diff --git a/.github/workflows/buildifier.yaml b/.github/workflows/buildifier.yaml
new file mode 100644
index 0000000..6072277
--- /dev/null
+++ b/.github/workflows/buildifier.yaml
@@ -0,0 +1,20 @@
+name: Buildifier
+
+# Controls when the action will run.
+on:
+  # Triggers the workflow on push or pull request events but only for the main branch
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: buildifier
+        run: bazel run --enable_bzlmod //:buildifier.check
diff --git a/BUILD.bazel b/BUILD.bazel
index 6de2045..ae42c72 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -1,6 +1,7 @@
 load("@aspect_bazel_lib_host//:defs.bzl", "host")
 load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
 load("@bazel_gazelle//:def.bzl", "DEFAULT_LANGUAGES", "gazelle", "gazelle_binary")
+load("@buildifier_prebuilt//:rules.bzl", "buildifier")
 load("//lib:write_source_files.bzl", "write_source_files")
 load("//lib:yq.bzl", "yq")
 load("//lib:diff_test.bzl", "diff_test")
@@ -33,6 +34,15 @@ gazelle(
     command = "update-repos",
 )
 
+buildifier(
+    name = "buildifier.check",
+    exclude_patterns = [
+        "./.git/*",
+    ],
+    lint_mode = "warn",
+    mode = "diff",
+)
+
 bzl_library(
     name = "internal_deps",
     srcs = ["internal_deps.bzl"],
diff --git a/MODULE.bazel b/MODULE.bazel
index b1cd193..882a6e2 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -28,3 +28,4 @@ register_toolchains(
 # Development-only dependencies
 
 bazel_dep(name = "bazel_skylib_gazelle_plugin", version = "1.4.1", dev_dependency = True)
+bazel_dep(name = "buildifier_prebuilt", version = "6.0.0.1", dev_dependency = True)
diff --git a/WORKSPACE b/WORKSPACE
index 24f8fb2..51e38fc 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -46,3 +46,12 @@ go_rules_dependencies()
 go_register_toolchains(version = "1.18.3")
 
 gazelle_dependencies()
+
+# Buildifier
+load("@buildifier_prebuilt//:deps.bzl", "buildifier_prebuilt_deps")
+
+buildifier_prebuilt_deps()
+
+load("@buildifier_prebuilt//:defs.bzl", "buildifier_prebuilt_register_toolchains")
+
+buildifier_prebuilt_register_toolchains()
diff --git a/internal_deps.bzl b/internal_deps.bzl
index b246588..4085627 100644
--- a/internal_deps.bzl
+++ b/internal_deps.bzl
@@ -53,6 +53,15 @@ def bazel_lib_internal_deps():
         ],
     )
 
+    http_archive(
+        name = "buildifier_prebuilt",
+        sha256 = "e46c16180bc49487bfd0f1ffa7345364718c57334fa0b5b67cb5f27eba10f309",
+        strip_prefix = "buildifier-prebuilt-6.1.0",
+        urls = [
+            "https://github.com/keith/buildifier-prebuilt/archive/6.1.0.tar.gz",
+        ],
+    )
+
     # Register toolchains for tests
     register_jq_toolchains()
     register_yq_toolchains()