diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index b9ef84291738..77dc4246617a 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -20,16 +20,28 @@ env:
   SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
 
 jobs:
+  prepare:
+    runs-on: ubuntu-20.04
+    outputs:
+      targets: ${{ steps.targets.outputs.matrix }}
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v3
+      -
+        name: Matrix
+        id: targets
+        run: |
+          echo "matrix=$(docker buildx bake validate --print | jq -cr '.group.validate.targets')" >> $GITHUB_OUTPUT
+
   validate:
     runs-on: ubuntu-20.04
+    needs:
+      - prepare
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - script: ./hack/lint
-          - script: ./hack/validate-vendor
-          - script: ./hack/validate-generated-files
-          - script: ./hack/validate-shfmt
+        target: ${{ fromJson(needs.prepare.outputs.targets) }}
     steps:
       -
         name: Checkout
@@ -42,6 +54,7 @@ jobs:
           driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
           buildkitd-flags: --debug
       -
-        name: Run
-        run: |
-          ${{ matrix.script }}
+        name: Validate
+        uses: docker/bake-action@v2
+        with:
+          targets: ${{ matrix.target }}
diff --git a/Makefile b/Makefile
index 813fcdf0e2e0..d2697fbbf2fc 100644
--- a/Makefile
+++ b/Makefile
@@ -1,46 +1,78 @@
 prefix=/usr/local
 bindir=$(prefix)/bin
 
-binaries: FORCE
+export BUILDX_CMD ?= docker buildx
+
+.PHONY: binaries
+binaries:
 	hack/binaries
 
-images: FORCE
+.PHONY: images
+images:
 # moby/buildkit:local and moby/buildkit:local-rootless are created on Docker
 	hack/images local moby/buildkit
 	TARGET=rootless hack/images local moby/buildkit
 
-install: FORCE
+.PHONY: install
+install:
 	mkdir -p $(DESTDIR)$(bindir)
 	install bin/* $(DESTDIR)$(bindir)
 
-clean: FORCE
+.PHONY: clean
+clean:
 	rm -rf ./bin
 
+.PHONY: test
 test:
 	./hack/test integration gateway dockerfile
 
+.PHONY: lint
 lint:
-	./hack/lint
+	$(BUILDX_CMD) bake lint
 
+.PHONY: validate-vendor
 validate-vendor:
-	./hack/validate-vendor
+	$(BUILDX_CMD) bake validate-vendor
 
+.PHONY: validate-shfmt
 validate-shfmt:
-	./hack/validate-shfmt
+	$(BUILDX_CMD) bake validate-shfmt
 
+.PHONY: shfmt
 shfmt:
-	./hack/shfmt
+	$(BUILDX_CMD) bake shfmt
+
+.PHONY: validate-authors
+validate-authors:
+	$(BUILDX_CMD) bake validate-authors
 
+.PHONY: validate-generated-files
 validate-generated-files:
-	./hack/validate-generated-files
+	$(BUILDX_CMD) bake validate-generated-files
 
-validate-all: test lint validate-vendor validate-generated-files
+.PHONY: validate-doctoc
+validate-doctoc:
+	$(BUILDX_CMD) bake validate-doctoc
 
+.PHONY: validate-all
+validate-all: test lint validate-vendor validate-generated-files validate-doctoc
+
+.PHONY: vendor
 vendor:
-	./hack/update-vendor
+	$(eval $@_TMP_OUT := $(shell mktemp -d -t buildkit-output.XXXXXXXXXX))
+	$(BUILDX_CMD) bake --set "*.output=type=local,dest=$($@_TMP_OUT)" vendor
+	rm -rf ./vendor
+	cp -R "$($@_TMP_OUT)"/out/* .
+	rm -rf "$($@_TMP_OUT)"/
 
+.PHONY: generated-files
 generated-files:
-	./hack/update-generated-files
+	$(BUILDX_CMD) bake generated-files
+
+.PHONY: authors
+authors:
+	$(BUILDX_CMD) bake authors
 
