diff --git a/hack/update-generated-kms-dockerized.sh b/hack/update-generated-kms-dockerized.sh
index 82db74f6d5f..d28ab214faa 100755
--- a/hack/update-generated-kms-dockerized.sh
+++ b/hack/update-generated-kms-dockerized.sh
@@ -19,7 +19,7 @@ set -o nounset
 set -o pipefail
 
 KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
-KUBE_REMOTE_RUNTIME_ROOT="${KUBE_ROOT}/staging/src/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/v1beta1/"
+KUBE_KMS_GRPC_ROOT="${KUBE_ROOT}/staging/src/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/v1beta1/"
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
 kube::golang::setup_env
@@ -40,7 +40,7 @@ if [[ -z "$(which protoc)" || "$(protoc --version)" != "libprotoc 3."* ]]; then
 fi
 
 function cleanup {
-	rm -f ${KUBE_REMOTE_RUNTIME_ROOT}/service.pb.go.bak
+	rm -f ${KUBE_KMS_GRPC_ROOT}/service.pb.go.bak
 }
 
 trap cleanup EXIT
@@ -49,14 +49,14 @@ gogopath=$(dirname $(kube::util::find-binary "protoc-gen-gogo"))
 
 PATH="${gogopath}:${PATH}" \
   protoc \
-  --proto_path="${KUBE_REMOTE_RUNTIME_ROOT}" \
+  --proto_path="${KUBE_KMS_GRPC_ROOT}" \
   --proto_path="${KUBE_ROOT}/vendor" \
-  --gogo_out=plugins=grpc:${KUBE_REMOTE_RUNTIME_ROOT} ${KUBE_REMOTE_RUNTIME_ROOT}/service.proto
+  --gogo_out=plugins=grpc:${KUBE_KMS_GRPC_ROOT} ${KUBE_KMS_GRPC_ROOT}/service.proto
 
 # Update boilerplate for the generated file.
-echo "$(cat hack/boilerplate/boilerplate.go.txt ${KUBE_REMOTE_RUNTIME_ROOT}/service.pb.go)" > ${KUBE_REMOTE_RUNTIME_ROOT}/service.pb.go
-sed -i".bak" "s/Copyright YEAR/Copyright $(date '+%Y')/g" ${KUBE_REMOTE_RUNTIME_ROOT}/service.pb.go
+echo "$(cat hack/boilerplate/boilerplate.go.txt ${KUBE_KMS_GRPC_ROOT}/service.pb.go)" > ${KUBE_KMS_GRPC_ROOT}/service.pb.go
+sed -i".bak" "s/Copyright YEAR/Copyright $(date '+%Y')/g" ${KUBE_KMS_GRPC_ROOT}/service.pb.go
 
 # Run gofmt to clean up the generated code.
 kube::golang::verify_go_version
-gofmt -l -s -w ${KUBE_REMOTE_RUNTIME_ROOT}/service.pb.go
+gofmt -l -s -w ${KUBE_KMS_GRPC_ROOT}/service.pb.go
diff --git a/hack/verify-generated-kms.sh b/hack/verify-generated-kms.sh
new file mode 100755
index 00000000000..03738b52e04
--- /dev/null
+++ b/hack/verify-generated-kms.sh
@@ -0,0 +1,45 @@
+#!/bin/bash
+
+# Copyright 2018 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
+KUBE_KMS_GRPC_ROOT="${KUBE_ROOT}/staging/src/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/v1beta1/"
+source "${KUBE_ROOT}/hack/lib/init.sh"
+
+kube::golang::setup_env
+
+function cleanup {
+	rm -rf ${KUBE_KMS_GRPC_ROOT}/_tmp/
+}
+
+trap cleanup EXIT
+
+mkdir -p ${KUBE_KMS_GRPC_ROOT}/_tmp
+cp ${KUBE_KMS_GRPC_ROOT}/service.pb.go ${KUBE_KMS_GRPC_ROOT}/_tmp/
+
+ret=0
+KUBE_VERBOSE=3 "${KUBE_ROOT}/hack/update-generated-kms.sh"
+diff -I "gzipped FileDescriptorProto" -I "0x" -Naupr ${KUBE_KMS_GRPC_ROOT}/_tmp/service.pb.go ${KUBE_KMS_GRPC_ROOT}/service.pb.go || ret=$?
+if [[ $ret -eq 0 ]]; then
+    echo "Generated KMS gRPC is up to date."
+    cp ${KUBE_KMS_GRPC_ROOT}/_tmp/service.pb.go ${KUBE_KMS_GRPC_ROOT}/
+else
+    echo "Generated KMS gRPC is out of date. Please run hack/update-generated-kms.sh"
+    exit 1
+fi