diff --git a/.github/scripts/check-vendor-hash.sh b/.github/scripts/check-vendor-hash.sh
new file mode 100755
index 0000000..e69743e
--- /dev/null
+++ b/.github/scripts/check-vendor-hash.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+CURRENT_HASH=$(grep -oP '(?<=vendorHash = ")[^"]+' flake.nix)
+
+go mod vendor
+
+COMPUTED_HASH=$(nix hash path vendor/)
+
+rm -rf vendor/
+
+if [ "$CURRENT_HASH" = "$COMPUTED_HASH" ]; then
+  echo "vendorHash is up to date"
+  exit 0
+fi
+
+echo "Updating vendorHash in flake.nix..."
+python3 -c "
+import sys
+with open('flake.nix', 'r') as f:
+    content = f.read()
+content = content.replace('$CURRENT_HASH', '$COMPUTED_HASH')
+with open('flake.nix', 'w') as f:
+    f.write(content)
+"
+echo "  Old: $CURRENT_HASH"
+echo "  New: $COMPUTED_HASH"
diff --git a/lefthook.yml b/lefthook.yml
index bd90c6a..c992a3f 100644
--- a/lefthook.yml
+++ b/lefthook.yml
@@ -1,6 +1,10 @@
 pre-commit:
   piped: true
   commands:
+    check-vendor-hash:
+      glob: "{go.mod,go.sum}"
+      run: .github/scripts/check-vendor-hash.sh
+      stage_fixed: true
     inject-exec-basics:
       glob: "{docs/basics.md,cmd/**}"
       run: python3 .github/scripts/inject-exec.py docs/basics.md