-.PHONY: vendor generated-files test binaries images install clean lint validate-all validate-vendor validate-generated-files
-FORCE:
+.PHONY: doctoc
+doctoc:
+	$(BUILDX_CMD) bake doctoc
diff --git a/docker-bake.hcl b/docker-bake.hcl
new file mode 100644
index 000000000000..8d70ec83a273
--- /dev/null
+++ b/docker-bake.hcl
@@ -0,0 +1,100 @@
+variable "ALPINE_VERSION" {
+  default = null
+}
+
+variable "GO_VERSION" {
+  default = null
+}
+
+variable "NODE_VERSION" {
+  default = null
+}
+
+target "_common" {
+  args = {
+    ALPINE_VERSION = ALPINE_VERSION
+    GO_VERSION = GO_VERSION
+    NODE_VERSION = NODE_VERSION
+    BUILDKIT_CONTEXT_KEEP_GIT_DIR = 1
+  }
+}
+
+group "validate" {
+  targets = ["lint", "validate-vendor", "validate-doctoc", "validate-generated-files", "validate-shfmt"]
+}
+
+target "lint" {
+  inherits = ["_common"]
+  dockerfile = "./hack/dockerfiles/lint.Dockerfile"
+  output = ["type=cacheonly"]
+}
+
+target "validate-vendor" {
+  inherits = ["_common"]
+  dockerfile = "./hack/dockerfiles/vendor.Dockerfile"
+  target = "validate"
+  output = ["type=cacheonly"]
+}
+
+target "validate-generated-files" {
+  inherits = ["_common"]
+  dockerfile = "./hack/dockerfiles/generated-files.Dockerfile"
+  target = "validate"
+  output = ["type=cacheonly"]
+}
+
+target "validate-shfmt" {
+  inherits = ["_common"]
+  dockerfile = "./hack/dockerfiles/shfmt.Dockerfile"
+  target = "validate"
+  output = ["type=cacheonly"]
+}
+
+target "validate-doctoc" {
+  inherits = ["_common"]
+  dockerfile = "./hack/dockerfiles/doctoc.Dockerfile"
+  target = "validate-toc"
+  output = ["type=cacheonly"]
+}
+
+target "validate-authors" {
+  inherits = ["_common"]
+  dockerfile = "./hack/dockerfiles/authors.Dockerfile"
+  target = "validate"
+  output = ["type=cacheonly"]
+}
+
+target "vendor" {
+  inherits = ["_common"]
+  dockerfile = "./hack/dockerfiles/vendor.Dockerfile"
+  target = "update"
+  output = ["."]
+}
+
+target "generated-files" {
+  inherits = ["_common"]
+  dockerfile = "./hack/dockerfiles/generated-files.Dockerfile"
+  target = "update"
+  output = ["."]
+}
+
+target "shfmt" {
+  inherits = ["_common"]
+  dockerfile = "./hack/dockerfiles/shfmt.Dockerfile"
+  target = "update"
+  output = ["."]
+}
+
+target "doctoc" {
+  inherits = ["_common"]
+  dockerfile = "./hack/dockerfiles/doctoc.Dockerfile"
+  target = "update"
+  output = ["."]
+}
+
+target "authors" {
+  inherits = ["_common"]
+  dockerfile = "./hack/dockerfiles/authors.Dockerfile"
+  target = "update"
+  output = ["."]
+}
diff --git a/hack/dockerfiles/authors.Dockerfile b/hack/dockerfiles/authors.Dockerfile
new file mode 100644
index 000000000000..1ffbe1250aea
--- /dev/null
+++ b/hack/dockerfiles/authors.Dockerfile
@@ -0,0 +1,34 @@
+# syntax=docker/dockerfile-upstream:master
+
+ARG ALPINE_VERSION=3.17
+
+FROM alpine:${ALPINE_VERSION} AS gen
+RUN apk add --no-cache git
+WORKDIR /src
+RUN --mount=type=bind,target=. <<EOT
+  set -e
+  mkdir /out
+  # see also ".mailmap" for how email addresses and names are deduplicated
+  {
+    echo "# This file lists all individuals having contributed content to the repository."
+    echo "# For how it is generated, see hack/dockerfiles/authors.Dockerfile."
+    echo
+    git log --format='%aN <%aE>' | LC_ALL=C.UTF-8 sort -uf
+  } > /out/AUTHORS
+  cat /out/AUTHORS
+EOT
+
+FROM scratch AS update
+COPY --from=gen /out /
+
+FROM gen AS validate
+RUN --mount=type=bind,target=.,rw <<EOT
+  set -e
+  git add -A
+  cp -rf /out/* .
+  if [ -n "$(git status --porcelain -- AUTHORS)" ]; then
+    echo >&2 'ERROR: Authors result differs. Please update with "make authors"'
+    git status --porcelain -- AUTHORS
+    exit 1
+  fi
+EOT
diff --git a/hack/dockerfiles/doctoc.Dockerfile b/hack/dockerfiles/doctoc.Dockerfile
new file mode 100644
index 000000000000..474017e6f372
--- /dev/null
+++ b/hack/dockerfiles/doctoc.Dockerfile
@@ -0,0 +1,31 @@
+# syntax=docker/dockerfile-upstream:master
+
+ARG NODE_VERSION=19
+
+FROM node:${NODE_VERSION}-alpine AS base
+RUN apk add --no-cache git
+WORKDIR /src
+
+FROM base AS doctoc
+RUN npm install -g doctoc
+RUN --mount=type=bind,source=README.md,target=README.md,rw <<EOT
+  set -e
+  doctoc README.md
+  mkdir /out
+  cp README.md /out/
+EOT
+
+FROM scratch AS update
+COPY --from=doctoc /out /
+
+FROM base AS validate-toc
+RUN --mount=type=bind,target=.,rw \
+    --mount=type=bind,from=doctoc,source=/out/README.md,target=./README.md <<EOT
+  set -e
+  diff=$(git status --porcelain -- 'README.md')
+  if [ -n "$diff" ]; then
+    echo >&2 'ERROR: The result of "doctoc" differs. Please update with "make doctoc"'
+    echo "$diff"
+    exit 1
+  fi
+EOT
diff --git a/hack/dockerfiles/generated-files.Dockerfile b/hack/dockerfiles/generated-files.Dockerfile
index 57e059c34c81..346435683b2a 100644
--- a/hack/dockerfiles/generated-files.Dockerfile
+++ b/hack/dockerfiles/generated-files.Dockerfile
@@ -1,7 +1,6 @@
 # syntax=docker/dockerfile-upstream:master
 
