diff --git a/.cirrus.yml b/.cirrus.yml
index 4d202ca71..7268cb410 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -86,6 +86,16 @@ build_task:
 
 validate_task:
   alias: "validate"
+  depends_on:
+    - "build"
+  cargo_cache: *ro_cargo_cache
+  targets_cache: *ro_targets_cache
+  bin_cache: *ro_bin_cache
+  setup_script: *setup
+  main_script: *main
+
+verify_vendor_task:
+  alias: "verify_vendor"
   depends_on:
     - "build"
   # From this point forward, all cache's become read-only - meaning
@@ -106,7 +116,6 @@ validate_task:
   setup_script: *setup
   main_script: *main
 
-
 unit_task:
   alias: "unit"
   depends_on:
@@ -159,6 +168,7 @@ success_task:
   depends_on:
     - "build"
     - "validate"
+    - "verify_vendor"
     - "unit"
     - "integration"
     - "meta"
diff --git a/contrib/cirrus/runner.sh b/contrib/cirrus/runner.sh
index 014855d52..ff1317674 100755
--- a/contrib/cirrus/runner.sh
+++ b/contrib/cirrus/runner.sh
@@ -28,6 +28,15 @@ _run_validate() {
     make validate
 }
 
+_run_verify_vendor() {
+   if git diff --no-ext-diff --quiet --exit-code;
+   then
+     echo No tampering with vendor...;
+   else
+     return 1;
+   fi;
+}
+
 _run_unit() {
     make unit
 }