
 
+kube::protoc::check_protoc
 kube::golang::setup_env
 
 GO111MODULE=on GOPROXY=off go install k8s.io/code-generator/cmd/go-to-protobuf
 GO111MODULE=on GOPROXY=off go install k8s.io/code-generator/cmd/go-to-protobuf/protoc-gen-gogo
 
-if [[ -z "$(which protoc)" || "$(protoc --version)" != "libprotoc 3."* ]]; then
-  echo "Generating protobuf requires protoc 3.0.0-beta1 or newer. Please download and"
-  echo "install the platform appropriate Protobuf package for your OS: "
-  echo
-  echo "  https://github.com/protocolbuffers/protobuf/releases"
-  echo
-  echo "WARNING: Protobuf changes are not being validated"
-  exit 1
-fi
-
 gotoprotobuf=$(kube::util::find-binary "go-to-protobuf")
 
 # requires the 'proto' tag to build (will remove when ready)