diff --git a/.circleci/config.yml b/.circleci/config.yml
index 164c5ddb22..f4c7567d5b 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -229,7 +229,8 @@ jobs:
       - run:
           name: Install protobuf
           command: |
-            wget https://github.com/protocolbuffers/protobuf/releases/download/v3.12.3/protoc-3.12.3-linux-x86_64.zip
+            protoc_version="$(make print-PROTOC_VERSION)"
+            wget https://github.com/protocolbuffers/protobuf/releases/download/v${protoc_version}/protoc-${protoc_version}-linux-x86_64.zip
             sudo unzip -d /usr/local protoc-*.zip
             sudo chmod +x /usr/local/bin/protoc
             sudo chmod -R a+Xr /usr/local/include/google/
diff --git a/GNUmakefile b/GNUmakefile
index 4710fbbaaf..d844cb6c37 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -2,6 +2,7 @@
 # https://www.consul.io/docs/install#compiling-from-source
 
 SHELL = bash
+PROTOC_VERSION=3.12.3
 GOPROTOVERSION?=$(shell grep github.com/golang/protobuf go.mod | awk '{print $$2}')
 GOTOOLS = \
 	github.com/elazarl/go-bindata-assetfs/go-bindata-assetfs@master \
@@ -342,13 +343,26 @@ else
 	@go test -v ./agent -run Vault
 endif
 
-proto: $(PROTOGOFILES) $(PROTOGOBINFILES)
-	@echo "Generated all protobuf Go files"
+.PHONY: protoc-check
+protoc-check:
+	$(info checking protocol buffer compiler version (expect: $(PROTOC_VERSION)))
+	@if ! command -v protoc &>/dev/null; then \
+		echo "ERROR: protoc is not installed; please install version $(PROTOC_VERSION)" >&2 ; \
+		exit 1 ; \
+	fi
+	@if [[ "$$(protoc --version | cut -d' ' -f2)" != "$(PROTOC_VERSION)" ]]; then \
+		echo "ERROR: protoc version $(PROTOC_VERSION) is required" >&2 ; \
+	fi
 
+proto: protoc-check $(PROTOGOFILES) $(PROTOGOBINFILES)
+	@echo "Generated all protobuf Go files"
 
 %.pb.go %.pb.binary.go: %.proto
 	@$(SHELL) $(CURDIR)/build-support/scripts/proto-gen.sh --grpc --import-replace "$<"
 
+# utility to echo a makefile variable (i.e. 'make print-PROTOC_VERSION')
+print-%  : ; @echo $($*)
+
 .PHONY: module-versions
 # Print a list of modules which can be updated.
 # Columns are: module current_version date_of_current_version latest_version