 ARG GO_VERSION="1.20"
-ARG NODE_VERSION="19"
 ARG PROTOC_VERSION="3.11.4"
 
 # protoc is dynamically linked to glibc so can't use alpine base
@@ -54,24 +53,3 @@ RUN --mount=type=bind,target=.,rw \
     exit 1
   fi
 EOT
-
-FROM node:${NODE_VERSION}-alpine AS doctoc
-RUN npm install -g doctoc
-WORKDIR /buildkit
-RUN --mount=type=bind,target=.,rw <<EOT
-  doctoc README.md
-  mkdir /out
-  cp README.md /out/
-EOT
-
-FROM base AS validate-toc
-RUN --mount=type=bind,target=.,rw \
-    --mount=type=bind,from=doctoc,source=/out/README.md,target=./README.md <<EOT
-  set -e
-  diff=$(git status --porcelain -- 'README.md')
-  if [ -n "$diff" ]; then
-    echo >&2 'ERROR: The result of "doctoc" differs. Please update with "doctoc README.md"'
-    echo "$diff"
-    exit 1
-  fi
-EOT
diff --git a/hack/dockerfiles/shfmt.Dockerfile b/hack/dockerfiles/shfmt.Dockerfile
index fb5db637d90f..86b3e86847a6 100644
--- a/hack/dockerfiles/shfmt.Dockerfile
+++ b/hack/dockerfiles/shfmt.Dockerfile
@@ -1,4 +1,5 @@
 # syntax=docker/dockerfile-upstream:master
+
 FROM mvdan/shfmt:v3.1.2-alpine AS shfmt
 WORKDIR /src
 ARG SHFMT_FLAGS="-i 2 -ci"
diff --git a/hack/dockerfiles/vendor.Dockerfile b/hack/dockerfiles/vendor.Dockerfile
index 64006bed24f2..6f2c45e56fe5 100644
--- a/hack/dockerfiles/vendor.Dockerfile
+++ b/hack/dockerfiles/vendor.Dockerfile
@@ -2,20 +2,36 @@
 
 ARG GO_VERSION=1.20
 
-FROM golang:${GO_VERSION}-alpine AS vendored
-RUN  apk add --no-cache git
+FROM golang:${GO_VERSION}-alpine AS base
+RUN apk add --no-cache git rsync
 WORKDIR /src
-RUN --mount=target=/src,rw \
-  --mount=target=/go/pkg/mod,type=cache \
-  go mod tidy && go mod vendor && \
-  mkdir /out && cp -r go.mod go.sum vendor /out
+
+FROM base AS vendored
+RUN --mount=target=/context \
+    --mount=target=.,type=tmpfs  \
+    --mount=target=/go/pkg/mod,type=cache <<EOT
+  set -e
+  rsync -a /context/. .
+  go mod tidy
+  go mod vendor
+  mkdir /out
+  cp -r go.mod go.sum vendor /out
+EOT
 
