diff --git a/.github/workflows/check-generated.yml b/.github/workflows/check-generated.yml
index 1d43b6fe5..d8c1a79f7 100644
--- a/.github/workflows/check-generated.yml
+++ b/.github/workflows/check-generated.yml
@@ -25,6 +25,9 @@ jobs:
       - name: "Check generated mocks"
         run: |
           set -euo pipefail
+
+          readonly MOCKERY=2.12.3  # N.B. no leading "v"
+          curl -sL "https://github.com/vektra/mockery/releases/download/v${MOCKERY}/mockery_${MOCKERY}_Linux_x86_64.tar.gz" | tar -C /usr/local/bin -xzf -
           make mockery 2>/dev/null
 
           if ! git diff --stat --exit-code ; then
diff --git a/scripts/mockery_generate.sh b/scripts/mockery_generate.sh
index 382c277bb..2d6f40e63 100755
--- a/scripts/mockery_generate.sh
+++ b/scripts/mockery_generate.sh
@@ -1,3 +1,15 @@
 #!/bin/sh
+#
+# Invoke Mockery v2 to update generated mocks for the given type.
+#
+# This script runs a locally-installed "mockery" if available, otherwise it
+# runs the published Docker container. This legerdemain is so that the CI build
+# and a local build can work off the same script.
+#
+if ! which mockery ; then
+  mockery() {
+    docker run --rm -v "$PWD":/w --workdir=/w vektra/mockery:v2.12.3
+  }
+fi
 
-go run github.com/vektra/mockery/v2 --disable-version-string --case underscore --name $*
+mockery --disable-version-string --case underscore --name "$@"