diff --git a/nix/bufCheck/default.nix b/nix/bufCheck/default.nix
new file mode 100644
index 000000000..6d17cb460
--- /dev/null
+++ b/nix/bufCheck/default.nix
@@ -0,0 +1,9 @@
+# Check protobuf syntax and breaking.
+#
+{ depot, pkgs, ... }:
+
+pkgs.writeShellScriptBin "ci-buf-check" ''
+  ${depot.third_party.bufbuild}/bin/buf check lint --input "${depot.depotPath}"
+  # Report-only
+  ${depot.third_party.bufbuild}/bin/buf check breaking --input "${depot.depotPath}" --against-input "${depot.depotPath}/.git#branch=canon" || true
+''
diff --git a/ops/pipelines/depot.nix b/ops/pipelines/depot.nix
index 3c9ee6b21..ad5a3faab 100644
--- a/ops/pipelines/depot.nix
+++ b/ops/pipelines/depot.nix
@@ -17,5 +17,9 @@ let
       command = "nix-build -A ciBuilds.__allTargets --show-trace";
       label = ":duck:";
     }
+    {
+      command = "${depot.nix.bufCheck}/bin/ci-buf-check";
+      label = ":water_buffalo:";
+    }
   ];
 in writeText "depot.yaml" (toJSON pipeline)