 FROM scratch AS update
 COPY --from=vendored /out /out
 
 FROM vendored AS validate
-RUN --mount=target=.,rw \
-  git add -A && \
-  rm -rf vendor && \
-  cp -rf /out/* . && \
-  ./hack/validate-vendor check
+RUN --mount=target=/context \
+    --mount=target=.,type=tmpfs <<EOT
+  set -e
+  rsync -a /context/. .
+  git add -A
+  rm -rf vendor
+  cp -rf /out/* .
+  if [ -n "$(git status --porcelain -- go.mod go.sum vendor)" ]; then
+    echo >&2 'ERROR: Vendor result differs. Please vendor your package with "make vendor"'
+    git status --porcelain -- go.mod go.sum vendor
+    exit 1
+  fi
+EOT
diff --git a/hack/generate-authors b/hack/generate-authors
deleted file mode 100755
index 8acd3637c486..000000000000
--- a/hack/generate-authors
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/usr/bin/env bash
-
-set -eu -o pipefail -x
-
-cd "$(dirname "$(readlink -f "$BASH_SOURCE")")/.."
-
-# see also ".mailmap" for how email addresses and names are deduplicated
-
-{
-  cat <<-'EOH'
-	# This file lists all individuals having contributed content to the repository.
-	# For how it is generated, see `scripts/generate-authors.sh`.
-	EOH
-  echo
-  git log --format='%aN <%aE>' | LC_ALL=C.UTF-8 sort -uf
-} >AUTHORS
diff --git a/hack/lint b/hack/lint
deleted file mode 100755
index 647e85b68269..000000000000
--- a/hack/lint
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-
-. $(dirname $0)/util
-set -e
-
-buildxCmd build --file ./hack/dockerfiles/lint.Dockerfile .
diff --git a/hack/shfmt b/hack/shfmt
deleted file mode 100755
index 0368e680e5ee..000000000000
--- a/hack/shfmt
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-
-. $(dirname $0)/util
-set -e
-
-buildxCmd build \
-  --target "update" \
-  --output "type=local,dest=." \
-  --file "./hack/dockerfiles/shfmt.Dockerfile" \
-  .
diff --git a/hack/update-generated-files b/hack/update-generated-files
deleted file mode 100755
index d038d7d6b632..000000000000
--- a/hack/update-generated-files
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/usr/bin/env bash
-
-. $(dirname $0)/util
-set -eu
-
-output=$(mktemp -d -t buildctl-output.XXXXXXXXXX)
-
-buildxCmd build \
-  --target "update" \
-  --output "type=local,dest=$output" \
-  --file "./hack/dockerfiles/generated-files.Dockerfile" \
-  .
-
-cp -R "$output/." .
-rm -rf $output
diff --git a/hack/update-vendor b/hack/update-vendor
deleted file mode 100755
index 18dd3237c608..000000000000
--- a/hack/update-vendor
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/usr/bin/env bash
-
-. $(dirname $0)/util
-set -eu
-
-output=$(mktemp -d -t buildx-output.XXXXXXXXXX)
-
-buildxCmd build \
-  --target "update" \
-  --output "type=local,dest=$output" \
-  --file "./hack/dockerfiles/vendor.Dockerfile" \
-  .
-
-rm -rf ./vendor
-cp -R "$output"/out/* .
-rm -rf $output
diff --git a/hack/validate-generated-files b/hack/validate-generated-files
deleted file mode 100755
index a1525ec30ac2..000000000000
--- a/hack/validate-generated-files
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/usr/bin/env bash
-
-. $(dirname $0)/util
-set -eu
-
-buildxCmd build \
-  --target "validate" \
-  --output "type=cacheonly" \
-  --file "./hack/dockerfiles/generated-files.Dockerfile" \
-  .
-
-buildxCmd build \
-  --target "validate-toc" \
-  --output "type=cacheonly" \
-  --file "./hack/dockerfiles/generated-files.Dockerfile" \
-  .
diff --git a/hack/validate-shfmt b/hack/validate-shfmt
deleted file mode 100755
index a1e33f0f9548..000000000000
--- a/hack/validate-shfmt
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env sh
-
-. $(dirname $0)/util
-set -e
-
-buildxCmd build \
-  --target validate \
-  --output "type=cacheonly" \
-  --file ./hack/dockerfiles/shfmt.Dockerfile \
-  .
diff --git a/hack/validate-vendor b/hack/validate-vendor
deleted file mode 100755
index d60a6fe91ab9..000000000000
--- a/hack/validate-vendor
+++ /dev/null
@@ -1,29 +0,0 @@
-#!/usr/bin/env sh
-set -eu
-
-case ${1:-} in
-  '')
-    . $(dirname $0)/util
-    buildxCmd build \
-      --target validate \
-      --file ./hack/dockerfiles/vendor.Dockerfile \
-      .
-    ;;
-  check)
-    status="$(git status --porcelain -- go.mod go.sum vendor 2>/dev/null)"
-    diffs=$(echo "$status" | grep -v '^[RAD] ' || true)
-    if [ "$diffs" ]; then
-      {
-        set +x
-        echo 'The result of "make vendor" differs'
-        echo
-        echo "$diffs"
-        echo
-        echo 'Please vendor your package with "make vendor"'
-        echo
-      } >&2
-      exit 1
-    fi
-    echo 'Congratulations! All vendoring changes are done the right way.'
-    ;;
-esac